2 files changed, 71 insertions, 0 deletions
diff --git a/modules/default.nix b/modules/default.nix
index 786c440..dc1d2f6 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -5,6 +5,7 @@
     ./gpg.nix
     ./btrfs.nix
     ./vpn.nix
+    ./remote-builder.nix
   ];
 
 }
diff --git a/modules/remote-builder.nix b/modules/remote-builder.nix
new file mode 100644
index 0000000..ddd9a99
--- /dev/null
+++ b/modules/remote-builder.nix
@@ -0,0 +1,70 @@
+{config, lib,...}:
+let
+cfg = config.addons.remote_builder; 
+in 
+{
+  options.addons.remote_builder = {
+    enable = lib.mkEnableOption "Enable remote builder support"; 
+    allowedKeyFiles = lib.mkOption {
+      default = []; 
+      example = [../secrets/example.pub];  
+      description = "Public key files that are allowed on the remote builder"; 
+    };
+    allowedKeys = lib.mkOption {
+      default = []; 
+      example = ["ssh-ed25519 ... user@example.com"];  
+      description = "Public keys that are allowed on the remote builder"; 
+    };
+    emulatedSystems = lib.mkOption {
+      default = []; 
+      example = ["aarch64-linux"];  # TODO: This probably has a nice type that could be used
+      description = "Allow the remote builder to emultate builds for certain architectures";  
+    }; 
+    openFirewall = lib.mkEnableOption "Forces the ssh port open for the remote builder"; 
+  };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    {
+      users.users.remotebuild = {
+        isSystemUser = true; 
+        group = "remotebuild";
+        useDefaultShell = true; 
+        # Add keys to remotebuild user.
+        openssh.authorizedKeys = { 
+          keyFiles = cfg.allowedKeyFiles; 
+          keys = cfg.allowedKeys; 
+        };
+      };
+
+      users.groups.remotebuild = {}; 
+      nix = {
+        nrBuildUsers = 64;
+        settings = {
+          trusted-users = [ "remotebuild" ];
+
+          min-free = 10 * 1024 * 1024;
+          max-free = 200 * 1024 * 1024;
+
+          max-jobs = "auto";
+          cores = 8;
+        };
+      };
+
+      boot.binfmt.emulatedSystems = cfg.emulatedSystems;  
+
+
+      # TODO: Make a good default module for ssh. 
+      services.openssh = {
+        enable = true; 
+        settings.AllowUsers = ["remotebuild"];
+      };
+    }  
+
+    # Open firewall for ssh if not open already, not really recommended unless the server is meant to be public. 
+    (lib.mkIf cfg.openFirewall {
+      services.openssh.openFirewall = lib.mkForce true; 
+    }) 
+  ]);
+
+
+}