summaryrefslogtreecommitdiff
path: root/system-profiles/build-server/default.nix
blob: 9cb9e14268a6f2f2bc37740020c3ddb79627bbd5 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
{ customUtils, flake, config, lib, ... }:

{
  imports = with flake.nixosModules.systemProfiles; [ openssh ];
  
  config = {
    users.groups.nix-ssh-builder = {};
    users.users.nix-ssh-builder = {
      description = "Nix build server user";
      useDefaultShell = true;
      isSystemUser = true;
      group = "nix-ssh-builder";
      extraGroups = [ "ssh" ];
    };
    nix.trustedUsers = [ "nix-ssh-builder" ];

    services.openssh = {
      enable = true;
      extraConfig = ''
        Match User nix-ssh-builder
          AllowAgentForwarding no
          AllowTcpForwarding no
          PermitTTY no
          PermitTunnel no
          X11Forwarding no
          ForceCommand ${config.nix.package.out}/bin/nix-store --serve --write
        Match All
      '';
    };

    users.users.nix-ssh-builder.openssh.authorizedKeys.keys =
      let
        importKeys = dir: lib.attrValues (customUtils.mapFilterAttrs (_: v: v != null) (n: v: lib.nameValuePair n (if v == "directory" then importKeys' dir n else null)) (builtins.readDir dir));
        importKeys' = dir: host: builtins.readFile (dir + "/${host}/public");
      in importKeys ./clients;
  };
}