feat: remote build for EFLKumo

config/hosts/imxyy-nix-server/build.nix

@@ -0,0 +1,47 @@
+{
+  config,
+  lib,
+  pkgs,
+  sopsRoot,
+  ...
+}:
+{
+  sops.secrets.et-imxyy-nix-server-nixremote = {
+    sopsFile = sopsRoot + /et-imxyy-nix-server-nixremote.toml;
+    format = "binary";
+  };
+  environment.systemPackages = [ pkgs.easytier ];
+  systemd.services."easytier-nixremote" = {
+    enable = true;
+    script = "${pkgs.easytier}/bin/easytier-core -c ${config.sops.secrets.et-imxyy-nix-server-nixremote.path}";
+    serviceConfig = {
+      Restart = lib.mkOverride 500 "always";
+      RestartMaxDelaySec = lib.mkOverride 500 "1m";
+      RestartSec = lib.mkOverride 500 "100ms";
+      RestartSteps = lib.mkOverride 500 9;
+      User = "root";
+    };
+    wantedBy = [ "multi-user.target" ];
+    after = [
+      "network.target"
+      "sops-nix.service"
+    ];
+  };
+  users.groups.nixremote = { };
+  users.users.nixremote = {
+    isSystemUser = true;
+    description = "nix remote build user";
+    group = "nixremote";
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOEFLUkyeaK8ZPPZdVNEmtx8zvoxi7xqS2Z6oxRBuUPO imxyy@imxyy-nix"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBWOy0QmAyxENg/O5m3cus8U3c9jCLioivwcWsh5/a82 imxyy-hisense-pad"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK8pivvE8PMtsOxmccfNhH/4KehDKhBfUfJbQZxo/SZT imxyy-ace5"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKALTBn/QSGcSPgMg0ViSazFcaA0+nEF05EJpjbsI6dE imxyy_soope_@imxyy-cloudwin"
+
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIENauvvhVMLsUwH9cPYsvnOg7VCL3a4yEiKm8I524TE efl@efl-nix"
+    ];
+  };
+  nix.settings.trusted-users = [
+    "nixremote"
+  ];
+}

config/hosts/imxyy-nix-server/default.nix

@@ -21,5 +21,6 @@
     ./note.nix
     ./matrix.nix
     ./minio.nix
+    ./build.nix
   ];
 }

config/hosts/imxyy-nix-server/net.nix

@@ -455,7 +455,7 @@
   environment.systemPackages = [ pkgs.easytier ];
   systemd.services."easytier" = {
     enable = true;
-    script = "easytier-core -c ${config.sops.secrets.et-imxyy-nix-server.path}";
+    script = "${pkgs.easytier}/bin/easytier-core -c ${config.sops.secrets.et-imxyy-nix-server.path}";
     serviceConfig = {
       Restart = lib.mkOverride 500 "always";
       RestartMaxDelaySec = lib.mkOverride 500 "1m";
@@ -468,11 +468,6 @@
       "network.target"
       "sops-nix.service"
     ];
-    path = with pkgs; [
-      easytier
-      iproute2
-      bash
-    ];
   };
 
   virtualisation.oci-containers = {

config/hosts/imxyy-nix-server/samba.nix

@@ -26,9 +26,8 @@
   ];
   users = {
     users.nas = {
-      isNormalUser = true;
-      home = "/var/empty";
-      description = "nas user";
+      isSystemUser = true;
+      description = "NAS user";
       group = "nextcloud";
     };
   };