diff options
| -rw-r--r-- | common.nix | 5 | ||||
| -rw-r--r-- | flake.nix | 1 | ||||
| -rw-r--r-- | hosts/apocalypse/default.nix | 11 | ||||
| -rw-r--r-- | hosts/apocalypse/firewall.nix | 4 | ||||
| -rw-r--r-- | modules/default.nix | 1 | ||||
| -rw-r--r-- | modules/remote-builder.nix | 70 | ||||
| -rw-r--r-- | secrets/eli.pub | 2 | ||||
| -rw-r--r-- | users/remote-build.nix | 16 |
8 files changed, 89 insertions, 21 deletions
@@ -34,6 +34,11 @@ dates = "weekly"; options = "--delete-older-than 30d"; }; + systemd.services.nix-daemon.serviceConfig = { + MemoryAccounting = true; + MemoryMax = "90%"; + OOMScoreAdjust = 500; + }; environment.systemPackages = with pkgs; [ htop @@ -29,7 +29,6 @@ ./common.nix ./hosts/apocalypse ./users/wilkuu.nix - ./users/remote-build.nix inputs.home-manager.nixosModules.default inputs.sops-nix.nixosModules.sops ]; diff --git a/hosts/apocalypse/default.nix b/hosts/apocalypse/default.nix index c4bffbf..eb9d14c 100644 --- a/hosts/apocalypse/default.nix +++ b/hosts/apocalypse/default.nix @@ -6,6 +6,9 @@ ./backup.nix ./firewall.nix ]; + + ## TODO REMOVE LATER TO PREVENT ELI FROM BUILDING REMOTELY + boot.binfmt.emulatedSystems = ["aarch64-linux"]; ## Addons for this system addons = { @@ -19,6 +22,12 @@ vpn.mullvad.enable = true; vpn.eduvpn.enable = true; gpg.enable = true; + + remote_builder = { + enable = true; + allowedKeyFiles = [../../secrets/eli.pub]; + openFirewall = true; + }; }; boot.loader.grub = { @@ -83,7 +92,7 @@ services.fwupd.enable = true; services.openssh = { - enable = false; + enable = true; ports = [22]; openFirewall = false; allowSFTP = false; diff --git a/hosts/apocalypse/firewall.nix b/hosts/apocalypse/firewall.nix index 26097af..8cf3e61 100644 --- a/hosts/apocalypse/firewall.nix +++ b/hosts/apocalypse/firewall.nix @@ -33,9 +33,9 @@ let ]; in { - networking.nftables.enable = false; + networking.nftables.enable = true; networking.firewall = { - enable = false; + enable = true; checkReversePath = false; allowedTCPPorts = baseTCP; allowedUDPPorts = baseUDP; diff --git a/modules/default.nix b/modules/default.nix index 786c440..dc1d2f6 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -5,6 +5,7 @@ ./gpg.nix ./btrfs.nix ./vpn.nix + ./remote-builder.nix ]; } diff --git a/modules/remote-builder.nix b/modules/remote-builder.nix new file mode 100644 index 0000000..ddd9a99 --- /dev/null +++ b/modules/remote-builder.nix @@ -0,0 +1,70 @@ +{config, lib,...}: +let +cfg = config.addons.remote_builder; +in +{ + options.addons.remote_builder = { + enable = lib.mkEnableOption "Enable remote builder support"; + allowedKeyFiles = lib.mkOption { + default = []; + example = [../secrets/example.pub]; + description = "Public key files that are allowed on the remote builder"; + }; + allowedKeys = lib.mkOption { + default = []; + example = ["ssh-ed25519 ... user@example.com"]; + description = "Public keys that are allowed on the remote builder"; + }; + emulatedSystems = lib.mkOption { + default = []; + example = ["aarch64-linux"]; # TODO: This probably has a nice type that could be used + description = "Allow the remote builder to emultate builds for certain architectures"; + }; + openFirewall = lib.mkEnableOption "Forces the ssh port open for the remote builder"; + }; + + config = lib.mkIf cfg.enable (lib.mkMerge [ + { + users.users.remotebuild = { + isSystemUser = true; + group = "remotebuild"; + useDefaultShell = true; + # Add keys to remotebuild user. + openssh.authorizedKeys = { + keyFiles = cfg.allowedKeyFiles; + keys = cfg.allowedKeys; + }; + }; + + users.groups.remotebuild = {}; + nix = { + nrBuildUsers = 64; + settings = { + trusted-users = [ "remotebuild" ]; + + min-free = 10 * 1024 * 1024; + max-free = 200 * 1024 * 1024; + + max-jobs = "auto"; + cores = 8; + }; + }; + + boot.binfmt.emulatedSystems = cfg.emulatedSystems; + + + # TODO: Make a good default module for ssh. + services.openssh = { + enable = true; + settings.AllowUsers = ["remotebuild"]; + }; + } + + # Open firewall for ssh if not open already, not really recommended unless the server is meant to be public. + (lib.mkIf cfg.openFirewall { + services.openssh.openFirewall = lib.mkForce true; + }) + ]); + + +} diff --git a/secrets/eli.pub b/secrets/eli.pub index c4b902a..687e555 100644 --- a/secrets/eli.pub +++ b/secrets/eli.pub @@ -1 +1 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGt45NZS0gBeiSX4P2ous4oZmPmCJ1dNrNlakVuQCPZf +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHbjit4PoMeg3Y7pBwUL2HT131Zrq8+HB6YSlRQrXsEk elisaado@mixbook diff --git a/users/remote-build.nix b/users/remote-build.nix deleted file mode 100644 index 7993d70..0000000 --- a/users/remote-build.nix +++ /dev/null @@ -1,16 +0,0 @@ -{pkgs, config, ...}: { - - sops.secrets.remote_pub = { - key = "remote/ssh/pub"; - sopsFile = ../secrets/secrets.yaml; - }; - users.users.remotebuild = { - isSystemUser = true; - group = "remotebuild"; - useDefaultShell = true; - openssh.authorizedKeys.keyFiles = [ ../secrets/eli.pub ]; - }; - - users.groups.remotebuild = {}; - nix.settings.trusted-users = [ "remotebuild" ]; -} |