NixOS: declare the agent with services.step-agent; document edge releases - #552
Open
tashian wants to merge 2 commits into
Open
NixOS: declare the agent with services.step-agent; document edge releases#552tashian wants to merge 2 commits into
tashian wants to merge 2 commits into
Conversation
…ases Rewrite the NixOS install section around one services.step-agent block: import the module, enable it, and declare team and fingerprint in settings. The rebuild installs the package, starts the agent, and the device enrolls on first start once it has been added via the API, so the interactive register step goes away for fleets. Interactive registration stays as the alternative for empty settings. Add an "Edge releases" subsection: point services.step-agent.package at an overrideAttrs of pkgs.step-agent with the edge tarball URL on packages.smallstep.com and the hex sha256 from the release manifest, which Nix accepts as-is. Name the error a TPM-less host hits, update the uninstall step, and note that on NixOS the unit's gate is ConditionPathExists=. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
With settings declared, agent.yaml is a store symlink, so document the --skip-config form of register, which registers the device without attempting to rewrite the declared file. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes EFF-696.
Rewrites the NixOS install section of the Smallstep Agent page and adds edge-release instructions. Replaces the
smallstep-agent.mdxhalf of #549 (itsenvironment.etcparagraph is subsumed bysettings). #549'stroubleshooting-agent.mdxwording, which rewrites the quoted condition toConditionPathExists=, is not included here: it depends on the deb/rpm unit change and should land with it.What changed
services.step-agentblock. Import the module, setenable = true, and declareteamandfingerprintinsettings.nixos-rebuild switchinstalls the package, starts the agent, and the device enrolls on first start once it has been added via the API. The interactivestep-agent registerstep is now the alternative for emptysettings, not the default.services.step-agent.packageat anoverrideAttrsofpkgs.step-agentwith the edge tarball URL onpackages.smallstep.comand the hexsha256from the release manifest, which Nix accepts as-is.ConditionPathExists=.The
services.step-agentmodule withenable/settingsships fromfiles.smallstep.com/step-agent.nixand has the same option surface as the module proposed upstream in NixOS/nixpkgs#555971, so theimportsline is the only thing that changes once that lands.The
--skip-confignote exists becauseregistersilently drops a failed config write; that is filed as OFF-21.Verified
Followed the new section on a nixos-unstable aarch64 VM: install, all units enabled,
agent.yamlrendered fromsettings,step-agent versionoutput as shown, and the edge override switching the running agent to 0.69.2. The example hash in the edge snippet is the real one forstep-agent_0.69.2_linux_amd64.tar.gz.files.smallstep.com, otherwise step 3'senable/settingsoptions don't exist for readers yet.🤖 Generated with Claude Code