Ryan Lahfa
551c75ac47
This enables any nix-builder to be able to remote build with the trusted bit in Nix. This effectively gives root to all these people, I don't think it's a big deal. Signed-off-by: Ryan Lahfa <ryan@dgnum.eu>
76 lines
1.9 KiB
Nix
76 lines
1.9 KiB
Nix
# SPDX-FileCopyrightText: 2025 Elias Coppens <elias@dgnum.eu>
|
|
#
|
|
# SPDX-License-Identifier: EUPL-1.2
|
|
|
|
{
|
|
pkgs,
|
|
lib,
|
|
dgn-keys,
|
|
meta,
|
|
...
|
|
}:
|
|
{
|
|
config = {
|
|
dgn-access-control.users = lib.genAttrs meta.organization.groups.nix-builder (u: lib.singleton u);
|
|
|
|
# FIXME(Raito): this should really go into `dgn-access-control` but I don't
|
|
# know what is the desired architecture for it. Leaving it for the people with opinions™.
|
|
users.groups.nix-builders = { };
|
|
users.users = lib.genAttrs meta.organization.groups.nix-builder (u: {
|
|
extraGroups = [ "nix-builders" ];
|
|
});
|
|
|
|
security.pam.loginLimits = [
|
|
{
|
|
domain = "*";
|
|
item = "nofile";
|
|
type = "-";
|
|
value = "20480";
|
|
}
|
|
];
|
|
|
|
systemd.services.nix-daemon.serviceConfig = {
|
|
MemoryAccounting = true;
|
|
MemoryMax = "450G";
|
|
MemoryHigh = "440G";
|
|
MemorySwapMax = "2G";
|
|
ManagedOOMSwap = "kill";
|
|
ManagedOOMMemoryPressure = "kill";
|
|
MemoryPressureWatch = "on";
|
|
};
|
|
|
|
nix = {
|
|
gc = {
|
|
automatic = true;
|
|
dates = lib.mkForce "*:45";
|
|
options = lib.mkForce ''--max-freed "$((128 * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | ${pkgs.gawk}/bin/awk '{ print $4 }')))"'';
|
|
|
|
randomizedDelaySec = "1800";
|
|
};
|
|
|
|
nrBuildUsers = 128;
|
|
|
|
settings = {
|
|
trusted-users = [
|
|
"@wheel"
|
|
"@nix-builders"
|
|
];
|
|
keep-outputs = false;
|
|
keep-derivations = false;
|
|
use-cgroups = true;
|
|
http-connections = 0;
|
|
auto-allocate-uids = true;
|
|
cores = 0;
|
|
max-jobs = 8;
|
|
fsync-metadata = true;
|
|
experimental-features = [
|
|
"auto-allocate-uids"
|
|
# "ca-derivations" this feature is really extremely broken.
|
|
"cgroups"
|
|
"fetch-closure"
|
|
"impure-derivations"
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|