add remote builder to vno1-oh2

data.nix

@@ -80,6 +80,8 @@ rec {
       publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHlWSZ/H6DR5i5aCrlrEQLVF9MXNvls/pjlLPLaav3f+";
       jakstIP = "100.89.176.6";
       vno1IP = "192.168.189.10";
+      supportedFeatures = ["nixos-test" "benchmark" "big-parallel" "kvm" "gccarch-armv8-a"];
+      system = "aarch64-linux";
     };
     "mxp10.motiejus.jakst" = {
       publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIy9IR7Jq3hRZ5JgwfmeCgSKFrdgujnZt79uxDPVi3tu";

hosts/fra1-a/configuration.nix

@@ -70,7 +70,7 @@
       sshguard.enable = true;
       tailscale.enable = true;
 
-      remote-builder = {
+      remote-builder.server = {
         enable = true;
         uidgid = myData.uidgid.remote-builder;
         sshAllowSubnet = myData.subnets.tailscale.sshPattern;

hosts/fwminex/configuration.nix

@@ -115,6 +115,15 @@ in {
         user = "motiejus";
         group = "users";
       };
+
+      remote-builder.client = let
+        host = myData.hosts."fra1-a.servers.jakst";
+      in {
+        enable = true;
+        inherit (host) system supportedFeatures;
+        hostName = host.jakstIP;
+        sshKey = "/etc/ssh/ssh_host_ed25519_key";
+      };
     };
   };
 
@@ -168,21 +177,6 @@ in {
   virtualisation.virtualbox.host.enable = true;
   users.extraGroups.vboxusers.members = ["motiejus"];
 
-  nix = {
-    buildMachines = [
-      {
-        hostName = myData.hosts."fra1-a.servers.jakst".jakstIP;
-        system = "aarch64-linux";
-        protocol = "ssh-ng";
-        sshUser = "remote-builder";
-        sshKey = "/etc/ssh/ssh_host_ed25519_key";
-        supportedFeatures = ["nixos-test" "benchmark" "big-parallel" "kvm" "gccarch-armv8-a"];
-      }
-    ];
-    distributedBuilds = true;
-    extraOptions = ''builders-use-substitutes = true'';
-  };
-
   networking = {
     hostId = "3a54afcd";
     hostName = "fwminex";

hosts/vno1-oh2/configuration.nix

@@ -247,6 +247,15 @@
           startAt = "*-*-* *:00/5:00";
         };
       };
+
+      remote-builder.client = let
+        host = myData.hosts."fra1-a.servers.jakst";
+      in {
+        enable = true;
+        inherit (host) system supportedFeatures;
+        hostName = host.jakstIP;
+        sshKey = "/etc/ssh/ssh_host_ed25519_key";
+      };
     };
   };
 

modules/services/remote-builder/default.nix

@@ -2,32 +2,63 @@
   config,
   lib,
   ...
-}: let
+}: {
-  cfg = config.mj.services.remote-builder;
-in {
   options.mj.services.remote-builder = with lib.types; {
-    enable = lib.mkEnableOption "Enable remote builder";
+    server = {
-    uidgid = lib.mkOption {type = int;};
+      enable = lib.mkEnableOption "Enable remote builder server";
-    sshAllowSubnet = lib.mkOption {type = str;};
+      uidgid = lib.mkOption {type = int;};
-    publicKeys = lib.mkOption {type = listOf str;};
+      sshAllowSubnet = lib.mkOption {type = str;};
+      publicKeys = lib.mkOption {type = listOf str;};
+    };
+    client = {
+      enable = lib.mkEnableOption "Enable remote builder client";
+      system = lib.mkOption {type = enum ["aarch64-linux" "x86_64-linux"];};
+      hostName = lib.mkOption {type = str;};
+      sshKey = lib.mkOption {type = path;};
+    };
   };
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkMerge [
-    users.users.remote-builder = {
+    (
-      description = "Remote Builder";
+      let
-      home = "/var/lib/remote-builder";
+        cfg = config.mj.services.remote-builder.server;
-      shell = "/bin/sh";
+      in
-      group = "remote-builder";
+        lib.mkIf cfg.enable {
-      isSystemUser = true;
+          users.users.remote-builder = {
-      createHome = true;
+            description = "Remote Builder";
-      uid = cfg.uidgid;
+            home = "/var/lib/remote-builder";
-      openssh.authorizedKeys.keys =
+            shell = "/bin/sh";
-        map (
+            group = "remote-builder";
-          k: "from=\"${cfg.sshAllowSubnet}\" ${k}"
+            isSystemUser = true;
-        )
+            createHome = true;
-        cfg.publicKeys;
+            uid = cfg.uidgid;
-    };
+            openssh.authorizedKeys.keys =
-    users.groups.remote-builder.gid = cfg.uidgid;
+              map (
-    nix.settings.trusted-users = ["remote-builder"];
+                k: "from=\"${cfg.sshAllowSubnet}\" ${k}"
-  };
+              )
+              cfg.publicKeys;
+          };
+          users.groups.remote-builder.gid = cfg.uidgid;
+          nix.settings.trusted-users = ["remote-builder"];
+        }
+    )
+    (
+      let
+        cfg = config.mj.services.remote-builder.client;
+      in
+        lib.mkIf cfg.enable {
+          nix = {
+            buildMachines = [
+              {
+                inherit (cfg) hostName system sshKey supportedFeatures;
+                protocol = "ssh-ng";
+                sshUser = "remote-builder";
+              }
+            ];
+            distributedBuilds = true;
+            extraOptions = ''builders-use-substitutes = true'';
+          };
+        }
+    )
+  ];
 }