linux - NixOps:如何部署到现有的 NixOS VM？

Question

我遇到了与这个问题几乎相同的问题，但从未得到回答:

nixops: how to use local ssh key when deploying on machine with existing nixos (targetEnv is none)?

虽然我没有使用 Terraform。只是 NixOS + NixOps。到目前为止，我:

• 在 Vultr 上创建了一个新的 VM
• 是否从当前的 iso(20.09 之前的东西)安装了标准的 NixOS，设置了 root 密码
• 使用 root 密码身份验证启用 ssh 并进行了 nixos-rebuild 切换
• 在我的笔记本电脑上手动生成了一个 ssh key 对
• ssh使用密码进入 VM，并将公钥添加到 /root/.ssh/authorized_keys

现在我可以使用新 key 手动通过 ssh 进入 VM，正如预期的那样:

ssh -i .secrets/vultrtest1_rsa root@XXX.XXX.XXX.XXX

很酷。接下来，我将现有的 NixOS 配置文件复制到我的笔记本电脑，并尝试将它们连接到 NixOps。我尝试了一个最小的 test1.nix，并添加了 deployment."none" 和/或 users.users.root.openssh 部分下面。

vultrtest1
├── configuration.nix
└── hardware-configuration.nix
test1.nix

# test1.nix
{
  network.description = "vultr test 1";
  network.enableRollback = true;

  vultrtest1 = { config, pkgs, ... } : {
    deployment.targetHost = "XXX.XXX.XXX.XXX";
    imports = [ ./vultrtest1/configuration.nix ];

    # deployment.targetEnv = "none"; # existing nixos vm

    # same result with or without this section:
    deployment."none" = {
      sshPrivateKey = builtins.readFile ./secrets/vultrtest1_rsa;
      sshPublicKey  = builtins.readFile ./secrets/vultrtest1_rsa.pub;
      sshPublicKeyDeployed = true;
    };

    # same result with or without this:
    users.users.root.openssh.authorizedKeys.keyFiles = [ ./secrets/vultrtest1_rsa.pub ];
  };

}

在所有情况下，当我尝试创建和部署网络时，NixOps 会尝试生成另一个 SSH key ，然后无法使用它登录:

$ nixops create test1.nix -d test1
created deployment ‘b4ac25fa-c842-11ea-9a84-00163e5e6c00’
b4ac25fa-c842-11ea-9a84-00163e5e6c00

$ nixops list
+--------------------------------------+-------+------------------------+------------+------+
| UUID                                 | Name  | Description            | # Machines | Type |
+--------------------------------------+-------+------------------------+------------+------+
| b4ac25fa-c842-11ea-9a84-00163e5e6c00 | test1 | Unnamed NixOps network |          0 |      |
+--------------------------------------+-------+------------------------+------------+------+

