From 81223079c2e95b861cbbc1bc58bfd9a149c695c4 Mon Sep 17 00:00:00 2001
From: Greg Hellings <greg.hellings@gmail.com>
Date: Tue, 25 Nov 2025 20:16:06 -0600
Subject: [PATCH] Add builder image

---
 .gitlab-ci.yml       |  1 +
 flake.nix            |  9 ------
 pkgs/default.nix     |  3 +-
 pkgs/img-builder.nix | 67 ++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 70 insertions(+), 10 deletions(-)
 create mode 100644 pkgs/img-builder.nix

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index edba834..9dc5099 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -33,6 +33,7 @@ default:
       - IMG:
           - img-bitwarden
           - img-immich
+          - img-builder
   script:
     - nix --extra-experimental-features "nix-command flakes" build ".#${IMG}"
     - cp -L result "${IMG}.tar.gz"
diff --git a/flake.nix b/flake.nix
index ca45cb3..4bc5aad 100644
--- a/flake.nix
+++ b/flake.nix
@@ -4,15 +4,6 @@
 {
   description = "Greg's machines!";
 
-  nixConfig = {
-    extra-substituters = [
-      "https://greg-hellings.cachix.org"
-    ];
-    extra-trusted-public-keys = [
-      "greg-hellings.cachix.org-1:y01Jl/L5evlhxdnUW6n56AiI1k8g1wxWhTxJCe7XSco="
-    ];
-  };
-
   inputs = {
     agenix = {
       url = "github:ryantm/agenix";
diff --git a/pkgs/default.nix b/pkgs/default.nix
index 987f449..a3550e1 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, top, ... }:
 
 let
   c = pkgs.callPackage;
@@ -16,6 +16,7 @@ in
   inject-darwin = c ./inject-darwin.nix { };
   inject = c ./inject.nix { };
   img-bitwarden = c ./img-bitwarden.nix { };
+  img-builder = c ./img-builder.nix { inherit top; };
   img-immich = c ./img-immich.nix { };
   qemu-hook = c ./qemu-hook.nix { };
   setup-ssh = c ./setup-ssh { };
diff --git a/pkgs/img-builder.nix b/pkgs/img-builder.nix
new file mode 100644
index 0000000..a3e005e
--- /dev/null
+++ b/pkgs/img-builder.nix
@@ -0,0 +1,67 @@
+{
+  bashInteractive,
+  dockerTools,
+  git,
+  lib,
+  nix,
+  pkgs,
+  podman,
+  top,
+  writeShellApplication,
+  ...
+}:
+let
+  policy = (
+    pkgs.writeTextFile {
+      name = "policy.json";
+      text = ''
+        {
+          "default": [{"type": "insecureAcceptAnything"}]
+        }
+      '';
+      destination = "/etc/containers/policy.json";
+    }
+  );
+  activate = writeShellApplication {
+    name = "activate";
+    runtimeInputs = [ bashInteractive ];
+    text = ''
+      mkdir -p /etc/containers
+      cp ${policy}/etc/containers/policy.json /etc/containers/policy.json;
+      bash "$@"
+    '';
+  };
+in
+(import "${nix.src.outPath}/docker.nix" {
+  inherit pkgs;
+  name = "img-builder";
+  tag = "latest";
+
+  bundleNixpkgs = false;
+  Cmd = [
+    (lib.getExe activate)
+  ];
+  extraPkgs = [
+    dockerTools.caCertificates
+    podman
+  ];
+  flake-registry = (pkgs.formats.json { }).generate "flake-registry.json" ({
+    version = 2;
+    flakes.nixpkgs = {
+      exact = true;
+      from = {
+        id = "nixpkgs";
+        type = "indirect";
+      };
+      to = "${top.nixunstable}";
+    };
+  });
+  gitMinimal = git; # We want the full version in this
+  maxLayers = 111;
+  nixConf = {
+    experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+  };
+})