infrastructure/machines/nixos/build01/nix-builder.nix

# SPDX-FileCopyrightText: 2025 Elias Coppens <elias@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2

{ pkgs, lib, ... }:
let
  org = import ../../../meta/organization.nix;
  keys = (import ../../../keys/default.nix)._keys;
in
{
  config = {
    users.users = builtins.listToAttrs (
      builtins.map (u: {
        name = u;
        value = {
          isNormalUser = true;
          home = "/home/${u}";
          openssh.authorizedKeys.keys = keys.${u};
        };
      }) org.groups.nix-builder
    );

    security.pam.loginLimits = [
      {
        domain = "*";
        item = "nofile";
        type = "-";
        value = "20480";
      }
    ];

    systemd.services.nix-daemon.serviceConfig = {
      MemoryAccounting = true;
      MemoryMax = "450G";
      MemoryHigh = "440G";
      MemorySwapMax = "2G";
      ManagedOOMSwap = "kill";
      ManagedOOMMemoryPressure = "kill";
      MemoryPressureWatch = "on";
    };

    nix = {
      gc = {
        automatic = true;
        dates = lib.mkForce "*:45";
        options = lib.mkForce ''--max-freed "$((128 * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | ${pkgs.gawk}/bin/awk '{ print $4 }')))"'';

        randomizedDelaySec = "1800";
      };

      nrBuildUsers = 128;

      settings = {
        keep-outputs = false;
        keep-derivations = false;
        use-cgroups = true;
        http-connections = 0;
        auto-allocate-uids = true;
        cores = 0;
        max-jobs = 8; # Do not build more than 2 derivations at once in the event, both of them are too big, yes this is stupid, fix it in Nix.
        fsync-metadata = true;
        system-features = [
          "benchmark"
          "big-parallel"
          "kvm"
          "nixos-test"
        ];
        experimental-features = [
          "auto-allocate-uids"
          # "ca-derivations" this feature is really extremely broken.
          "cgroups"
          "fetch-closure"
          "impure-derivations"
        ];
      };
    };
  };
}