$ nixops deploy -d test1                                                             
vultrtest1> generating new SSH keypair... done
root@XXX.XXX.XXX.XXX: Permission denied (publickey,keyboard-interactive).
vultrtest1> could not connect to ‘root@XXX.XXX.XXX.XXX’, retrying in 1 seconds...
root@XXX.XXX.XXX.XXX: Permission denied (publickey,keyboard-interactive).
vultrtest1> could not connect to ‘root@XXX.XXX.XXX.XXX’, retrying in 2 seconds...
root@XXX.XXX.XXX.XXX: Permission denied (publickey,keyboard-interactive).
vultrtest1> could not connect to ‘root@XXX.XXX.XXX.XXX’, retrying in 4 seconds...
root@XXX.XXX.XXX.XXX: Permission denied (publickey,keyboard-interactive).
vultrtest1> could not connect to ‘root@XXX.XXX.XXX.XXX’, retrying in 8 seconds...
root@XXX.XXX.XXX.XXX: Permission denied (publickey,keyboard-interactive).
Traceback (most recent call last):
  File "/nix/store/kybdy5m979h4kvswq2gx3la3rpw5cq5k-nixops-1.7/bin/..nixops-wrapped-wrapped", line 991, in <module>
    args.op()
  File "/nix/store/kybdy5m979h4kvswq2gx3la3rpw5cq5k-nixops-1.7/bin/..nixops-wrapped-wrapped", line 412, in op_deploy
    max_concurrent_activate=args.max_concurrent_activate)
  File "/nix/store/kybdy5m979h4kvswq2gx3la3rpw5cq5k-nixops-1.7/lib/python2.7/site-packages/nixops/deployment.py", line 1063, in deploy
    self.run_with_notify('deploy', lambda: self._deploy(**kwargs))
  File "/nix/store/kybdy5m979h4kvswq2gx3la3rpw5cq5k-nixops-1.7/lib/python2.7/site-packages/nixops/deployment.py", line 1052, in run_with_notify
    f()
  File "/nix/store/kybdy5m979h4kvswq2gx3la3rpw5cq5k-nixops-1.7/lib/python2.7/site-packages/nixops/deployment.py", line 1063, in <lambda>
    self.run_with_notify('deploy', lambda: self._deploy(**kwargs))
  File "/nix/store/kybdy5m979h4kvswq2gx3la3rpw5cq5k-nixops-1.7/lib/python2.7/site-packages/nixops/deployment.py", line 996, in _deploy
    nixops.parallel.run_tasks(nr_workers=-1, tasks=self.active_resources.itervalues(), worker_fun=worker)
  File "/nix/store/kybdy5m979h4kvswq2gx3la3rpw5cq5k-nixops-1.7/lib/python2.7/site-packages/nixops/parallel.py", line 44, in thread_fun
    result_queue.put((worker_fun(t), None, t.name))
  File "/nix/store/kybdy5m979h4kvswq2gx3la3rpw5cq5k-nixops-1.7/lib/python2.7/site-packages/nixops/deployment.py", line 979, in worker
    os_release = r.run_command("cat /etc/os-release", capture_stdout=True)
  File "/nix/store/kybdy5m979h4kvswq2gx3la3rpw5cq5k-nixops-1.7/lib/python2.7/site-packages/nixops/backends/__init__.py", line 337, in run_command
    return self.ssh.run_command(command, self.get_ssh_flags(), **kwargs)
  File "/nix/store/kybdy5m979h4kvswq2gx3la3rpw5cq5k-nixops-1.7/lib/python2.7/site-packages/nixops/ssh_util.py", line 280, in run_command
    master = self.get_master(flags, timeout, user)
  File "/nix/store/kybdy5m979h4kvswq2gx3la3rpw5cq5k-nixops-1.7/lib/python2.7/site-packages/nixops/ssh_util.py", line 200, in get_master
    compress=self._compress)
  File "/nix/store/kybdy5m979h4kvswq2gx3la3rpw5cq5k-nixops-1.7/lib/python2.7/site-packages/nixops/ssh_util.py", line 57, in __init__
    "‘{0}’".format(target)
nixops.ssh_util.SSHConnectionFailed: unable to start SSH master connection to ‘root@XXX.XXX.XXX.XXX’

我错过了什么？也许我可以手动添加刚刚生成的 NixOps key ？

更新:我使用了 SQLiteBrowser查看 NixOps 状态数据库并将生成的公钥粘贴到 authorized_keys 中。现在我可以手动使用新生成的 key ssh 登录，但 NixOps 仍然无法部署。

Answer 1

以一种不太令人满意的方式暂时解决了它:

• 浏览数据库以查找 NixOps 生成的公钥和私钥
• 手动将这些添加到 VM 上的 authorized_keys
• 还将旧 key 添加到本地 ~/.ssh 并在 ~/.ssh/config 中添加一个条目>

不知道为什么 NixOps 使用本地 ssh 配置，或者如何防止这种情况。有效的条目如下所示:

Host XXX.XXX.XXX.XXX
  HostName XXX.XXX.XXX.XXX
  Port 22
  User root
  IdentityFile ~/.ssh/vultrtest1_rsa

将等待几天，然后将此标记为解决方案，除非有人可以解释如何告诉 NixOps 使用 .secrets 中的本地 key 而不是 ~/.ssh.