Builder : Specify builder ssh key instead of trustin all.

home/config/ssh/default.nix

@@ -1,27 +1,26 @@
 # SSH client configuration.
 { util, ... }: let
-	mkHost = name: address: port: user: extra: ''
+	mkHost = name: address: port: user: extra: util.trimTabs (''
 		Host ${name}
 			HostName ${address}
 			User ${user}
 			Port ${toString port}
-	'' + extra;
+	'') + extra;
 in {
 	text = util.trimTabs (''
 		Host *
 			ControlMaster auto
 			ControlPath ~/.ssh/%r@%h:%p.socket
 			ControlPersist yes
-	''
+	'')
 	+ mkHost "dasha"      "10.0.0.7"       22143 "root"       ""
 	+ mkHost "desktop"    "10.0.0.3"       22143 "root"       ""
 	+ mkHost "fmpmaven"   "10.30.22.10"    22    "root"       ""
 	+ mkHost "home"       "10.0.0.1"       22143 "root"       ""
 	+ mkHost "laptop"     "192.168.1.9"    22143 "root"       ""
+	+ mkHost "nixbuilder" "10.0.0.1"       22143 "nixbuilder" ""
 	+ mkHost "pi"         "192.168.1.6"    22143 "root"       ""
 	+ mkHost "vpn"        "194.113.233.38" 22143 "root"       ""
 	+ mkHost "work"       "192.168.1.5"    22143 "root"       ""
-
-	+ mkHost "nixbuilder" "10.0.0.1" 22143 "nixbuilder" "	StrictHostKeyChecking=accept-new"
-	);
+	;
 }

module/RemoteBuild.nix

@@ -1,7 +1,7 @@
 { pkgs, lib, config, secret, ... }: with lib; let
 	cfg = config.module.builder;
-
 	serverKeyPath       = "/root/.nixbuilder";
+	serverSshPublicKey  = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFqr7zKGOy/2bbAQCD85Ol+NoGGtvdMbSy3jGb98jM+f"; # Use ssh-keyscan.
 in {
 	options = {
 		module.builder = {
@@ -48,7 +48,9 @@ in {
 
 		(mkIf cfg.client.enable {
 			# NOTE: Requires host public key to be present in secret.ssh.builderKeys.
-			nix.buildMachines = [{
+			nix = {
+				distributedBuilds = true;
+				buildMachines = [{
 					hostName = "nixbuilder";
 					protocol = "ssh-ng";
 					systems  = [
@@ -61,8 +63,7 @@ in {
 					mandatoryFeatures = [ ];
 					supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
 				}];
-			nix.distributedBuilds = true;
-			nix.settings = let
+				settings = let
 					substituters = [ "ssh-ng://nixbuilder" ];
 				in {
 					substituters = mkForce substituters;
@@ -73,6 +74,11 @@ in {
 					# require-sigs = false;
 					# substitute = false;
 				};
+			};
+			services.openssh.knownHosts.nixbuilder = {
+				publicKey      = serverSshPublicKey;
+				extraHostNames = [ "[10.0.0.1]:22143" ];
+			};
 		})
 	];
 }