flake.nix

@@ -169,7 +169,7 @@
       #  file = ./secrets/${hostname}.yaml;
       #  exists = builtins.pathExists file;
       #  yaml = lib.removeAttrs (lib.importYAML file) ["sops"];
-      #  secrets = lib.attrNames yaml; # TODO: recurse
+      #  secrets = lib.attrNames yaml;
       #in
       #  if !exists then {} else lib.mkMerge (lib.forEach secrets (secret:
       #    lib.mkIf (config.sops.secrets ? secret) {

hosts/eple/configuration.nix

@@ -5,10 +5,6 @@
   boot.loader.efi.canTouchEfiVariables = true;
   boot.loader.efi.efiSysMountPoint = "/boot/efi";
 
-  boot.binfmt.emulatedSystems = [
-    "aarch64-linux"
-  ];
-
   services.nfs.server.enable = false; # TODO: remove?
 
   imports = [

hosts/known-hosts.toml

@@ -12,10 +12,10 @@
 # ssh.listenUser
 # ssh.listenPort
 # ssh.listenPublicKey # cat /etc/ssh/ssh_host_ed25519_key.pub || ssh-keyscan {{fqdn}}
-# ssh.proxyJump         # optional hostname
-# ssh.connectTimeout
-# ssh.userPrivateKey    # optional IdentityFile to use
 # ssh.userPublicKey   # sudo ssh-keygen -t ed25519 && sudo cat /root/.ssh/id_ed25519.pub
+# ssh.proxyJump      # optional hostname
+# ssh.userPrivateKey # optional IdentityFile to use
+# ssh.connectTimeout
 
 
 # buildMachine.supportedFeatures:
@@ -32,8 +32,8 @@ buildMachine.speedFactor = 1
 buildMachine.supportedFeatures = []
 buildMachine.mandatoryFeatures = []
 buildMachine.protocol = "ssh" # "ssh-ng"
-# ssh.listenUser = "pbsds" # TODO: change
-ssh.listenUser = "nixbld-remote"
+ssh.listenUser = "pbsds" # TODO: change
+# ssh.listenUser = "nixbld-remote"
 ssh.listenPort = 22
 ssh.connectTimeout = 3
 
@@ -41,7 +41,6 @@ ssh.connectTimeout = 3
 #   headless:  one job per 4 threads and 8GB RAM
 #   graphical: one job
 
-
 ["bolle.pbsds.net"]
 buildMachine.systems = ["x86_64-linux", "i686-linux", "riscv64-linux"]
 buildMachine.maxJobs = 3 # 12 threads 32GB
@@ -52,7 +51,6 @@ ssh.proxyJump = "isvegg.pvv.ntnu.no"
 
 ["eple.pbsds.net"] # r9 290x
 aliases = [ "eple.tail9aac63.ts.net" ]
-buildMachine.systems = ["x86_64-linux", "i686-linux", "aarch64-linux"]
 buildMachine.maxJobs = 3 # 12 threads 32GB
 buildMachine.speedFactor = 3 # i7-5820K
 buildMachine.supportedFeatures = ["kvm", "big-parallel", "nixos-test"]
@@ -110,7 +108,6 @@ ssh.listenPort = 2222
 ssh.listenPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILD7+tE6rm742fz+nqa3+zlglMuzCzOQlc0OSJssvgVL"
 ssh.userPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJVohqGMKp/UEZtb71RSBBXOEGX4o3lN5GYBlP7HEKbs root@brumlebasse"
 
-
 ["isvegg.pvv.ntnu.no"]
 # buildMachine.maxJobs = 1 # 4 threads 16GB
 buildMachine.speedFactor = 1 # i5-3570

profiles/known-hosts.nix

@@ -4,15 +4,8 @@
 # TODO: https://exozy.me/about
 
 let
-  inherit (builtins)
-    map
-    fromTOML
-    toString
-    readFile
-    elem
-    attrNames
-    attrValues
-    ;
+  inherit (builtins) map fromTOML readFile elem attrNames attrValues;
+  inherit (lib) mkIf;
 
