vinzenz/nixos-configuration
0
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

distributed builds: add builders to known hosts

Browse source
This commit is contained in:
müde 2026-05-01 21:54:54 +02:00
parent 05645a2c46
commit b995113f56
2 changed files with 22 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

7
flake.nix
View file

@ -150,7 +150,8 @@
}; };
distributedBuilds = { distributedBuilds = {
isBuilder = true; isBuilder = true;
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKAbojdhb3PfazSRmudvo381Y+zUFVLMa7AbWbfK/Zp2 muede-lpt2-nix-builds"; hostPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHGKoZ68wwyVRmPB0SkvpJUyUMDWeFbC5Je9zukyEOh7";
clientPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKAbojdhb3PfazSRmudvo381Y+zUFVLMa7AbWbfK/Zp2 muede-lpt2-nix-builds";
}; };
}; };
muede-pc2 = { muede-pc2 = {
@ -160,7 +161,9 @@
}; };
distributedBuilds = { distributedBuilds = {
isBuilder = true; isBuilder = true;
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHmnyhP6L+kGHV15cb/d31AQr50wSEaQhkUBwy2+OEKk muede-pc2-nix-builds"; speedFactor = 2;
hostPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKEQQS5XNoj62Oj85xQfIuLORwoBRwfqjvfBHHsiI+RH";
clientPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHmnyhP6L+kGHV15cb/d31AQr50wSEaQhkUBwy2+OEKk muede-pc2-nix-builds";
}; };
}; };
ronja-pc = { ronja-pc = {

21
nixosModules/distributed-builds.nix
View file

@ -10,8 +10,8 @@ let
# Collect all per-device public keys that have been registered. # Collect all per-device public keys that have been registered.
authorizedPublicKeys = lib.pipe devices [ authorizedPublicKeys = lib.pipe devices [
(lib.filterAttrs (_: v: (v.distributedBuilds or { }) ? publicKey)) (lib.filterAttrs (_: v: (v.distributedBuilds or { }) ? clientPublicKey))
(lib.mapAttrsToList (_: v: v.distributedBuilds.publicKey)) (lib.mapAttrsToList (_: v: v.distributedBuilds.clientPublicKey))
]; ];
# === Onboarding a device as a build client === # === Onboarding a device as a build client ===
@ -21,7 +21,7 @@ let
# (owned by root, mode 0600) # (owned by root, mode 0600)
# #
# 2. Add the public key to the device entry in flake.nix: # 2. Add the public key to the device entry in flake.nix:
# distributedBuilds.publicKey = "ssh-ed25519 AAAA... <hostname>-nix-builds"; # distributedBuilds.clientPublicKey = "ssh-ed25519 AAAA... <hostname>-nix-builds";
# #
# 3. Rebuild all machines so they pick up the new authorized key. # 3. Rebuild all machines so they pick up the new authorized key.
# #
@ -29,16 +29,27 @@ let
# #
# Add to its entry in flake.nix: # Add to its entry in flake.nix:
# distributedBuilds.isBuilder = true; # distributedBuilds.isBuilder = true;
# distributedBuilds.hostPublicKey = "ssh-ed25519 AAAA..."; # from: ssh-keyscan -t ed25519 <hostname>
# All machines automatically discover and use it after the next rebuild. # All machines automatically discover and use it after the next rebuild.
buildServerDevices = lib.filterAttrs (_: v: (v.distributedBuilds or { }).isBuilder or false) devices; buildServerDevices = lib.filterAttrs (_: v: (v.distributedBuilds or { }).isBuilder or false) devices;
knownHosts = lib.pipe buildServerDevices [
(lib.filterAttrs (_: v: v.distributedBuilds ? hostPublicKey))
(lib.mapAttrs (hostName: v: {
publicKey = v.distributedBuilds.hostPublicKey;
}))
];
buildMachineList = lib.mapAttrsToList (hostName: v: { buildMachineList = lib.mapAttrsToList (hostName: v: {
inherit hostName; inherit hostName;
systems = [ v.system ]; systems = [ v.system ];
sshUser = buildUser; sshUser = buildUser;
sshKey = sshKeyPath; sshKey = sshKeyPath;
protocol = "ssh-ng"; protocol = "ssh-ng";
} // lib.optionalAttrs (v.distributedBuilds ? speedFactor) {
speedFactor = v.distributedBuilds.speedFactor;
} // {
supportedFeatures = [ supportedFeatures = [
"nixos-test" "nixos-test"
"big-parallel" "big-parallel"
@ -51,11 +62,13 @@ let
in in
{ {
# Dedicated user for receiving distributed build connections # Dedicated user for receiving distributed build connections
programs.ssh.knownHosts = knownHosts;
users.users.${buildUser} = { users.users.${buildUser} = {
isSystemUser = true; isSystemUser = true;
group = buildUser; group = buildUser;
useDefaultShell = true; useDefaultShell = true;
openssh.authorizedKeys.keys = authorizedPublicKeys; openssh.authorizedKeys.keys = map (k: ''command="nix daemon --stdio",restrict ${k}'') authorizedPublicKeys;
}; };
users.groups.${buildUser} = { }; users.groups.${buildUser} = { };