alejandro-angulo
0830ab5d48
All checks were successful
Gitea Actions Demo / Explore-Gitea-Actions (push) Successful in 9s
102 lines
2.6 KiB
Nix
102 lines
2.6 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}:
|
|
let
|
|
inherit (lib)
|
|
mkIf
|
|
mkEnableOption
|
|
mkOption
|
|
types
|
|
;
|
|
|
|
cfg = config.aa.nix;
|
|
selfHostedCacheHost = "https://cache.kilonull.com/";
|
|
in
|
|
{
|
|
options.aa.nix = {
|
|
enable = mkEnableOption "manage nix configuration.";
|
|
package = mkOption {
|
|
type = types.package;
|
|
default = pkgs.nixVersions.latest;
|
|
description = "Which nix package to use.";
|
|
};
|
|
|
|
useSelfhostedCache = mkEnableOption "use self-hosted nix cache (currently hosted on gospel)";
|
|
remoteBuilder.enable = mkEnableOption "set up as a remote builder";
|
|
};
|
|
|
|
config = mkIf cfg.enable (
|
|
lib.mkMerge [
|
|
{
|
|
environment.systemPackages = with pkgs; [
|
|
nix-prefetch
|
|
nixfmt-rfc-style
|
|
];
|
|
|
|
nix =
|
|
let
|
|
users = [
|
|
"root"
|
|
config.aa.user.name
|
|
];
|
|
in
|
|
{
|
|
package = cfg.package;
|
|
|
|
settings = {
|
|
experimental-features = "nix-command flakes";
|
|
trusted-users = users;
|
|
allowed-users = users;
|
|
|
|
builders-use-substitutes = cfg.useSelfhostedCache;
|
|
substituters =
|
|
if cfg.useSelfhostedCache then
|
|
[
|
|
# TESTING
|
|
"https://minio.kilonull.com/nix-store"
|
|
selfHostedCacheHost
|
|
]
|
|
else
|
|
[ ];
|
|
trusted-public-keys = mkIf cfg.useSelfhostedCache [
|
|
"gospelCache:9cbn8Wm54BbwpPS0TXw+15wrYZBpfOJt4Fzfbfcq/pc="
|
|
];
|
|
};
|
|
|
|
# TODO: Configure distributedBuilds and buildMachines?
|
|
|
|
gc = {
|
|
automatic = lib.mkDefault true;
|
|
dates = lib.mkDefault "weekly";
|
|
options = lib.mkDefault "--delete-older-than 30d";
|
|
};
|
|
};
|
|
}
|
|
(lib.mkIf cfg.remoteBuilder.enable {
|
|
users.users.remotebuild = {
|
|
isNormalUser = true;
|
|
createHome = false;
|
|
group = "remotebuild";
|
|
|
|
# All the keys from ./remote_client_keys should be trusted
|
|
openssh.authorizedKeys.keyFiles = (
|
|
let
|
|
publicKeys = builtins.readDir ./remote_client_keys;
|
|
fileNames = builtins.attrNames publicKeys;
|
|
filePaths = builtins.map (fileName: ./remote_client_keys + "/${fileName}") fileNames;
|
|
in
|
|
filePaths
|
|
);
|
|
};
|
|
|
|
users.groups.remotebuild = { };
|
|
|
|
nix.settings.trusted-users = [ "remotebuild" ];
|
|
})
|
|
]
|
|
);
|
|
}
|