1 files changed, 35 insertions, 0 deletions

diff --git a/system-profiles/build-server/default.nix b/system-profiles/build-server/default.nix
new file mode 100644
index 00000000..9c821f64
--- /dev/null
+++ b/system-profiles/build-server/default.nix
@@ -0,0 +1,35 @@
+{ customUtils, flake, config, lib, ... }:
+
+{
+  imports = with flake.nixosModules.systemProfiles; [ openssh ];
+  
+  config = {
+    users.groups.nix-ssh-builder = {};
+    users.users.nix-ssh-builder = {
+      description = "Nix build server user";
+      useDefaultShell = true;
+      isSystemUser = true;
+      group = "nix-ssh-builder";
+    };
+
+    services.openssh = {
+      enable = true;
+      extraConfig = ''
+        Match User nix-ssh-builder
+          AllowAgentForwarding no
+          AllowTcpForwarding no
+          PermitTTY no
+          PermitTunnel no
+          X11Forwarding no
+          ForceCommand ${config.nix.package.out}/bin/nix-store --serve --write
+        Match All
+      '';
+    };
+
+    users.users.nix-ssh-builder.openssh.authorizedKeys.keys =
+      let
+        importKeys = dir: lib.attrValues (customUtils.mapFilterAttrs (_: v: v == "directory") (n: _: lib.nameValuePair n (importKeys' dir n)) (builtins.readDir dir));
+        importKeys' = dir: host: builtins.readFile (dir + "/${host}/public");
+      in importKeys ./clients;
+  };
+}