From d6629c876993c09398a6ba81366b1f096a514a32 Mon Sep 17 00:00:00 2001
From: Greg Hellings <greg.hellings@gmail.com>
Date: Fri, 18 Oct 2024 16:46:35 -0500
Subject: [PATCH] Enable remote builder configuration

Allow easily setting a box up as a remote builder
---
 hosts/myself/default.nix         | 39 +++++++++++++-------------
 modules/baseline.nix             |  4 +++
 modules/nixos/default.nix        | 48 ++++++++++++++++++++------------
 modules/nixos/remote-builder.nix | 24 ++++++++++++++++
 4 files changed, 78 insertions(+), 37 deletions(-)
 create mode 100644 modules/nixos/remote-builder.nix

diff --git a/hosts/myself/default.nix b/hosts/myself/default.nix
index 7c2edd3..1564af3 100644
--- a/hosts/myself/default.nix
+++ b/hosts/myself/default.nix
@@ -8,7 +8,10 @@
     ./minio.nix
   ];
 
-  greg.tailscale.enable = true;
+  greg = {
+    tailscale.enable = true;
+    remote-builder.enable = true;
+  };
 
   services = {
     openssh.enable = true;
@@ -28,25 +31,27 @@
     };
     interfaces = {
       enp38s0 = {
-        ipv4.addresses = [{
-          address = "10.42.1.6";
-          prefixLength = 16;
-        }
+        ipv4.addresses = [
+          {
+            address = "10.42.1.6";
+            prefixLength = 16;
+          }
           {
             address = "10.42.100.1";
             prefixLength = 16;
-          }];
+          }
+        ];
       };
       san = {
-        ipv4.addresses = [{
-          address = "10.201.1.1";
-          prefixLength = 24;
-        }];
+        ipv4.addresses = [
+          {
+            address = "10.201.1.1";
+            prefixLength = 24;
+          }
+        ];
       };
     };
-    nameservers = [
-      "10.42.1.5"
-    ];
+    nameservers = [ "10.42.1.5" ];
   };
   users = {
     users = {
@@ -74,14 +79,10 @@
         configurationLimit = 10;
       };
     };
-    binfmt.emulatedSystems = [
-      "aarch64-linux"
-    ];
+    binfmt.emulatedSystems = [ "aarch64-linux" ];
   };
   nixpkgs.config = {
     allowUnfree = true;
-    permittedInsecurePackages = [
-      "nodejs-16.20.2"
-    ];
+    permittedInsecurePackages = [ "nodejs-16.20.2" ];
   };
 }
diff --git a/modules/baseline.nix b/modules/baseline.nix
index 18b5e05..1538c88 100644
--- a/modules/baseline.nix
+++ b/modules/baseline.nix
@@ -15,6 +15,10 @@
       keep-derivations = true;
       min-free = (toString (1024 * 1024 * 1024));
       max-free = (toString (5 * 1024 * 1024 * 1024));
+      trusted-users = [
+        "greg"
+        "gregory.hellings"
+      ]; # For home and for work machines
       substituters = [
         "https://cache.garnix.io"
         "https://ai.cachix.org"
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index 3d907eb..90e0166 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -1,10 +1,12 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 
 let
-  x =
-    if builtins.hasAttr "xonsh-unwrapped" pkgs then
-      pkgs.xonsh else
-      pkgs.xonsh.passthru.wrapper;
+  x = if builtins.hasAttr "xonsh-unwrapped" pkgs then pkgs.xonsh else pkgs.xonsh.passthru.wrapper;
 in
 {
   imports = [
@@ -20,6 +22,7 @@ in
     ./linode.nix
     ./print.nix
     ./proxy.nix
+    ./remote-builder.nix
     ./router.nix
     ./rpi4.nix
     ./sway.nix
@@ -57,17 +60,21 @@ in
 
   programs.xonsh = {
     enable = true;
-    package = (x.override {
-      extraPackages = (ps: with ps; [
-        (ps.toPythonModule pkgs.pipenv)
-        pyyaml
-        requests
-        ruamel-yaml
-        xonsh-apipenv
-        pkgs.nur.repos.xonsh-xontribs.xonsh-direnv
-        pkgs.nur.repos.xonsh-xontribs.xontrib-vox
-      ]);
-    });
+    package = (
+      x.override {
+        extraPackages = (
+          ps: with ps; [
+            (ps.toPythonModule pkgs.pipenv)
+            pyyaml
+            requests
+            ruamel-yaml
+            xonsh-apipenv
+            pkgs.nur.repos.xonsh-xontribs.xonsh-direnv
+            pkgs.nur.repos.xonsh-xontribs.xontrib-vox
+          ]
+        );
+      }
+    );
   };
 
   # Enable the OpenSSH daemon for remote control
@@ -82,9 +89,14 @@ in
   users.users.greg = {
     isNormalUser = true;
     createHome = true;
-    extraGroups = [ "wheel" "networkmanager" ]; # Enable ‘sudo’ for the user.
+    extraGroups = [
+      "wheel"
+      "networkmanager"
+    ]; # Enable ‘sudo’ for the user.
     shell = config.programs.xonsh.package;
-    openssh.authorizedKeys.keys = lib.strings.splitString "\n" (builtins.readFile ../../home/ssh/authorized_keys);
+    openssh.authorizedKeys.keys = lib.strings.splitString "\n" (
+      builtins.readFile ../../home/ssh/authorized_keys
+    );
   };
 
   i18n.defaultLocale = "en_US.UTF-8";
diff --git a/modules/nixos/remote-builder.nix b/modules/nixos/remote-builder.nix
new file mode 100644
index 0000000..e0faeeb
--- /dev/null
+++ b/modules/nixos/remote-builder.nix
@@ -0,0 +1,24 @@
+{ lib, config, ... }:
+
+let
+  cfg = config.greg.remote-builder;
+in
+with lib;
+{
+  options.greg.remote-builder = {
+    enable = mkEnableOption "Enable this as a remote builder for myself";
+  };
+
+  config = mkIf cfg.enable {
+    greg.tailscale.enable = true;
+    users.users.remote-builder-user = {
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG4fNCnomQEsFKQZp16LXRqkfXHzzZbGAYJWPMvlGGQy root@exodus"
+      ];
+      homeMode = "500";
+      isNormalUser = true;
+      useDefaultShell = true;
+    };
+    nix.settings.trusted-users = [ config.users.users.remote-builder-user.name ];
+  };
+}