blob: ca9b0a1f9340158c048f545d3560cc42d6bf1887 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
{ config, lib, ... }:
let
cfg = config.addons.remote_builder;
in
{
options.addons.remote_builder = {
enable = lib.mkEnableOption "Enable remote builder support";
allowedKeyFiles = lib.mkOption {
default = [ ];
example = [ ../secrets/example.pub ];
description = "Public key files that are allowed on the remote builder";
};
allowedKeys = lib.mkOption {
default = [ ];
example = [ "ssh-ed25519 ... user@example.com" ];
description = "Public keys that are allowed on the remote builder";
};
emulatedSystems = lib.mkOption {
default = [ ];
example = [ "aarch64-linux" ]; # TODO: This probably has a nice type that could be used
description = "Allow the remote builder to emultate builds for certain architectures";
};
openFirewall = lib.mkEnableOption "Forces the ssh port open for the remote builder";
};
config = lib.mkIf cfg.enable (
lib.mkMerge [
{
users.users.remotebuild = {
isSystemUser = true;
group = "remotebuild";
useDefaultShell = true;
# Add keys to remotebuild user.
openssh.authorizedKeys = {
keyFiles = cfg.allowedKeyFiles;
keys = cfg.allowedKeys;
};
};
users.groups.remotebuild = { };
nix = {
nrBuildUsers = 64;
settings = {
trusted-users = [ "remotebuild" ];
min-free = 10 * 1024 * 1024;
max-free = 200 * 1024 * 1024;
max-jobs = "auto";
cores = 8;
};
};
boot.binfmt.emulatedSystems = cfg.emulatedSystems;
# TODO: Make a good default module for ssh.
services.openssh = {
enable = true;
settings.AllowUsers = [ "remotebuild" ];
};
}
# Open firewall for ssh if not open already, not really recommended unless the server is meant to be public.
(lib.mkIf cfg.openFirewall {
services.openssh.openFirewall = lib.mkForce true;
})
]
);
}
|
