Configuration for my NixOS based systems and Home Manager
Setup remote building on odin + shizuri from misaki
+151
+83
README.md
+83
README.md
···
139
139
home-manager switch --flake .#noah-aleister
140
140
```
141
141
142
+
### Remote Builders
143
+
144
+
`shizuri` and `odin` are configured as trusted `x86_64-linux` Nix remote builders. Client hosts import `modules/nix-remote-builders.nix` through `common.nix`, so NixOS hosts in this flake will try to use both builders except for the current host itself.
145
+
146
+
Builder access uses the `nixremote` user declared in `modules/nix-builder.nix`. Add client public keys to `users.users.nixremote.openssh.authorizedKeys.keys` before rebuilding the build hosts.
147
+
148
+
#### Set up a new client
149
+
150
+
Generate or install the client key at the path expected by `modules/nix-remote-builders.nix`:
151
+
152
+
```bash
153
+
sudo install -d -m 700 /root/.ssh
154
+
sudo ssh-keygen -t ed25519 -N '' -C "nix-remote-builder@$(hostname)" -f /root/.ssh/nix-remote-builder
155
+
```
156
+
157
+
Copy the public key:
158
+
159
+
```bash
160
+
sudo cat /root/.ssh/nix-remote-builder.pub
161
+
```
162
+
163
+
Add that public key to `users.users.nixremote.openssh.authorizedKeys.keys` in `modules/nix-builder.nix`, then rebuild each builder:
164
+
165
+
```bash
166
+
sudo nixos-rebuild switch --flake .#shizuri
167
+
sudo nixos-rebuild switch --flake .#odin
168
+
```
169
+
170
+
On the client, trust the builder host keys and rebuild the client:
171
+
172
+
```bash
173
+
sudo ssh-keyscan -H shizuri odin | sudo tee -a /root/.ssh/known_hosts >/dev/null
174
+
sudo nixos-rebuild switch --flake .#<client-hostname>
175
+
```
176
+
177
+
Test builder access:
178
+
179
+
```bash
180
+
sudo ssh -i /root/.ssh/nix-remote-builder nixremote@shizuri nix-store --version
181
+
sudo ssh -i /root/.ssh/nix-remote-builder nixremote@odin nix-store --version
182
+
sudo nix build nixpkgs#hello --max-jobs 0 -L
183
+
```
184
+
185
+
#### Set up a new build host
186
+
187
+
Import the builder module from the new host configuration:
188
+
189
+
```nix
190
+
{
191
+
imports = [
192
+
../../modules/nix-builder.nix
193
+
];
194
+
}
195
+
```
196
+
197
+
Add the host to the `builders` list in `modules/nix-remote-builders.nix`:
198
+
199
+
```nix
200
+
{
201
+
hostName = "new-builder";
202
+
sshUser = "nixremote";
203
+
sshKey = "/root/.ssh/nix-remote-builder";
204
+
system = "x86_64-linux";
205
+
protocol = "ssh-ng";
206
+
maxJobs = 24;
207
+
speedFactor = 4;
208
+
supportedFeatures = [
209
+
"nixos-test"
210
+
"benchmark"
211
+
"big-parallel"
212
+
"kvm"
213
+
];
214
+
}
215
+
```
216
+
217
+
Rebuild the new builder first, then rebuild each client that should use it:
218
+
219
+
```bash
220
+
sudo nixos-rebuild switch --flake .#new-builder
221
+
sudo ssh-keyscan -H new-builder | sudo tee -a /root/.ssh/known_hosts >/dev/null
222
+
sudo nixos-rebuild switch --flake .#<client-hostname>
223
+
```
224
+
142
225
## Maintenance
143
226
144
227
Regular maintenance tasks:
+4
common.nix
+4
common.nix
+1
host-specific/odin/configuration.nix
+1
host-specific/odin/configuration.nix
+1
host-specific/shizuri/configuration.nix
+1
host-specific/shizuri/configuration.nix
+21
modules/nix-builder.nix
+21
modules/nix-builder.nix
···
1
+
{ lib, ... }:
2
+
{
3
+
users.users.nixremote = {
4
+
isNormalUser = true;
5
+
createHome = true;
6
+
description = "Nix remote build user";
7
+
openssh.authorizedKeys.keys = [
8
+
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINeVMpqxARxLDGCYSys1Rd8fJnZG07IPWwDH1I+vGvFA nix-remote-builder@misaki"
9
+
];
10
+
};
11
+
12
+
nix.settings = {
13
+
trusted-users = [ "nixremote" ];
14
+
system-features = lib.mkForce [
15
+
"nixos-test"
16
+
"benchmark"
17
+
"big-parallel"
18
+
"kvm"
19
+
];
20
+
};
21
+
}
+41
modules/nix-remote-builders.nix
+41
modules/nix-remote-builders.nix
···
1
+
{ config, lib, ... }:
2
+
let
3
+
builders = [
4
+
{
5
+
hostName = "shizuri";
6
+
sshUser = "nixremote";
7
+
sshKey = "/root/.ssh/nix-remote-builder";
8
+
system = "x86_64-linux";
9
+
protocol = "ssh-ng";
10
+
maxJobs = 24;
11
+
speedFactor = 4;
12
+
supportedFeatures = [
13
+
"nixos-test"
14
+
"benchmark"
15
+
"big-parallel"
16
+
"kvm"
17
+
];
18
+
}
19
+
{
20
+
hostName = "odin";
21
+
sshUser = "nixremote";
22
+
sshKey = "/root/.ssh/nix-remote-builder";
23
+
system = "x86_64-linux";
24
+
protocol = "ssh-ng";
25
+
maxJobs = 24;
26
+
speedFactor = 4;
27
+
supportedFeatures = [
28
+
"nixos-test"
29
+
"benchmark"
30
+
"big-parallel"
31
+
"kvm"
32
+
];
33
+
}
34
+
];
35
+
in
36
+
{
37
+
nix.distributedBuilds = true;
38
+
nix.settings.builders-use-substitutes = true;
39
+
40
+
nix.buildMachines = lib.filter (builder: builder.hostName != config.networking.hostName) builders;
41
+
}