pederbs/config
2
2
Fork 0
Code Issues Pull Requests Releases Activity

remote builds: letsgooo

Browse Source
This commit is contained in:
Peder Bergebakken Sundt
2024-07-31 21:35:42 +02:00
parent 592fec9763
commit 28ceff5e72
5 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
profiles/remote-builders.nix
+6 -6
View File
@@ -5,7 +5,7 @@
# TODO: https://github.com/winterqt/darwin-build-box
let
inherit (builtins) map fromTOML readFile elem attrNames;
inherit (builtins) map fromTOML readFile elem attrNames attrValues;
inherit (lib) mkIf;
hosts' = fromTOML (readFile ../hosts/known-hosts.toml); # TODO: eww
@@ -18,7 +18,7 @@ let
hostNames = attrNames hosts;
thisHost = hosts.${config.networking.fqdn};
thisHostIsBuilder = thisHost.maxJobs > 0;
thisHostIsHopHost = builtins.elem config.networking.fqdn (lib.forEach hosts (host: host.ssh.proxyJump or null));
thisHostIsHopHost = builtins.elem config.networking.fqdn (lib.forEach (attrValues hosts) (host: host.ssh.proxyJump or null));
thisHostIsConsumer = thisHost.ssh ? userPublicKey;
mkRemoteConfig = fqdn: let
@@ -55,15 +55,15 @@ let
})
# in
(mkIf ((thisHostIsBuilder || thisHostIsHopHost) && isConsumer) {
nix.settings.allowed-users = [ thisHost.ssh.listenUser ];
nix.settings.trusted-users = [ thisHost.ssh.listenUser ];
users.users.${thisHost.ssh.listenUser} = {
isSystemUser = lib.mkDefault (!config.users.users.${thisHost.ssh.listenUser}.isNormalUser);
openssh.authorizedKeys.keys = [ host.ssh.userPublicKey ];
group = lib.mkOptionDefault "nogroup";
};
})
(mkIf (thisHostIsBuilder && isConsumer) {
nix.settings.allowed-users = [ thisHost.ssh.listenUser ];
nix.settings.trusted-users = [ thisHost.ssh.listenUser ];
})
]);