From faeeb8df9e6c2588809eb977aff3efed2949a4b8 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Sat, 18 Jan 2025 16:26:06 -0600 Subject: [PATCH 1/2] We don't need direnv here --- .envrc | 1 - 1 file changed, 1 deletion(-) delete mode 100644 .envrc diff --git a/.envrc b/.envrc deleted file mode 100644 index 3550a30..0000000 --- a/.envrc +++ /dev/null @@ -1 +0,0 @@ -use flake From 0607fc4f14054c4961a4e5599b363c3967ae8ac9 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 21 Jan 2025 14:53:11 -0600 Subject: [PATCH 2/2] Enable pushing builds to S3 --- home/modules/baseline/xonsh.nix | 5 ++- modules/baseline.nix | 2 ++ modules/cache-public-key.pem | 1 + modules/nixos/remote-builder.nix | 54 +++++++++++++++++++++++++------ secrets/cache-credentials.age | Bin 0 -> 979 bytes secrets/cache-private-key.age | Bin 0 -> 970 bytes secrets/secrets.nix | 24 ++++++++++++++ 7 files changed, 76 insertions(+), 10 deletions(-) create mode 100644 modules/cache-public-key.pem create mode 100644 secrets/cache-credentials.age create mode 100644 secrets/cache-private-key.age diff --git a/home/modules/baseline/xonsh.nix b/home/modules/baseline/xonsh.nix index bb7865c..b207290 100644 --- a/home/modules/baseline/xonsh.nix +++ b/home/modules/baseline/xonsh.nix @@ -15,6 +15,8 @@ enable = true; sessionVariables = { + # This is for pushing builds to my local S3 cache + AWS_SHARED_CREDENTIALS_FILE = "/run/agenix/cache-credentials"; CLICOLOR = 1; EDITOR = "nvim"; # vte_new_tab_cwd causes new Terminal tabs to open in the @@ -48,15 +50,16 @@ s = "nix run \".#runserver\""; # Nix related ones + deploy = "nixos-rebuild switch --use-remote-sudo --use-substitutes --target-host"; gl-nging = "sudo nixos-container run gitlab -- systemctl restart nginx"; nb = "nix build -L"; nixdu = "sudo nix-store --gc --print-roots | egrep -v r\"^(/nix/var|/run/\\w+-system|\\{memory|/proc)\""; nixtest = "nixpkgs-review rev HEAD"; nixup = "nix flake lock --update-input"; + nixcopy = "nix copy --to \"s3://binary-cache/?profile=default&endpoint=nas.home%3A9000&scheme=http\""; stable = "nix flake lock --update-input nixstable --update-input hm --update-input nixvimstable"; unstable = "nix flake lock --update-input nixunstable --update-input hmunstable --update-input nixvimunstable --update-input nurpkgs --update-input vsext --update-input wsl"; updateScript = "nix-shell maintainers/scripts/update.nix --argstr package"; - deploy = "nixos-rebuild switch --use-remote-sudo --use-substitutes --target-host"; # General gh-personal = "$GH_CONFIG_DIR=\"${config.home.homeDirectory}/.config/gh/personal\" gh"; diff --git a/modules/baseline.nix b/modules/baseline.nix index bbfaefa..54915b4 100644 --- a/modules/baseline.nix +++ b/modules/baseline.nix @@ -35,6 +35,7 @@ in "gregory.hellings" ]; # For home and for work machines substituters = [ + "http://nas.home:9000/binary-cache/" "https://cache.garnix.io" "https://ai.cachix.org" "https://nixpkgs-python.cachix.org" @@ -42,6 +43,7 @@ in "https://nix-community.cachix.org" ]; trusted-public-keys = [ + "nix.home:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8=" "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g=" "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc=" "nixpkgs-python.cachix.org-1:hxjI7pFxTyuTHn2NkvWCrAUcNZLNS3ZAvfYNuYifcEU=" diff --git a/modules/cache-public-key.pem b/modules/cache-public-key.pem new file mode 100644 index 0000000..e0cdaca --- /dev/null +++ b/modules/cache-public-key.pem @@ -0,0 +1 @@ +nas.home:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8= diff --git a/modules/nixos/remote-builder.nix b/modules/nixos/remote-builder.nix index 62caad0..863a25a 100644 --- a/modules/nixos/remote-builder.nix +++ b/modules/nixos/remote-builder.nix @@ -1,4 +1,9 @@ -{ lib, config, ... }: +{ + config, + lib, + pkgs, + ... +}: let cfg = config.greg.remote-builder; @@ -10,7 +15,46 @@ with lib; }; config = mkIf cfg.enable { + age.secrets = { + # Don't forget to also update home/modules/baseline/xonsh.nix if this changes + cache-credentials = { + file = ../../secrets/cache-credentials.age; + owner = "greg"; + group = "nixbld"; + mode = "660"; + }; + private-cache = { + file = ../../secrets/cache-private-key.age; + group = "nixbld"; + mode = "660"; + }; + }; + + # If the system is powerful enough to be a remote builder, it should + # be powerful enough to do some basic qemu stuff + boot.binfmt.emulatedSystems = [ + "i686-linux" + "aarch64-linux" + ]; + greg.tailscale.enable = true; + + # The builder user needs to be trusted to submit builds + nix.settings = { + post-build-hook = getExe ( + pkgs.writeShellScriptBin "upload-to-cache.sh" '' + set -eu + set -f + export AWS_SHARED_CREDENTIALS_FILE=${config.age.secrets.cache-credentials.path} + export IFS=' ' + echo "Uploading paths " $OUT_PATHS + nix copy --to "s3://binary-cache/?scheme=http&endpoint=nas.home%3A9000&profile=default" $OUT_PATHS + '' + ); + secret-key-files = config.age.secrets.private-cache.path; + trusted-users = [ config.users.users.remote-builder-user.name ]; + }; + users.users.remote-builder-user = { openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG4fNCnomQEsFKQZp16LXRqkfXHzzZbGAYJWPMvlGGQy root@exodus" @@ -26,13 +70,5 @@ with lib; isNormalUser = true; useDefaultShell = true; }; - # The builder user needs to be trusted to submit builds - nix.settings.trusted-users = [ config.users.users.remote-builder-user.name ]; - # If the system is powerful enough to be a remote builder, it should - # be powerful enough to do some basic qemu stuff - boot.binfmt.emulatedSystems = [ - "i686-linux" - "aarch64-linux" - ]; }; } diff --git a/secrets/cache-credentials.age b/secrets/cache-credentials.age new file mode 100644 index 0000000000000000000000000000000000000000..b945a6d478a8bca069768b274802569198be4af1 GIT binary patch literal 979 zcmZY6&#T)60KoAbHV-{26TwSlIMC1~P1CfwOp+#TlfE>++WaW*lIHjCG-=W#^PsYW zI>tPB6+H@~vf=G1zIX8GL1Z%VGTGCc3KNEiqVN3n7kv2gHC(%ECuZJcJ3mdXrMU}L zy-xQ!P!wL*wvfS~hXaJ@IXxGs6F0+md0JDj0~!s7Z#lxN*aqE_tWL@qAB84rYh>Q) zon;1w1hr0tsmt(db~_Zx@sydnrg0qrQ$hoH!k3d`=t;&$My~idbaf zyr}0G9&jo?QKfZbI%%GfH6&D3$ZAq4Gn=QhapF<13ka-;`%MXxN*GR*a?z@r*e~`6 zObynSzt{T$O7p{wVbN&^C+Jdv;J_fLIE7HmlqyNusWH{x`-B5-MnlRAl>;ejiSuot zB~+~l#B@+@t7;;z=H=WG##6151I}YYd0_PguV?KUf4atlS<7_>CWXbAJYH)fa*%rC zkx@34WTzG~&Q%m{d^5+E$x0j;?s;v;&!CwIY%{SKU|?trDvq#eAr^44wUE-)dnmgQ zqk$$OW@yRuWYp;kngF*>1MV;ifxUV)^IaN65}sG8G}tUm52-y=%Gl~D4Yf05MF29^ zTgRnetznUVkD{xG^s)ER>fh7%FMJo>22YP3fAUK^e(CnzJNS?L=<=N_pTGI@%DD92pD(^0 x+&j7S{1^A3i=R2z@5ozMPky-d_aEQ<^XS&MA3t|`{NIO1?