38 lines
1.2 KiB
Nix
38 lines
1.2 KiB
Nix
# Module that enables remote builds. This is a server configuration.
|
|
{ pkgs, secret, lib, ... }: let
|
|
keyPath = "/root/.nixbuilder";
|
|
in {
|
|
# Service that generates new key on boot if not present.
|
|
# Don't forget to add new key to secret.ssh.buildKeys.
|
|
systemd.services.generate-nix-cache-key = {
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig.Type = "oneshot";
|
|
path = [ pkgs.nix ];
|
|
script = ''
|
|
[[ -f "${keyPath}/private-key" ]] && exit
|
|
mkdir ${keyPath} || true
|
|
nix-store --generate-binary-cache-key "nixbuilder-1" "${keyPath}/private-key" "${keyPath}/public-key"
|
|
nix store sign --all -k "${keyPath}/private-key"
|
|
'';
|
|
};
|
|
|
|
# Add `nixbuilder` restricted user.
|
|
users.groups.nixbuilder = {};
|
|
users.users.nixbuilder = {
|
|
openssh.authorizedKeys.keys = secret.ssh.buildKeys;
|
|
description = "Nix Remote Builder";
|
|
isNormalUser = true;
|
|
createHome = lib.mkForce false;
|
|
uid = 1234;
|
|
home = "/";
|
|
group = "nixbuilder";
|
|
};
|
|
|
|
# Sign store automatically.
|
|
# Sign existing store with: nix store sign --all -k /path/to/secret-key-file
|
|
nix.settings = {
|
|
trusted-users = [ "nixbuilder" ];
|
|
secret-key-files = [ "${keyPath}/private-key" ];
|
|
};
|
|
}
|