motiejus
/
config
1
Fork 0
Code Packages Releases Activity

add remote builder to vno1-oh2

main
Motiejus Jakštys 2024-02-27 22:56:09 +02:00
parent 5207327591
commit e702cdfb18
5 changed files with 77 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
data.nix
View File

@ -80,6 +80,8 @@ rec {
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHlWSZ/H6DR5i5aCrlrEQLVF9MXNvls/pjlLPLaav3f+";
jakstIP = "100.89.176.6";
vno1IP = "192.168.189.10";
supportedFeatures = ["nixos-test" "benchmark" "big-parallel" "kvm" "gccarch-armv8-a"];
system = "aarch64-linux";
};
"mxp10.motiejus.jakst" = {
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIy9IR7Jq3hRZ5JgwfmeCgSKFrdgujnZt79uxDPVi3tu";

2
hosts/fra1-a/configuration.nix
View File

@ -70,7 +70,7 @@
sshguard.enable = true;
tailscale.enable = true;
remote-builder = {
remote-builder.server = {
enable = true;
uidgid = myData.uidgid.remote-builder;
sshAllowSubnet = myData.subnets.tailscale.sshPattern;

24
hosts/fwminex/configuration.nix
View File

@ -115,6 +115,15 @@ in {
user = "motiejus";
group = "users";
};
remote-builder.client = let
host = myData.hosts."fra1-a.servers.jakst";
in {
enable = true;
inherit (host) system supportedFeatures;
hostName = host.jakstIP;
sshKey = "/etc/ssh/ssh_host_ed25519_key";
};
};
};
@ -168,21 +177,6 @@ in {
virtualisation.virtualbox.host.enable = true;
users.extraGroups.vboxusers.members = ["motiejus"];
nix = {
buildMachines = [
{
hostName = myData.hosts."fra1-a.servers.jakst".jakstIP;
system = "aarch64-linux";
protocol = "ssh-ng";
sshUser = "remote-builder";
sshKey = "/etc/ssh/ssh_host_ed25519_key";
supportedFeatures = ["nixos-test" "benchmark" "big-parallel" "kvm" "gccarch-armv8-a"];
}
];
distributedBuilds = true;
extraOptions = ''builders-use-substitutes = true'';
};
networking = {
hostId = "3a54afcd";
hostName = "fwminex";

9
hosts/vno1-oh2/configuration.nix
View File

@ -247,6 +247,15 @@
startAt = "*-*-* *:00/5:00";
};
};
remote-builder.client = let
host = myData.hosts."fra1-a.servers.jakst";
in {
enable = true;
inherit (host) system supportedFeatures;
hostName = host.jakstIP;
sshKey = "/etc/ssh/ssh_host_ed25519_key";
};
};
};

81
modules/services/remote-builder/default.nix
View File

@ -2,32 +2,63 @@
config,
lib,
...
}: let
cfg = config.mj.services.remote-builder;
in {
}: {
options.mj.services.remote-builder = with lib.types; {
enable = lib.mkEnableOption "Enable remote builder";
uidgid = lib.mkOption {type = int;};
sshAllowSubnet = lib.mkOption {type = str;};
publicKeys = lib.mkOption {type = listOf str;};
server = {
enable = lib.mkEnableOption "Enable remote builder server";
uidgid = lib.mkOption {type = int;};
sshAllowSubnet = lib.mkOption {type = str;};
publicKeys = lib.mkOption {type = listOf str;};
};
client = {
enable = lib.mkEnableOption "Enable remote builder client";
system = lib.mkOption {type = enum ["aarch64-linux" "x86_64-linux"];};
hostName = lib.mkOption {type = str;};
sshKey = lib.mkOption {type = path;};
};
};
config = lib.mkIf cfg.enable {
users.users.remote-builder = {
description = "Remote Builder";
home = "/var/lib/remote-builder";
shell = "/bin/sh";
group = "remote-builder";
isSystemUser = true;
createHome = true;
uid = cfg.uidgid;
openssh.authorizedKeys.keys =
map (
k: "from=\"${cfg.sshAllowSubnet}\" ${k}"
)
cfg.publicKeys;
};
users.groups.remote-builder.gid = cfg.uidgid;
nix.settings.trusted-users = ["remote-builder"];
};
config = lib.mkMerge [
(
let
cfg = config.mj.services.remote-builder.server;
in
lib.mkIf cfg.enable {
users.users.remote-builder = {
description = "Remote Builder";
home = "/var/lib/remote-builder";
shell = "/bin/sh";
group = "remote-builder";
isSystemUser = true;
createHome = true;
uid = cfg.uidgid;
openssh.authorizedKeys.keys =
map (
k: "from=\"${cfg.sshAllowSubnet}\" ${k}"
)
cfg.publicKeys;
};
users.groups.remote-builder.gid = cfg.uidgid;
nix.settings.trusted-users = ["remote-builder"];
}
)
(
let
cfg = config.mj.services.remote-builder.client;
in
lib.mkIf cfg.enable {
nix = {
buildMachines = [
{
inherit (cfg) hostName system sshKey supportedFeatures;
protocol = "ssh-ng";
sshUser = "remote-builder";
}
];
distributedBuilds = true;
extraOptions = ''builders-use-substitutes = true'';
};
}
)
];
}