1 files changed, 50 insertions, 0 deletions
diff --git a/nix/deploy.sh b/nix/deploy.sh
new file mode 100755
index 0000000..d3ad649
--- /dev/null
+++ b/nix/deploy.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+HOST="$1"
+FLAKE=".#${HOST}"
+KEY_DIR="./host-keys/${HOST}"
+USER="${2:-root}"
+
+# Validate
+if [ ! -d "$KEY_DIR" ]; then
+  echo "❌ No host key directory found for '${HOST}'"
+  exit 1
+fi
+
+# Validate the per-host secrets file exists
+SECRETS_FILE="secrets/${HOST}.yaml"
+if [ ! -f "$SECRETS_FILE" ]; then
+  echo "❌ No secrets file found at ${SECRETS_FILE}"
+  echo "   Run: sops ${SECRETS_FILE}"
+  exit 1
+fi
+
+
+# ---- Compare host key fingerprints and replace if different ----
+LOCAL_FINGERPRINT=$(ssh-keygen -lf "${KEY_DIR}/ssh_host_ed25519_key.pub" 2>/dev/null | awk '{print $2}')
+REMOTE_FINGERPRINT=$(ssh "${USER}@${HOST}" ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub 2>/dev/null | awk '{print $2}')
+
+if [ "$LOCAL_FINGERPRINT" != "$REMOTE_FINGERPRINT" ]; then
+  echo "→ [${HOST}] Host key mismatch! Replacing..."
+  echo "   Local:  ${LOCAL_FINGERPRINT}"
+  echo "   Remote: ${REMOTE_FINGERPRINT}"
+  
+  # Copy the pre-generated key to replace the VM's auto-generated one
+  scp "${KEY_DIR}/ssh_host_ed25519_key"  "${USER}@${HOST}:/etc/ssh/ssh_host_ed25519_key"
+  scp "${KEY_DIR}/ssh_host_ed25519_key.pub" "${USER}@${HOST}:/etc/ssh/ssh_host_ed25519_key.pub"
+  ssh "${USER}@${HOST}" chmod 600 /etc/ssh/ssh_host_ed25519_key
+  ssh "${USER}@${HOST}" chmod 644 /etc/ssh/ssh_host_ed25519_key.pub
+  
+  echo "→ [${HOST}] Key replaced. You may get a WARNING on next SSH (host key changed)."
+  echo "   Remove old key with: ssh-keygen -R ${HOST}"
+else
+  echo "→ [${HOST}] Host keys match, no action needed"
+fi
+
+# Deploy
+echo "→ [${HOST}] Deploying with nixos-rebuild..."
+nixos-rebuild switch \
+  --flake "$FLAKE" \
+  --target-host "${USER}@${HOST}" \
+  --sudo