sshuttle, cleanup

profiles/remote-builders.nix

@@ -33,14 +33,15 @@ let
     isThis = fqdn == config.networking.fqdn;
   in mkIf (!isThis) ( lib.mkMerge [
     # out
-    (lib.mkIf (isBuilder && thisHostIsConsumer) {
+    (lib.mkIf (thisHostIsConsumer && isBuilder) {
 
       nix.buildMachines = [ buildMachine ];
 
     })
     # out or jump
-    (lib.mkIf (host.ssh ? listenPublicKey && thisHostIsConsumer) {
+    (lib.mkIf (thisHostIsConsumer && host.ssh ? listenPublicKey) {
       programs.ssh.knownHosts.${fqdn}.publicKey = host.ssh.listenPublicKey;
+      # TODO: use nix.buildMachines.*.publicHostKey ?
 
       # timeouts are great when remote is unresponsive. nix doesn't care
       programs.ssh.extraConfig = ''
@@ -48,12 +49,12 @@ let
           ConnectTimeout 3
           Port ${builtins.toString host.ssh.listenPort}
           ${lib.optionalString (host.ssh ? proxyJump) ''
-            ProxyJump ${host.ssh.proxyJump}
+            ProxyJump ${jump.ssh.listenUser}@${host.ssh.proxyJump}:${builtins.toString jump.ssh.listenPort}
           ''}
       '';
     })
     # in
-    (mkIf (isConsumer && (thisHostIsBuilder || thisHostIsHopHost) ) {
+    (mkIf ((thisHostIsBuilder || thisHostIsHopHost) && isConsumer) {
 
       nix.settings.allowed-users = [ thisHost.ssh.listenUser ];
       nix.settings.trusted-users = [ thisHost.ssh.listenUser ];