   known-hosts = let
     known-hosts' = lib.importTOML ../hosts/known-hosts.toml; # TODO: eww
@@ -20,13 +13,14 @@ let
     lib.pipe known-hosts' [
       (lib.flip lib.removeAttrs ["__default__"])
       (lib.mapAttrs (fqdn: host:
-        lib.recursiveUpdate (known-hosts'."__default__" or {}) host
+        lib.recursiveUpdate (
+          (known-hosts'."__default__" or {})
+          // { isAlias = false; }
+        ) host
       ))
-      (lib.mapAttrsToList (fqdn: host:
-        let
+      (lib.mapAttrsToList (fqdn: host: let
           allHostnames = [ fqdn ] ++ host.aliases;
-        in
-        lib.forEach allHostnames (alias:
+        in lib.forEach allHostnames (alias:
           lib.nameValuePair
             alias
             (host // {
@@ -41,8 +35,8 @@ let
   hostNames = attrNames known-hosts;
   thisHost = known-hosts.${config.networking.fqdn};
   thisHostIsBuilder = thisHost.buildMachine.maxJobs > 0;
-  thisHostIsBuildee = thisHost.ssh ? userPublicKey;
-  thisHostIsHopHost = elem config.networking.fqdn (lib.forEach (attrValues known-hosts) (host: host.ssh.proxyJump or null));
+  thisHostIsHopHost = builtins.elem config.networking.fqdn (lib.forEach (attrValues known-hosts) (host: host.ssh.proxyJump or null));
+  thisHostIsConsumer = thisHost.ssh ? userPublicKey;
 
   mkRemoteConfig = fqdn: let
     thatHost = known-hosts.${fqdn};
@@ -52,11 +46,11 @@ let
       sshUser = thatHost.ssh.listenUser;
     };
     thatHostIsBuilder = thatHost.buildMachine.maxJobs > 0;
-    thatHostIsBuildee = thatHost.ssh ? userPublicKey && thisHostIsBuilder;
-    thatHostIsThis = elem config.networking.fqdn ([ fqdn ] ++ thatHost.aliases);
-  in lib.mkIf (!thatHostIsThis) ( lib.mkMerge [
+    thatHostIsConsumer = thatHost.ssh ? userPublicKey && thisHostIsBuilder;
+    thatHostIsThis = builtins.elem config.networking.fqdn ([ fqdn ] ++ thatHost.aliases);
+  in mkIf (!thatHostIsThis) ( lib.mkMerge [
     # out
-    (lib.mkIf (thisHostIsBuildee && thatHostIsBuilder) {
+    (lib.mkIf (thisHostIsConsumer && thatHostIsBuilder) {
 
       # TODO: Allow setting speedFactor for local builds, as local is currently fixed to 0
       # https://github.com/NixOS/nix/issues/2457
@@ -68,17 +62,17 @@ let
 
     })
     # out or jump
-    (lib.mkIf (thisHostIsBuildee && thatHost.ssh ? listenPublicKey) {
+    (lib.mkIf (thisHostIsConsumer && thatHost.ssh ? listenPublicKey) {
       programs.ssh.knownHosts.${fqdn}.publicKey = thatHost.ssh.listenPublicKey;
       # TODO: use nix.buildMachines.*.publicHostKey ?
 
       # timeouts are great when remote is unresponsive. nix doesn't care, lix is way and tests each remote only once
       programs.ssh.extraConfig = ''
         Host ${fqdn}
-          ConnectTimeout ${toString thatHost.ssh.connectTimeout}
-          Port ${toString thatHost.ssh.listenPort}
+          ConnectTimeout ${builtins.toString thatHost.ssh.connectTimeout}
+          Port ${builtins.toString thatHost.ssh.listenPort}
           ${lib.optionalString (thatHost.ssh ? proxyJump) ''
-            ProxyJump ${thatJump.ssh.listenUser}@${thatHost.ssh.proxyJump}:${toString thatJump.ssh.listenPort}
+            ProxyJump ${thatJump.ssh.listenUser}@${thatHost.ssh.proxyJump}:${builtins.toString thatJump.ssh.listenPort}
           ''}
           ${lib.optionalString (thatHost.ssh ? userPrivateKey) ''
             IdentityFile ${thatHost.ssh.userPrivateKey}
@@ -91,14 +85,14 @@ let
 
     })
     # in
-    (lib.mkIf ((thisHostIsBuilder || thisHostIsHopHost) && thatHostIsBuildee) {
+    (mkIf ((thisHostIsBuilder || thisHostIsHopHost) && thatHostIsConsumer) {
       users.users.${thisHost.ssh.listenUser} = {
         isSystemUser = lib.mkDefault (!config.users.users.${thisHost.ssh.listenUser}.isNormalUser);
         openssh.authorizedKeys.keys = [ thatHost.ssh.userPublicKey ];
         group = lib.mkOptionDefault "nogroup";
       };
     })
-    (lib.mkIf (thisHostIsBuilder && thatHostIsBuildee) {
+    (mkIf (thisHostIsBuilder && thatHostIsConsumer) {
       nix.settings.allowed-users = [ thisHost.ssh.listenUser ];
       nix.settings.trusted-users = [ thisHost.ssh.listenUser ];
     })