>v0=fO;)){s+%7Qt$u( literal 0 HcmV?d00001 diff --git a/secrets/cache-private-key.age b/secrets/cache-private-key.age new file mode 100644 index 0000000000000000000000000000000000000000..9281777caf7a5a98ac50186cb9607cc9b7f8774d GIT binary patch literal 970 zcmZ9|%M06d003YW#voG^o%p~*z+v`w0WO42s3CQW~Rq)8ApZQk$Z(IkZ(y$JIl z?&L*;F+`@ad6Bw_Ox3Q-m>5&;1KN_)ORC+Q}|&v(itK=hNIp4j9yZ z5iSa^Yg_nWfKf0FJO^{(wzI`hMj<_bqigrLO;T4UaK%_B*4#z==uk`s=)vOc$po@( ze#gw0yTg*p7L^uYCOgt4zqAx1-R5~YIn_)Zr!^YRB^3-Pbw9&!xe+!E z;f8Du=roE{F_l`trOJ4s*-_x@kW&D<-;)gw*MpWCsqILn$+pt!XoRN~HkbIQQJSMI zIN_3j;C3?qJjZKSM7(ytMsOYsZdN6qn6{LL!fRz%fXp{^g!&6KY3(!G~NUF(>Yh&cE zg0+V&aHr@*w!|&g{n%fRDEd?@6&~RM%u$MIFkD_clL~07Y$o@%z&}JxqH5Vd5FM7` zD_ikijNoWM%PT_5?W&LS%d|)BXz0)1 z&xYPh?|uH{Bka9bF5PD953fA;@2B7Dm&eAv*RMT(Kz{L%FrZ}Pvrir(z}eE8+;E&s1u qpIua`b8qeLo*8>D|8())r{A#Of9=@^A9(bK8~@xnZ~Xnl)&BtF9!q)v literal 0 HcmV?d00001 diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 8b5a16b..db1a0a0 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -6,6 +6,8 @@ let hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz"; jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0"; matrix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMIbvNNYrsT9sSBSwIL9c0LiHDaOiztlTJZAGgTDGUHq root@vm-matrix"; + exodus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFxmnCj2E9DxcnefPW+n4yCuLShxqr0p024riogdeXA3"; + systems = [ genesis linode @@ -14,6 +16,7 @@ let hosea jeremiah matrix + exodus ]; user_genesis_virt = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFWPSFQT0AH77wrwRhiskcBS0w4ZakBRdJywYYBsnm3S greg@genesis"; @@ -23,6 +26,7 @@ let user_isaiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAl6DJVrPSujvJSAEA5Q8tRrzfJs/c6DMwqwQEUFffIR greg@isaiah"; user_hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrqJQvDspLi1vXQRJ/Z5kN/F8jCBHvaXjo+5zLuIYjR greg@hosea"; user_jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYIiecdyM9c7tXgR96983K3wqiJeQRMbrzGIF8Wy6uO greg@jeremiah"; + user_exodus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC189EnvWjNUp3xSzPMAtw85oQEsvP1tQR1TK640nLx6 greg@exodus"; users = [ user_genesis_virt @@ -32,6 +36,7 @@ let user_isaiah user_hosea user_jeremiah + user_exodus ]; everyone = systems ++ users; @@ -50,6 +55,25 @@ in "jude-forgejo-runner.age".publicKeys = everyone; "minio.age".publicKeys = everyone; + "cache-private-key.age".publicKeys = [ + jeremiah + isaiah + jude + user_jeremiah + user_isaiah + user_jude + user_exodus + ]; + "cache-credentials.age".publicKeys = [ + jeremiah + isaiah + jude + user_jeremiah + user_isaiah + user_jude + user_exodus + ]; + "restic-env.age".publicKeys = everyone; "restic-pw.age".publicKeys = everyone;