From f77132133b6433e822ec6ef82244dde424806054 Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Thu, 12 Nov 2026 17:02:56 +0400
Subject: [PATCH] nixos: never commit the staged host key

An install reads the server's SSH host key from nixos/extra/, and that
key also decrypts the server's secrets. Ignore the directory, along
with nix build result links.

Assisted-by: Claude:fable-5-2
---
 nixos/.gitignore | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 nixos/.gitignore

diff --git a/nixos/.gitignore b/nixos/.gitignore
new file mode 100644
index 0000000..0431210
--- /dev/null
+++ b/nixos/.gitignore
@@ -0,0 +1,4 @@
+# Host private keys staged for an install (see README); never commit
+/extra/
+result
+result-*