rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

declare root's builder ssh key as a tmpfiles copy of fred's

Browse source
This commit is contained in:
rope 2026-08-13 13:56:44 +01:00
parent e514eb62c5
commit 59888302e4
1 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
common.nix
View file

@ -191,6 +191,17 @@ in
supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ]; supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
}]; }];
# nix.buildMachines runs from the daemon, i.e. as root, so it needs root's own
# key — fred's doesn't count, and ssh refuses a key file owned by another user
# outright. Copying fred's (root can read it anyway, so this leaks nothing new)
# beats committing a private key to a repo the hosts fetch over plain HTTPS.
# C+ re-copies on every activation, so rotating fred's key rotates root's too.
systemd.tmpfiles.rules = lib.mkIf
(lib.elem config.networking.hostName [ "FredOS-Gaming" "FredOS-Macbook" ]) [
"d /root/.ssh 0700 root root -"
"C+ /root/.ssh/id_ed25519 0600 root root - /home/fred/.ssh/id_ed25519"
];
# Accept unsigned paths copied back from the remote builder. # Accept unsigned paths copied back from the remote builder.
nix.extraOptions = nix.extraOptions =
lib.mkIf (config.networking.hostName != "FredOS-Mediaserver") '' lib.mkIf (config.networking.hostName != "FredOS-Mediaserver") ''