diff --git a/modules/nixos/remote-builder.nix b/modules/nixos/remote-builder.nix index 863a25a..0961a80 100644 --- a/modules/nixos/remote-builder.nix +++ b/modules/nixos/remote-builder.nix @@ -40,20 +40,33 @@ with lib; greg.tailscale.enable = true; # The builder user needs to be trusted to submit builds - nix.settings = { - post-build-hook = getExe ( - pkgs.writeShellScriptBin "upload-to-cache.sh" '' - set -eu - set -f - export AWS_SHARED_CREDENTIALS_FILE=${config.age.secrets.cache-credentials.path} - export IFS=' ' - echo "Uploading paths " $OUT_PATHS - nix copy --to "s3://binary-cache/?scheme=http&endpoint=nas.home%3A9000&profile=default" $OUT_PATHS - '' - ); - secret-key-files = config.age.secrets.private-cache.path; - trusted-users = [ config.users.users.remote-builder-user.name ]; - }; + nix.settings = + let + upload = getExe ( + pkgs.writeShellScriptBin "upload-to-cache.sh" '' + set -eu + set -f + export AWS_SHARED_CREDENTIALS_FILE=${config.age.secrets.cache-credentials.path} + export IFS=' ' + ${getExe config.nix.package} copy --to "s3://binary-cache/?scheme=http&endpoint=nas.home%3A9000&profile=default" "$@" + '' + ); + uploadRunner = getExe ( + pkgs.writeShellScriptBin "uploade-to-cache-runner.sh" '' + ${lib.getExe' config.systemd.package "systemd-run"} \ + --unit "upload-$(${lib.getExe' pkgs.coreutils "date"} +%s%3N)" \ + --property Type=exec \ + --property CollectMode=inactive \ + --property Group=nixbld \ + ${upload} $OUT_PATHS + '' + ); + in + { + post-build-hook = uploadRunner; + secret-key-files = config.age.secrets.private-cache.path; + trusted-users = [ config.users.users.remote-builder-user.name ]; + }; users.users.remote-builder-user = { openssh.authorizedKeys.keys = [