more separation

2026-04-23 16:03:32 -05:00
parent 779310fb2c
commit 250c949bd6
10 changed files with 105 additions and 41 deletions
--- a/modules/features/remoteBuilds.nix
+++ b/modules/features/remoteBuilds.nix
@@ -0,0 +1,65 @@
+{ inputs, ... }: {
+
+    flake.nixosModules.remoteBuilds = { config, lib, ... }: {
+
+        imports = [
+            inputs.sops-nix.nixosModules.sops
+        ];
+
+        config = {
+
+            nix = {
+                settings = {
+                    builders-use-substitutes = (config.sops.secrets ? "remoteBuildKey");
+
+                };
+
+                distributedBuilds = lib.mkDefault (config.sops.secrets ? "remoteBuildKey");
+
+                buildMachines = lib.mkIf (config.sops.secrets ? "remoteBuildKey") [
+                {
+                    hostName = "esotericbytes.com";
+                    sshUser = "remote-builder";
+                    sshKey = config.sops.secrets."remoteBuildKey".path;
+                    supportedFeatures = [
+                        "nixos-test"
+                            "benchmark"
+                            "big-parallel"
+                            "kvm"
+                    ];
+                    systems = [ "x86_64-linux" "aarch64-linux" ];
+                }
+                ];
+
+            };
+
+            users.users."remote-builder" = lib.mkIf (builtins.any
+                (x: (builtins.match "^remoteBuildClientKeys/.+" x) != null) 
+                (builtins.attrNames config.sops.secrets)
+            ) {
+                isNormalUser = true;
+                createHome = false;
+            };
+
+            sops.templates."remote-builder" = lib.mkIf (builtins.any
+                    (x: (builtins.match "^remoteBuildClientKeys/.+" x) != null) 
+                    (builtins.attrNames config.sops.secrets)
+                    )  {
+                content = builtins.concatStringsSep ''''\n'' (builtins.map 
+                        (y: config.sops.placeholder.${y}) 
+                        (builtins.filter 
+                         (x: (builtins.match "^remoteBuildClientKeys/.+" x) != null) 
+                         (builtins.attrNames config.sops.secrets)
+                        )
+                        );
+                path = "/etc/ssh/authorized_keys.d/remote-builder";
+                owner = "remote-builder";
+            };
+
+            sops = {
+                age.keyFile = "/var/lib/sops/age/keys.txt";
+                defaultSopsFormat = "yaml";
+            };
+        };
+    };
+}