diff --git a/hosts/default.nix b/hosts/default.nix index 9ad2cc3..79ba1f8 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -22,6 +22,7 @@ let }; lib = nixpkgs.lib; + users.defaultShell = "pkgs.zsh"; in { @@ -33,6 +34,7 @@ in nur.nixosModules.nur ./desktop ./configuration_desktop.nix + ../modules/hardware/remoteBuilder.nix nixos-hardware.nixosModules.common-cpu-amd nixos-hardware.nixosModules.common-gpu-amd nixos-hardware.nixosModules.common-pc-ssd @@ -60,6 +62,7 @@ in nur.nixosModules.nur ./laptop ./configuration_desktop.nix + ../modules/hardware/remoteClient.nix nixos-hardware.nixosModules.common-cpu-intel nixos-hardware.nixosModules.common-gpu-intel nixos-hardware.nixosModules.common-pc-ssd @@ -86,6 +89,7 @@ in nur.nixosModules.nur ./steamdeck ./configuration_desktop.nix + ../modules/hardware/remoteClient.nix nixos-hardware.nixosModules.common-cpu-amd nixos-hardware.nixosModules.common-gpu-amd nixos-hardware.nixosModules.common-pc-ssd @@ -139,6 +143,7 @@ in nur.nixosModules.nur ./nas ./configuration_desktop.nix + ../modules/hardware/remoteClient.nix nixos-hardware.nixosModules.common-cpu-intel nixos-hardware.nixosModules.common-pc-ssd @@ -165,6 +170,7 @@ in nur.nixosModules.nur ./jupiter ./configuration_desktop.nix + ../modules/hardware/remoteClient.nix nixos-hardware.nixosModules.common-cpu-intel nixos-hardware.nixosModules.common-pc-ssd diff --git a/modules/hardware/remoteBuilder.nix b/modules/hardware/remoteBuilder.nix new file mode 100644 index 0000000..13f1442 --- /dev/null +++ b/modules/hardware/remoteBuilder.nix @@ -0,0 +1,14 @@ +{ pkgs, ... }: + +{ + users.users.nixremote = { # System User + isNormalUser = true; + extraGroups = [ "kvm" ]; + shell = pkgs.zsh; # Default shell + uid = 1001; +# initialPassword = "password95"; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILczsj4W1kFQaalFwaY+RJ4LEzNeFKD+itXB40Q2O59M nixremote@hades" + ]; + }; +} diff --git a/modules/hardware/remoteClient.nix b/modules/hardware/remoteClient.nix new file mode 100644 index 0000000..a45d91f --- /dev/null +++ b/modules/hardware/remoteClient.nix @@ -0,0 +1,24 @@ + +{ config, lib, pkgs, ... }: + +{ + nix = { + distributedBuilds = true; + buildMachines = [ { + hostName = "hades"; + system = "x86_64-linux"; + supportedFeatures = [ "kvm" "big-parallel" ]; + sshUser = "nixremote" + sshKey = config.age.secrets."keys/nixremote".path; + maxJobs = 1; + speedFactor = 8; + publicHostKey = "c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUVnbld5UVVVYSt2Y0hBS3g2ZWRiVGdxVzhwaCtNQ2lTNmZVd1lqWWNTK28gcm9vdEBoYWRlcwo=%"; + protocol = "ssh-ng"; + ] }; + }; + + age.secrets."keys/nixremote" = { + file = ../../../secrets/keys/nixremote.age; + owner = "root"; + }; +} diff --git a/secrets/keys/nixremote.age b/secrets/keys/nixremote.age new file mode 100644 index 0000000..5b1de81 Binary files /dev/null and b/secrets/keys/nixremote.age differ diff --git a/secrets/nixremote b/secrets/nixremote new file mode 100644 index 0000000..6354229 --- /dev/null +++ b/secrets/nixremote @@ -0,0 +1,7 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW +QyNTUxOQAAACC3M7I+FtZBUGmpRcGmPkSeCxMzXhSg/orVweNENjufTAAAAJAgCaSVIAmk +lQAAAAtzc2gtZWQyNTUxOQAAACC3M7I+FtZBUGmpRcGmPkSeCxMzXhSg/orVweNENjufTA +AAAEAJPJDPptl9Ljj80G3MNyiAfMBKn6MOfBOT+vF0aBenTLczsj4W1kFQaalFwaY+RJ4L +EzNeFKD+itXB40Q2O59MAAAADWthYmJvbmVAaGFkZXM= +-----END OPENSSH PRIVATE KEY----- diff --git a/secrets/nixremote.pub b/secrets/nixremote.pub new file mode 100644 index 0000000..c82954d --- /dev/null +++ b/secrets/nixremote.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILczsj4W1kFQaalFwaY+RJ4LEzNeFKD+itXB40Q2O59M kabbone@hades diff --git a/secrets/secrets.nix b/secrets/secrets.nix index a807253..e3e3445 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -20,15 +20,24 @@ let dmz = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDwN8p78OncPIRUfV64PLHOem4LtlQ3opOJwLEYqdGVx"; hades = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEgnWyQUUa+vcHAKx6edbTgqW8ph+MCiS6fUwYjYcS+o"; - nbf5 = ""; + nas = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPfKbeexWFg8nFEQvZCcFycrwil24c4HJxZazDQpnVNs"; + jupiter = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILWXo8ljwE4o+nL4A3es3zw4rPhvGRf7MIR336mJaO3C"; + steamdeck = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGV8tMIza5FOB3DQhiYaS3QG67n4J0e4okCrvoxPxneA"; systems = [ - hades - nbf5 dmz + hades + nas + jupiter + steamdeck ]; servers = [ dmz ]; + buildClients = [ + nas + jupiter + steamdeck + ]; in { "services/postgresql/initScript.age".publicKeys = servers ++ users; @@ -45,4 +54,5 @@ in "services/gitea/databasePassword.age".publicKeys = servers ++ users; "services/gitea/mailerPassword.age".publicKeys = servers ++ users; "services/woodpecker/environment.age".publicKeys = servers ++ users; + "keys/nixremote.age".publicKeys = buildClients ++ users; }