nixbld-remote

flake.nix

@@ -169,7 +169,7 @@
       #  file = ./secrets/${hostname}.yaml;
       #  exists = builtins.pathExists file;
       #  yaml = lib.removeAttrs (lib.importYAML file) ["sops"];
-      #  secrets = lib.attrNames yaml;
+      #  secrets = lib.attrNames yaml; # TODO: recurse
       #in
       #  if !exists then {} else lib.mkMerge (lib.forEach secrets (secret:
       #    lib.mkIf (config.sops.secrets ? secret) {

hosts/eple/configuration.nix

@@ -5,6 +5,10 @@
   boot.loader.efi.canTouchEfiVariables = true;
   boot.loader.efi.efiSysMountPoint = "/boot/efi";
 
+  boot.binfmt.emulatedSystems = [
+    "aarch64-linux"
+  ];
+
   services.nfs.server.enable = false; # TODO: remove?
 
   imports = [

hosts/known-hosts.toml

@@ -12,10 +12,10 @@
 # ssh.listenUser
 # ssh.listenPort
 # ssh.listenPublicKey   # cat /etc/ssh/ssh_host_ed25519_key.pub || ssh-keyscan {{fqdn}}
-# ssh.userPublicKey   # sudo ssh-keygen -t ed25519 && sudo cat /root/.ssh/id_ed25519.pub
 # ssh.proxyJump         # optional hostname
-# ssh.userPrivateKey # optional IdentityFile to use
 # ssh.connectTimeout
+# ssh.userPrivateKey    # optional IdentityFile to use
+# ssh.userPublicKey     # sudo ssh-keygen -t ed25519 && sudo cat /root/.ssh/id_ed25519.pub
 
 
 # buildMachine.supportedFeatures:
@@ -32,8 +32,8 @@ buildMachine.speedFactor = 1
 buildMachine.supportedFeatures = []
 buildMachine.mandatoryFeatures = []
 buildMachine.protocol = "ssh" # "ssh-ng"
-ssh.listenUser = "pbsds" # TODO: change
+# ssh.listenUser = "pbsds" # TODO: change
-# ssh.listenUser = "nixbld-remote"
+ssh.listenUser = "nixbld-remote"
 ssh.listenPort = 22
 ssh.connectTimeout = 3
 
@@ -41,6 +41,7 @@ ssh.connectTimeout = 3
 #   headless:  one job per 4 threads and 8GB RAM
 #   graphical: one job
 
+
 ["bolle.pbsds.net"]
 buildMachine.systems = ["x86_64-linux", "i686-linux", "riscv64-linux"]
 buildMachine.maxJobs = 3 # 12 threads 32GB
@@ -51,6 +52,7 @@ ssh.proxyJump = "isvegg.pvv.ntnu.no"
 
 ["eple.pbsds.net"] # r9 290x
 aliases = [ "eple.tail9aac63.ts.net" ]
+buildMachine.systems = ["x86_64-linux", "i686-linux", "aarch64-linux"]
 buildMachine.maxJobs = 3 # 12 threads 32GB
 buildMachine.speedFactor = 3 # i7-5820K
 buildMachine.supportedFeatures = ["kvm", "big-parallel", "nixos-test"]
@@ -108,6 +110,7 @@ ssh.listenPort = 2222
 ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILD7+tE6rm742fz+nqa3+zlglMuzCzOQlc0OSJssvgVL"
 ssh.userPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJVohqGMKp/UEZtb71RSBBXOEGX4o3lN5GYBlP7HEKbs root@brumlebasse"
 
+
 ["isvegg.pvv.ntnu.no"]
 # buildMachine.maxJobs = 1 # 4 threads 16GB
 buildMachine.speedFactor = 1 # i5-3570

profiles/known-hosts.nix

@@ -4,8 +4,15 @@
 # TODO: https://exozy.me/about
 
 let
-  inherit (builtins) map fromTOML readFile elem attrNames attrValues;
+  inherit (builtins)
-  inherit (lib) mkIf;
+    map
+    fromTOML
+    toString
+    readFile
+    elem
+    attrNames
+    attrValues
+    ;
 
