fixed priv. escalation race on first deploy

1 files changed, 8 insertions, 5 deletions

diff --git a/nix/deploy.sh b/nix/deploy.sh
index 4459aab..98e48d0 100755
--- a/nix/deploy.sh
+++ b/nix/deploy.sh
@@ -8,6 +8,7 @@ HOST="$1"
 FLAKE=".#${HOST}"
 KEY_DIR="./host-keys/${HOST}"
 USER="${2:-root}"
+TARGET="${3:-switch}"
 
 # Validate
 if [ ! -d "$KEY_DIR" ]; then
@@ -34,10 +35,12 @@ if [ "$LOCAL_FINGERPRINT" != "$REMOTE_FINGERPRINT" ]; then
   echo "   Remote: ${REMOTE_FINGERPRINT}"
   
   # Copy the pre-generated key to replace the VM's auto-generated one
-  scp "${KEY_DIR}/ssh_host_ed25519_key"  "${USER}@${HOST}:/etc/ssh/ssh_host_ed25519_key"
-  scp "${KEY_DIR}/ssh_host_ed25519_key.pub" "${USER}@${HOST}:/etc/ssh/ssh_host_ed25519_key.pub"
-  ssh "${USER}@${HOST}" chmod 600 /etc/ssh/ssh_host_ed25519_key
-  ssh "${USER}@${HOST}" chmod 644 /etc/ssh/ssh_host_ed25519_key.pub
+  scp "${KEY_DIR}/ssh_host_ed25519_key"  "${USER}@${HOST}:/tmp/ssh_host_ed25519_key"
+  scp "${KEY_DIR}/ssh_host_ed25519_key.pub" "${USER}@${HOST}:/tmp/ssh_host_ed25519_key.pub"
+  ssh "${USER}@${HOST}" sudo cp /tmp/ssh_host_ed25519_key /etc/ssh/ssh_host_ed25519_key
+  ssh "${USER}@${HOST}" sudo cp /tmp/ssh_host_ed25519_key.pub /etc/ssh/ssh_host_ed25519_key.pub
+  ssh "${USER}@${HOST}" sudo chmod 600 /etc/ssh/ssh_host_ed25519_key
+  ssh "${USER}@${HOST}" sudo chmod 644 /etc/ssh/ssh_host_ed25519_key.pub
   
   echo "→ [${HOST}] Key replaced. You may get a WARNING on next SSH (host key changed)."
   echo "   Remove old key with: ssh-keygen -R ${HOST}"
@@ -47,7 +50,7 @@ fi
 
 # Deploy
 echo "→ [${HOST}] Deploying with nixos-rebuild..."
-nixos-rebuild switch \
+nixos-rebuild "$TARGET" \
   --flake "$FLAKE" \
   --target-host "${USER}@${HOST}" \
   --sudo