enable remote-building for lappy/moby

hosts/by-name/servo/default.nix

@@ -29,6 +29,7 @@
   sane.services.wg-home.ip = config.sane.hosts.by-name."servo".wg-home.ip;
   sane.nixcache.substituters.servo = false;
   sane.nixcache.substituters.desko = false;
+  sane.nixcache.remote-builders.desko = false;
   # sane.services.duplicity.enable = true;  # TODO: re-enable after HW upgrade
 
   # automatically log in at the virtual consoles.

hosts/common/default.nix

@@ -57,6 +57,8 @@
   # does the daemon continually scan the nix store?
   # does the builder use some content-addressed db to efficiently dedupe?
   nix.settings.auto-optimise-store = true;
+  # TODO: see if i can remove this?
+  nix.settings.trusted-users = [ "root" ];
 
   services.journald.extraConfig = ''
     # docs: `man journald.conf`

hosts/modules/nixcache.nix

@@ -36,6 +36,10 @@ in
       nixos = subOpt;
       cachix = subOpt;
     };
+    sane.nixcache.remote-builders.desko = mkOption {
+      default = true;
+      type = types.bool;
+    };
   };
 
   config = {
@@ -55,5 +59,21 @@ in
       "desko:Q7mjjqoBMgNQ5P0e63sLur65A+D4f3Sv4QiycDIKxiI="
       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
     ];
+
+    nix.buildMachines = lib.mkIf cfg.remote-builders.desko [{
+      hostName = "desko";
+      system = "x86_64-linux";
+      protocol = "ssh-ng";
+      maxJobs = 4; # constrained by ram, for things like webkitgtk, etc.
+      speedFactor = 8;
+      supportedFeatures = [ "big-parallel" ];
+      mandatoryFeatures = [ ];
+      # TODO: define sshUser and sshKey here instead of in hosts/common/users/root.nix
+    }];
+    nix.distributedBuilds = lib.mkIf cfg.remote-builders.desko true;
+    # optional, useful when the builder has a faster internet connection than yours
+    nix.extraOptions = lib.mkIf cfg.remote-builders.desko ''
+      builders-use-substitutes = true
+    '';
   };
 }

modules/services/nixserve.nix

@@ -24,6 +24,7 @@ in
   };
 
   config = mkIf cfg.enable {
+    nix.settings.trusted-users = [ "nixremote" ];
     services.nix-serve = {
       enable = true;
       inherit (cfg) port secretKeyFile;