gross

nixos/module/hectic/service/gitea-runner-controller.nix

@@ -47,12 +47,14 @@ let
       "GITEA_REGISTRATION_TOKEN_FILE=${registrationTokenPath}"
       "GITEA_ADMIN_TOKEN_FILE=${config.sops.secrets."${secretPrefix}/admin-token".path}"
       "GCR_SSH_PRIVKEY_FILE=${config.sops.secrets."${secretPrefix}/ssh-private-key".path}"
+      "GCR_HCLOUD_SSH_KEY_ID=${toString cfg.hcloudSshKeyId}"
       "GCR_NIX_VERSION=${cfg.nixVersion}"
       "GCR_NIX_TARBALL_SHA256=${cfg.nixTarballSha256}"
       "GCR_ARM_NIX_TARBALL_SHA256=${cfg.armNixTarballSha256}"
       "GCR_ACT_RUNNER_VERSION=${cfg.actRunnerVersion}"
       "GCR_ACT_RUNNER_SHA256=${cfg.actRunnerSha256}"
     ]
+    ++ lib.optional (cfg.debugSshPublicKey != null) "\"GCR_DEBUG_SSH_PUBKEY=${cfg.debugSshPublicKey}\""
     ++ lib.optionals (cfg.imageId != null) [ "GCR_IMAGE_ID=${cfg.imageId}" ]
     ++ lib.optionals (cfg.armImageId != null) [ "GCR_ARM_IMAGE_ID=${cfg.armImageId}" ]
     ++ lib.optionals (cfg.nixImageId != null) [ "GCR_NIX_IMAGE_ID=${cfg.nixImageId}" ]
@@ -177,6 +179,11 @@ in
           used by gcr_bootstrap_script documentation).
         '';
       };
+      hcloudSshKeyId = lib.mkOption {
+        type = lib.types.nullOr lib.types.ints.positive;
+        default = null;
+        description = "Hetzner project SSH key ID injected into ephemeral VMs at creation.";
+      };
       bootstrapSshPrivateKeyFile = lib.mkOption {
         type = lib.types.path;
         description = ''

nixos/system/hectic-lab/hectic-lab.nix

@@ -109,7 +109,7 @@ in {
       # NOTE(yukkop): ephemeral Hetzner VM runners (1 VM = 1 job).
       # Runbook: infra/gitea-runners/runbook.md "Ephemeral VM runner cutover".
       enable  = true;
-      imageId = "424558114"; # MicroOS x86 + Hetzner datasource dhcpcd fix
+      imageId = "429564260"; # MicroOS x86 + persistent controller SSH key
       armImageId = "423979717"; # OpenSUSE MicroOS ARM K3S 2026-08-24 snapshot
       nixImageId = "161547269"; # Ubuntu 24.04 x86; Nix needs writable root
       armNixImageId = "161547270"; # Ubuntu 24.04 ARM; Nix needs writable root
@@ -119,7 +119,8 @@ in {
         "hectic-lab/*"
       ];
       # FIXME(yukkop): debug key for bootstrap debugging; remove once E2E stable.
-      debugSshPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJBLxMo5icX2Xyng7mcWGnIi+c4ZbVygjPhuU8noCkfZ yukkop@nixos";
+    debugSshPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBSWIv80pyCMDQ6zH34P2qWizpOcO7X86BVhMGtbob9U gcr-controller@hectic-lab";
+    hcloudSshKeyId = 118512401;
     };
   };