   known-hosts = let
     known-hosts' = lib.importTOML ../hosts/known-hosts.toml; # TODO: eww
@@ -13,14 +20,13 @@ let
     lib.pipe known-hosts' [
       (lib.flip lib.removeAttrs ["__default__"])
       (lib.mapAttrs (fqdn: host:
-        lib.recursiveUpdate (
+        lib.recursiveUpdate (known-hosts'."__default__" or {}) host
-          (known-hosts'."__default__" or {})
-          // { isAlias = false; }
-        ) host
       ))
-      (lib.mapAttrsToList (fqdn: host: let
+      (lib.mapAttrsToList (fqdn: host:
+        let
           allHostnames = [ fqdn ] ++ host.aliases;
-        in lib.forEach allHostnames (alias:
+        in
+        lib.forEach allHostnames (alias:
           lib.nameValuePair
             alias
             (host // {
@@ -35,8 +41,8 @@ let
   hostNames = attrNames known-hosts;
   thisHost = known-hosts.${config.networking.fqdn};
   thisHostIsBuilder = thisHost.buildMachine.maxJobs > 0;
-  thisHostIsHopHost = builtins.elem config.networking.fqdn (lib.forEach (attrValues known-hosts) (host: host.ssh.proxyJump or null));
+  thisHostIsBuildee = thisHost.ssh ? userPublicKey;
-  thisHostIsConsumer = thisHost.ssh ? userPublicKey;
+  thisHostIsHopHost = elem config.networking.fqdn (lib.forEach (attrValues known-hosts) (host: host.ssh.proxyJump or null));
 
   mkRemoteConfig = fqdn: let
     thatHost = known-hosts.${fqdn};
@@ -46,11 +52,11 @@ let
       sshUser = thatHost.ssh.listenUser;
     };
     thatHostIsBuilder = thatHost.buildMachine.maxJobs > 0;
-    thatHostIsConsumer = thatHost.ssh ? userPublicKey && thisHostIsBuilder;
+    thatHostIsBuildee = thatHost.ssh ? userPublicKey && thisHostIsBuilder;
-    thatHostIsThis = builtins.elem config.networking.fqdn ([ fqdn ] ++ thatHost.aliases);
+    thatHostIsThis = elem config.networking.fqdn ([ fqdn ] ++ thatHost.aliases);
-  in mkIf (!thatHostIsThis) ( lib.mkMerge [
+  in lib.mkIf (!thatHostIsThis) ( lib.mkMerge [
     # out
-    (lib.mkIf (thisHostIsConsumer && thatHostIsBuilder) {
+    (lib.mkIf (thisHostIsBuildee && thatHostIsBuilder) {
 
       # TODO: Allow setting speedFactor for local builds, as local is currently fixed to 0
       # https://github.com/NixOS/nix/issues/2457
@@ -62,17 +68,17 @@ let
 
     })
     # out or jump
-    (lib.mkIf (thisHostIsConsumer && thatHost.ssh ? listenPublicKey) {
+    (lib.mkIf (thisHostIsBuildee && thatHost.ssh ? listenPublicKey) {
       programs.ssh.knownHosts.${fqdn}.publicKey = thatHost.ssh.listenPublicKey;
       # TODO: use nix.buildMachines.*.publicHostKey ?
 
       # timeouts are great when remote is unresponsive. nix doesn't care, lix is way and tests each remote only once
       programs.ssh.extraConfig = ''
         Host ${fqdn}
-          ConnectTimeout ${builtins.toString thatHost.ssh.connectTimeout}
+          ConnectTimeout ${toString thatHost.ssh.connectTimeout}
-          Port ${builtins.toString thatHost.ssh.listenPort}
+          Port ${toString thatHost.ssh.listenPort}
           ${lib.optionalString (thatHost.ssh ? proxyJump) ''
-            ProxyJump ${thatJump.ssh.listenUser}@${thatHost.ssh.proxyJump}:${builtins.toString thatJump.ssh.listenPort}
+            ProxyJump ${thatJump.ssh.listenUser}@${thatHost.ssh.proxyJump}:${toString thatJump.ssh.listenPort}
           ''}
           ${lib.optionalString (thatHost.ssh ? userPrivateKey) ''
             IdentityFile ${thatHost.ssh.userPrivateKey}
@@ -85,14 +91,14 @@ let
 
     })
     # in
-    (mkIf ((thisHostIsBuilder || thisHostIsHopHost) && thatHostIsConsumer) {
+    (lib.mkIf ((thisHostIsBuilder || thisHostIsHopHost) && thatHostIsBuildee) {
       users.users.${thisHost.ssh.listenUser} = {
         isSystemUser = lib.mkDefault (!config.users.users.${thisHost.ssh.listenUser}.isNormalUser);
         openssh.authorizedKeys.keys = [ thatHost.ssh.userPublicKey ];
         group = lib.mkOptionDefault "nogroup";
       };
     })
-    (mkIf (thisHostIsBuilder && thatHostIsConsumer) {
+    (lib.mkIf (thisHostIsBuilder && thatHostIsBuildee) {
       nix.settings.allowed-users = [ thisHost.ssh.listenUser ];
       nix.settings.trusted-users = [ thisHost.ssh.listenUser ];
     })