|
1 | | -{ lib, pkgs, ... }: |
| 1 | +{ lib, ... }: |
2 | 2 | let |
3 | 3 | # To give yourself permission to use `makemake` as a remote builder, add |
4 | 4 | # yourself to the list below (sorted appropriately). You'll need `remotebuild = true;`. |
|
88 | 88 | }; |
89 | 89 | in |
90 | 90 | { |
91 | | - imports = [ |
92 | | - # TODO: remove this once everyone is using personal accounts: |
93 | | - # <https://github.com/ngi-nix/infra/issues/26>. |
94 | | - { |
95 | | - users.users.root.openssh.authorizedKeys.keys = lib.pipe users [ |
96 | | - (lib.filterAttrs (name: user: user.wheel or false)) |
97 | | - (lib.mapAttrsToList (name: user: user.keys)) |
98 | | - lib.flatten |
99 | | - ]; |
100 | | - |
101 | | - users.users.remotebuild = { |
102 | | - isNormalUser = true; |
103 | | - createHome = false; |
104 | | - group = "remotebuild"; |
105 | | - openssh.authorizedKeys.keys = lib.pipe users [ |
106 | | - (lib.filterAttrs (name: user: user.remotebuild or false)) |
107 | | - (lib.mapAttrsToList (name: user: user.keys)) |
108 | | - lib.flatten |
109 | | - ]; |
110 | | - }; |
111 | | - |
112 | | - systemd.tmpfiles.rules = |
113 | | - let |
114 | | - rootBashProfile = pkgs.writeText "bash_profile" /* bash */ '' |
115 | | - if [ -n "$SSH_CONNECTION" ]; then |
116 | | - echo "" >&2 |
117 | | - echo "*** NOTE: SSH access as the root user is deprecated, and will be removed soon! ***" >&2 |
118 | | - echo "" >&2 |
119 | | - echo "Please switch to to your own personal user." >&2 |
120 | | - echo "See <https://github.com/ngi-nix/infra/issues/37> for details." >&2 |
121 | | - fi |
122 | | - ''; |
123 | | - remoteBuildBashProfile = pkgs.writeText "bash_profile" /* bash */ '' |
124 | | - echo "" >&2 |
125 | | - echo "*** NOTE: The remotebuild user is deprecated, and will be removed soon! ***" >&2 |
126 | | - echo "" >&2 |
127 | | - echo "Please switch to to your own personal user." >&2 |
128 | | - echo "See <https://github.com/ngi-nix/infra/issues/37> for details." >&2 |
129 | | - ''; |
130 | | - in |
131 | | - [ |
132 | | - "L+ /root/.bash_profile 0644 root root - ${rootBashProfile}" |
133 | | - "L+ /home/remotebuild/.bash_profile 0644 remotebuild remotebuild - ${remoteBuildBashProfile}" |
134 | | - ]; |
135 | | - } |
136 | | - ]; |
137 | | - |
138 | 91 | nix.settings.trusted-users = [ |
139 | 92 | # This allows using `makemake` as a remote builder. |
140 | 93 | "@remotebuild" |
|
0 commit comments