add remote builder

5 files changed, 67 insertions, 3 deletions

diff --git a/config/default.nix b/config/default.nix
index 81e202a..5af99ea 100644
--- a/config/default.nix
+++ b/config/default.nix
@@ -5,7 +5,7 @@
     ./environment.nix
     ./hardware
     ./networking
-    ./nix.nix
+    ./nix
     ./users.nix
   ];
 
diff --git a/config/networking/default.nix b/config/networking/default.nix
index 409ce3b..fb8dafe 100644
--- a/config/networking/default.nix
+++ b/config/networking/default.nix
@@ -78,7 +78,13 @@ in {
               prefix = "192.168.2";
               prefixLength = 24;
             };
-            machines.self.ip = "192.168.2.1";
+            machines = {
+              self.ip = "192.168.2.1";
+              hephaistos = {
+                ip = "192.168.2.2";
+                mac = "f4:a4:75:a1:a2:93";
+              };
+            };
           };
           iot = {
             interfaces = ["wlp1s0-iot"];
@@ -131,6 +137,23 @@ in {
         address = ifaces.all."${interface}".machines.livebox.ip;
       };
 
+      hosts = let
+        withMachines =
+          # [{machines: AttrSet, ...}]
+          lib.collect (value: builtins.isAttrs value.machines or false)
+          config.personal.networking.interfaces.all;
+        machineToHost =
+          # String -> {ip: String, ...} -> { name: String, value: String }
+          name: {ip, ...}: lib.nameValuePair ip "${name}.local";
+        pruneMachines =
+          # AttrSet -> {{ip: String, ...}}
+          lib.filterAttrs (name: value: name != "self" && (builtins.isString value.ip or false));
+        hosts =
+          # [{machines: AttrSet, ...}] -> [{String}]
+          lib.forEach withMachines ({machines, ...}: lib.mapAttrs' machineToHost (pruneMachines machines));
+      in
+        lib.zipAttrs hosts;
+
       useDHCP = false;
       dhcpcd.enable = false;
 
diff --git a/config/networking/services/firewall/ruleset.nix b/config/networking/services/firewall/ruleset.nix
index 3418ef8..ba9b39d 100644
--- a/config/networking/services/firewall/ruleset.nix
+++ b/config/networking/services/firewall/ruleset.nix
@@ -5,6 +5,10 @@
       sonos-play1
       sonos-move
       ;
+    inherit
+      (interfaces.all.wan.machines)
+      hephaistos
+      ;
   };
   makeTable = args:
     {
@@ -195,7 +199,13 @@ in {
           + ssdp
           + sonos.player-controller
           + sonos.controller-player;
-        wan_wan.rules = with rulesCommon; syncthing + kdeconnect;
+        wan_wan.rules = with rulesCommon;
+          syncthing
+          + kdeconnect
+          + ''
+            ip daddr ${machines.hephaistos.ip} \
+              ${ssh}
+          '';
         forward = makeBaseChain "filter" "forward" {
           rules = with rulesCommon;
             conntrack
diff --git a/config/nix.nix b/config/nix/default.nix
index 182aa1b..a9d79cc 100644
--- a/config/nix.nix
+++ b/config/nix/default.nix
@@ -1,4 +1,6 @@
 {lib, ...}: {
+  imports = [./remote-builds.nix];
+
   personal.nix = {
     enable = true;
     autoUpgrade.enable = true;
diff --git a/config/nix/remote-builds.nix b/config/nix/remote-builds.nix
new file mode 100644
index 0000000..2bca883
--- /dev/null
+++ b/config/nix/remote-builds.nix
@@ -0,0 +1,29 @@
+{...}: {
+  programs.ssh = {
+    extraConfig = ''
+      Host hephaistos.local
+        # Prevent using ssh-agent or another keyfile, useful for testing
+        IdentitiesOnly yes
+        IdentityFile /root/.ssh/nixremote
+        # The weakly privileged user on the remote builder – if not set, 'root' is used – which will hopefully fail
+        User nixremote
+    '';
+    knownHosts."hephaistos.local".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIPMlRcOB8142XkF8uFCLbyYhcqp4LioChXKAM3EGqSa";
+  };
+
+  nix = {
+    distributedBuilds = true;
+    buildMachines = [
+      {
+        hostName = "hephaistos.local";
+        system = "x86_64-linux";
+        # Nix custom ssh-variant that avoids lots of "trusted-users" settings pain
+        protocol = "ssh-ng";
+        maxJobs = 4;
+        speedFactor = 4;
+        supportedFeatures = ["nixos-test" "benchmark" "big-parallel" "kvm"];
+        mandatoryFeatures = [];
+      }
+    ];
+  };
+}