Merge branch 'main' of gh:greg-hellings/nixos-config

.envrc

@@ -1 +0,0 @@
-use flake

home/modules/baseline/xonsh.nix

@@ -15,6 +15,8 @@
     enable = true;
 
     sessionVariables = {
+      # This is for pushing builds to my local S3 cache
+      AWS_SHARED_CREDENTIALS_FILE = "/run/agenix/cache-credentials";
       CLICOLOR = 1;
       EDITOR = "nvim";
       # vte_new_tab_cwd causes new Terminal tabs to open in the
@@ -48,15 +50,16 @@
       s = "nix run \".#runserver\"";
 
       # Nix related ones
+      deploy = "nixos-rebuild switch --use-remote-sudo --use-substitutes --target-host";
       gl-nging = "sudo nixos-container run gitlab -- systemctl restart nginx";
       nb = "nix build -L";
       nixdu = "sudo nix-store --gc --print-roots | egrep -v r\"^(/nix/var|/run/\\w+-system|\\{memory|/proc)\"";
       nixtest = "nixpkgs-review rev HEAD";
       nixup = "nix flake lock --update-input";
+      nixcopy = "nix copy --to \"s3://binary-cache/?profile=default&endpoint=nas.home%3A9000&scheme=http\"";
       stable = "nix flake lock --update-input nixstable --update-input hm --update-input nixvimstable";
       unstable = "nix flake lock --update-input nixunstable --update-input hmunstable --update-input nixvimunstable --update-input nurpkgs --update-input vsext --update-input wsl";
       updateScript = "nix-shell maintainers/scripts/update.nix --argstr package";
-      deploy = "nixos-rebuild switch --use-remote-sudo --use-substitutes --target-host";
 
       # General
       gh-personal = "$GH_CONFIG_DIR=\"${config.home.homeDirectory}/.config/gh/personal\" gh";

modules/baseline.nix

@@ -35,6 +35,7 @@ in
         "gregory.hellings"
       ]; # For home and for work machines
       substituters = [
+        "http://nas.home:9000/binary-cache/"
         "https://cache.garnix.io"
         "https://ai.cachix.org"
         "https://nixpkgs-python.cachix.org"
@@ -42,6 +43,7 @@ in
         "https://nix-community.cachix.org"
       ];
       trusted-public-keys = [
+        "nix.home:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8="
         "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
         "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="
         "nixpkgs-python.cachix.org-1:hxjI7pFxTyuTHn2NkvWCrAUcNZLNS3ZAvfYNuYifcEU="

modules/cache-public-key.pem

@@ -0,0 +1 @@
+nas.home:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8=

modules/nixos/remote-builder.nix

@@ -1,4 +1,9 @@
-{ lib, config, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.greg.remote-builder;
@@ -10,7 +15,46 @@ with lib;
   };
 
   config = mkIf cfg.enable {
+    age.secrets = {
+      # Don't forget to also update home/modules/baseline/xonsh.nix if this changes
+      cache-credentials = {
+        file = ../../secrets/cache-credentials.age;
+        owner = "greg";
+        group = "nixbld";
+        mode = "660";
+      };
+      private-cache = {
+        file = ../../secrets/cache-private-key.age;
+        group = "nixbld";
+        mode = "660";
+      };
+    };
+
+    # If the system is powerful enough to be a remote builder, it should
+    # be powerful enough to do some basic qemu stuff
+    boot.binfmt.emulatedSystems = [
+      "i686-linux"
+      "aarch64-linux"
+    ];
+
     greg.tailscale.enable = true;
+
+    # The builder user needs to be trusted to submit builds
+    nix.settings = {
+      post-build-hook = getExe (
+        pkgs.writeShellScriptBin "upload-to-cache.sh" ''
+          set -eu
+          set -f
+          export AWS_SHARED_CREDENTIALS_FILE=${config.age.secrets.cache-credentials.path}
+          export IFS=' '
+          echo "Uploading paths " $OUT_PATHS
+          nix copy --to "s3://binary-cache/?scheme=http&endpoint=nas.home%3A9000&profile=default" $OUT_PATHS
+        ''
+      );
+      secret-key-files = config.age.secrets.private-cache.path;
+      trusted-users = [ config.users.users.remote-builder-user.name ];
+    };
+
     users.users.remote-builder-user = {
       openssh.authorizedKeys.keys = [
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG4fNCnomQEsFKQZp16LXRqkfXHzzZbGAYJWPMvlGGQy root@exodus"
@@ -26,13 +70,5 @@ with lib;
       isNormalUser = true;
       useDefaultShell = true;
     };
-    # The builder user needs to be trusted to submit builds
-    nix.settings.trusted-users = [ config.users.users.remote-builder-user.name ];
-    # If the system is powerful enough to be a remote builder, it should
-    # be powerful enough to do some basic qemu stuff
-    boot.binfmt.emulatedSystems = [
-      "i686-linux"
-      "aarch64-linux"
-    ];
   };
 }

secrets/secrets.nix

@@ -6,6 +6,8 @@ let
   hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz";
   jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0";
   matrix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMIbvNNYrsT9sSBSwIL9c0LiHDaOiztlTJZAGgTDGUHq root@vm-matrix";
+  exodus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFxmnCj2E9DxcnefPW+n4yCuLShxqr0p024riogdeXA3";
+
   systems = [
     genesis
     linode
@@ -14,6 +16,7 @@ let
     hosea
     jeremiah
     matrix
+    exodus
   ];
 
   user_genesis_virt = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFWPSFQT0AH77wrwRhiskcBS0w4ZakBRdJywYYBsnm3S greg@genesis";
@@ -23,6 +26,7 @@ let
   user_isaiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAl6DJVrPSujvJSAEA5Q8tRrzfJs/c6DMwqwQEUFffIR greg@isaiah";
   user_hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrqJQvDspLi1vXQRJ/Z5kN/F8jCBHvaXjo+5zLuIYjR greg@hosea";
   user_jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYIiecdyM9c7tXgR96983K3wqiJeQRMbrzGIF8Wy6uO greg@jeremiah";
+  user_exodus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC189EnvWjNUp3xSzPMAtw85oQEsvP1tQR1TK640nLx6 greg@exodus";
 
   users = [
     user_genesis_virt
@@ -32,6 +36,7 @@ let
     user_isaiah
     user_hosea
     user_jeremiah
+    user_exodus
   ];
 
   everyone = systems ++ users;
@@ -50,6 +55,25 @@ in
   "jude-forgejo-runner.age".publicKeys = everyone;
   "minio.age".publicKeys = everyone;
 
+  "cache-private-key.age".publicKeys = [
+    jeremiah
+    isaiah
+    jude
+    user_jeremiah
+    user_isaiah
+    user_jude
+    user_exodus
+  ];
+  "cache-credentials.age".publicKeys = [
+    jeremiah
+    isaiah
+    jude
+    user_jeremiah
+    user_isaiah
+    user_jude
+    user_exodus
+  ];
+
   "restic-env.age".publicKeys = everyone;
   "restic-pw.age".publicKeys = everyone;