Enable pushing builds to S3

modules/baseline.nix

@@ -35,6 +35,7 @@ in
         "gregory.hellings"
       ]; # For home and for work machines
       substituters = [
+        "http://nas.home:9000/binary-cache/"
         "https://cache.garnix.io"
         "https://ai.cachix.org"
         "https://nixpkgs-python.cachix.org"
@@ -42,6 +43,7 @@ in
         "https://nix-community.cachix.org"
       ];
       trusted-public-keys = [
+        "nix.home:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8="
         "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
         "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="
         "nixpkgs-python.cachix.org-1:hxjI7pFxTyuTHn2NkvWCrAUcNZLNS3ZAvfYNuYifcEU="

modules/cache-public-key.pem

@@ -0,0 +1 @@
+nas.home:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8=

modules/nixos/remote-builder.nix

@@ -1,4 +1,9 @@
-{ lib, config, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.greg.remote-builder;
@@ -10,7 +15,46 @@ with lib;
   };
 
   config = mkIf cfg.enable {
+    age.secrets = {
+      # Don't forget to also update home/modules/baseline/xonsh.nix if this changes
+      cache-credentials = {
+        file = ../../secrets/cache-credentials.age;
+        owner = "greg";
+        group = "nixbld";
+        mode = "660";
+      };
+      private-cache = {
+        file = ../../secrets/cache-private-key.age;
+        group = "nixbld";
+        mode = "660";
+      };
+    };
+
+    # If the system is powerful enough to be a remote builder, it should
+    # be powerful enough to do some basic qemu stuff
+    boot.binfmt.emulatedSystems = [
+      "i686-linux"
+      "aarch64-linux"
+    ];
+
     greg.tailscale.enable = true;
+
+    # The builder user needs to be trusted to submit builds
+    nix.settings = {
+      post-build-hook = getExe (
+        pkgs.writeShellScriptBin "upload-to-cache.sh" ''
+          set -eu
+          set -f
+          export AWS_SHARED_CREDENTIALS_FILE=${config.age.secrets.cache-credentials.path}
+          export IFS=' '
+          echo "Uploading paths " $OUT_PATHS
+          nix copy --to "s3://binary-cache/?scheme=http&endpoint=nas.home%3A9000&profile=default" $OUT_PATHS
+        ''
+      );
+      secret-key-files = config.age.secrets.private-cache.path;
+      trusted-users = [ config.users.users.remote-builder-user.name ];
+    };
+
     users.users.remote-builder-user = {
       openssh.authorizedKeys.keys = [
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG4fNCnomQEsFKQZp16LXRqkfXHzzZbGAYJWPMvlGGQy root@exodus"
@@ -26,13 +70,5 @@ with lib;
       isNormalUser = true;
       useDefaultShell = true;
     };
-    # The builder user needs to be trusted to submit builds
-    nix.settings.trusted-users = [ config.users.users.remote-builder-user.name ];
-    # If the system is powerful enough to be a remote builder, it should
-    # be powerful enough to do some basic qemu stuff
-    boot.binfmt.emulatedSystems = [
-      "i686-linux"
-      "aarch64-linux"
-    ];
   };
 }