lukegb/depot
1
0
Fork 0
Code Issues 1 Pull requests Projects Packages Activity Actions

ops/nixos: whitby-distributed

Browse source
This commit is contained in:
Luke Granger-Brown 2023-03-12 03:51:10 +00:00
parent c5d4542bbb
commit 6d24fe6e78
4 changed files with 44 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
ops/nixos/cofractal-ams01/default.nix
View file

@ -47,6 +47,7 @@ in
imports = [
../lib/zfs.nix
../lib/bgp.nix
../lib/whitby-distributed.nix
../lib/nixbuild-distributed.nix
../lib/gitlab-runner-cacher.nix
../lib/coredns/default.nix

18
ops/nixos/lib/nixbuild-distributed.nix
View file

@ -4,7 +4,7 @@
{ config, lib, ... }:
{
imports = [ ./vault-agent-secrets.nix ];
imports = [ ./nixbuild-key.nix ];
# Distributed builds!
nix.buildMachines = lib.mkAfter [{
@ -27,22 +27,6 @@
builders-use-substitutes = true
'';
my.vault.secrets.id_ed25519_nixbuild = {
group = "users";
template = ''
{{ with secret "kv/apps/nixbuild" -}}
{{ .Data.data.id_ed25519_nixbuild }}
{{- end }}
'';
};
my.vault.secrets."id_ed25519_nixbuild.pub" = {
group = "users";
template = ''
{{ with secret "kv/apps/nixbuild" -}}
{{ .Data.data.id_ed25519_nixbuild_pub }}
{{- end }}
'';
};
programs.ssh.extraConfig = ''
Host eu.nixbuild.net
PubkeyAcceptedKeyTypes ssh-ed25519

25
ops/nixos/lib/nixbuild-key.nix Normal file
View file

@ -0,0 +1,25 @@
# SPDX-FileCopyrightText: 2023 Luke Granger-Brown <depot@lukegb.com>
#
# SPDX-License-Identifier: Apache-2.0
{ config, lib, ... }:
{
imports = [ ./vault-agent-secrets.nix ];
my.vault.secrets.id_ed25519_nixbuild = {
group = "users";
template = ''
{{ with secret "kv/apps/nixbuild" -}}
{{ .Data.data.id_ed25519_nixbuild }}
{{- end }}
'';
};
my.vault.secrets."id_ed25519_nixbuild.pub" = {
group = "users";
template = ''
{{ with secret "kv/apps/nixbuild" -}}
{{ .Data.data.id_ed25519_nixbuild_pub }}
{{- end }}
'';
};
}

19
ops/nixos/lib/whitby-distributed.nix
View file

@ -2,11 +2,13 @@
#
# SPDX-License-Identifier: Apache-2.0
{ lib, ... }:
{ lib, config, ... }:
{
imports = [ ./nixbuild-key.nix ];
# Distributed builds!
nix.buildMachines = lib.mkAfter [ {
hostName = "whitby";
hostName = "whitby-build";
system = "x86_64-linux";
maxJobs = 64;
speedFactor = 4;
@ -17,4 +19,17 @@
nix.extraOptions = ''
builders-use-substitutes = true
'';
programs.ssh.extraConfig = ''
Host whitby-build
User lukegb
PubkeyAcceptedKeyTypes ssh-ed25519
IdentityFile ${config.my.vault.secrets.id_ed25519_nixbuild.path}
'';
programs.ssh.knownHosts = {
whitby-build = {
hostNames = [ "whitby.tvl.fyi" "whitby-build" ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILNh/w4BSKov0jdz3gKBc98tpoLta5bb87fQXWBhAl2I";
};
};
}