From e394a6e21e642666c4c8c0962bad09834efd02cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?m=C3=BCde?= <git@darkest.space>
Date: Sun, 3 May 2026 13:46:30 +0200
Subject: [PATCH] distributed builds: fix ssh only accepting build key for real

---
 nixosModules/distributed-builds.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/nixosModules/distributed-builds.nix b/nixosModules/distributed-builds.nix
index 7d5df6e..91341f5 100644
--- a/nixosModules/distributed-builds.nix
+++ b/nixosModules/distributed-builds.nix
@@ -102,11 +102,13 @@ in
       (lib.mkIf isClient {
         programs.ssh = {
           knownHosts = buildServerKnownHosts;
-          extraConfig = ''
-            Match Host ${lib.concatStringsSep " " (lib.attrNames buildServerDevices)} User ${buildUser}
-              IdentityFile ${clientSshKeyPath}
-              IdentitiesOnly yes
-          '';
+          extraConfig = lib.concatStringsSep "\n" (
+            lib.mapAttrsToList (name: _: ''
+              Match host ${name} user ${buildUser}
+                IdentityFile ${clientSshKeyPath}
+                IdentitiesOnly yes
+            '') buildServerDevices
+          );
         };
         nix = {
           distributedBuilds = buildMachines != [ ];