Added remote build user

modules/nixos/nix/default.nix

@@ -25,9 +25,12 @@ in
     };
 
     useSelfhostedCache = mkEnableOption "use self-hosted nix cache (currently hosted on gospel)";
+    remoteBuilder.enable = mkEnableOption "set up as a remote builder";
   };
 
-  config = mkIf cfg.enable {
+  config = mkIf cfg.enable (
+    lib.mkMerge [
+      {
         environment.systemPackages = with pkgs; [
           nix-prefetch
           nixfmt-rfc-style
@@ -71,5 +74,28 @@ in
               options = lib.mkDefault "--delete-older-than 30d";
             };
           };
+      }
+      (lib.mkIf cfg.remoteBuilder.enable {
+        users.users.remotebuild = {
+          isNormalUser = true;
+          createHome = false;
+          group = "remotebuild";
+
+          # All the keys from ./remote_client_keys should be trusted
+          openssh.authorizedKeys.keyFiles = (
+            let
+              publicKeys = builtins.readDir ./remote_client_keys;
+              fileNames = builtins.attrNames publicKeys;
+              filePaths = builtins.map (fileName: ./remote_client_keys + "/${fileName}") fileNames;
+            in
+            filePaths
+          );
         };
+
+        users.groups.remotebuild = { };
+
+        nix.settings.trusted-users = [ "remotebuild" ];
+      })
+    ]
+  );
 }

modules/nixos/nix/remote_client_keys/carbon.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKy1MP/CjBPhcXac3XgTEnhATN6xpXRO6YDkHNhLQrkx root@carbon

systems/x86_64-linux/gospel/default.nix

@@ -14,6 +14,7 @@
 
   aa = {
     nix.enable = true;
+    nix.remoteBuilder.enable = true;
 
     archetypes = {
       workstation.enable = true;