chore: serialize ssh bootstrap key repairs

2026-06-24 22:16:05 +00:00
parent 439021f798
commit 31abf40722
1 changed files with 8 additions and 0 deletions
@@ -44,6 +44,14 @@ lib.mkIf userExists {
      set -eu

      PASSPHRASE=$(cat /var/lib/secrets/ssh-passphrase)
+      lock_dir="${keyPath}.lock"
+
+      if ! mkdir "$lock_dir"; then
+        echo "Factory SSH key setup is already running." >&2
+        exit 1
+      fi
+
+      trap 'rmdir "$lock_dir"' EXIT

      generate_factory_key() {
        ssh-keygen -q -N "$PASSPHRASE" -t ed25519 -f "${keyPath}"