Repository navigation
git githubAuth.nix: the user's PAT as Nix access-tokens, user-level only - #53
Merged
Merged
Conversation
homeSpec.programs.git.githubAuth.nix.enable derives a clan var nix-access-tokens-<user> from the existing github-<user> PAT (no new prompt) and !includes it from the user's ~/.config/nix/nix.conf, so nix can fetch private github: inputs. The system nix.conf is never touched: an included line that is not `key = value` is a hard syntax error for every nix command, which in /etc/nix/nix.conf took down the daemon and activation and needed a GRUB rollback. The generator validates the token shape so a bad value fails at `clan vars generate`, and !include skips a missing or unreadable file before the var is deployed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
andrewthomaslee
enabled auto-merge (squash)
November 15, 2026 00:34
andrewthomaslee
added a commit
to external-systems/home
that referenced
this pull request
Nov 15, 2026
## Summary Bumps `modules` to external-systems/modules#53 (merged) and turns on `githubAuth.nix` for netsa and matt. Nix fetches private `github:` inputs with the user's existing `github-<user>` PAT, and only that user's own nix config ever sees it. ```diff users/netsa/default.nix, users/matt/default.nix - githubAuth.enabled = true; + githubAuth = { + enabled = true; + nix.enable = true; # ~/.config/nix/nix.conf: !include <nix-access-tokens-<user>> + }; vars/shared/ + nix-access-tokens-netsa/ (beelink, ghost, kamrui-h1, nixos) + nix-access-tokens-matt/ (beelink) documentation/docs/fleet/github-token-rotation.md + where nix gets the token; the runbook regenerates nix-access-tokens-<user> too ``` The vars were generated on this branch (`clan vars generate beelink`; the vars are shared, so both users are covered). There were no new prompts: each var is derived from `github-<user>/pat`. ## Evidence - **Before:** outside devenv, nix has no GitHub token, so private inputs (`secrets`) 404. **After:** kamrui-h1's netsa home-manager `nix.extraOptions` evaluates to `!include <deployed nix-access-tokens-netsa path>` (before generation it was `!include /no-such-path`, which Nix skips). - Each generator checks the token shape (`^(ghp_|github_pat_)…`) and both PATs passed. A malformed token would have failed `clan vars generate`. - `clan vars check`: "All vars are present and valid" for beelink, euc-hel-0, ghost, hp-notebook, kamrui-h1 and nixos. - `fmt`: 0 changed. `check`: exit 0. ## Merge Danger **Door:** two-way The system `/etc/nix/nix.conf` is unchanged, so the daemon, activation and boot never read the token. Roll back by turning off `nix.enable`. **Blast Radius:** per-user If the token is revoked, only that user's github.com fetches fail. Override for one shell with `NIX_CONFIG='access-tokens ='`. Takes effect on each machine at its next deploy (kamrui-h1, beelink, ghost, nixos). Merge order: modules#53 (merged), then this PR. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
New opt-in
homeSpec.programs.git.githubAuth.nix.enable: the user's existinggithub-<user>PAT also authenticates Nix (privategithub:flake inputs), only in that user's own nix config.flake-parts/homeModules/git.nix:githubAuth.nix.{enable,accessTokensFile}, the!include, and an assertion that it needsgithubAuth.enabled.flake-parts/nixosModules/git.nix: declares the derived generator for opted-in users and feeds its path in through the existingsharedModuleshook, the same way it doespatFile.tests/fixtures/nixos.nix: toggle on, soeval-all-enabledcovers it.Why user-level only: if an included line isn't
key = value, everynixcommand fails withsyntax error in configuration line. A raw PAT!included into/etc/nix/nix.confbroke the daemon and activation, and the only way back was a GRUB rollback (home history before887d030). The fetchers run in the client process, so the token never has to reach the system config.Evidence
Nix 2.34
!includebehaviour, tested with fake tokens:access-tokens = github.com=…error: syntax error in configuration line(every nix command)Generator script with fake inputs:
ghp_…and paddedgithub_pat_…→ rc 0,nix config showparses the output;oops not a tokenand empty → rc 1, no file written.Fixture eval: generators
github-alice,nix-access-tokens-alice; alice'snix.extraOptions=!include /run/secrets/vars/nix-access-tokens-alice/access-tokens.conf.fmt: 0 changed.check(nix run .#flake-check): exit 0. No VM test, as the owner asked (small feature).Merge Danger
Door: two-way
Off by default; nothing changes until a profile sets
githubAuth.nix.enable.Blast Radius: per-user
When enabled, the worst case (expired or revoked token) breaks only that user's github.com fetches, including public ones. Override for one shell with
NIX_CONFIG='access-tokens ='or skip the user config withNIX_USER_CONF_FILES=/dev/null. The daemon, activation and boot never read the file. After rotatinggithub-<user>, regeneratenix-access-tokens-<user>as well.Merge order: this PR, then home bumps
modulesand enables the toggle for netsa and matt.🤖 Generated with Claude Code