Archived
beatzaplentyandClaude Sonnet 5
75f1342339
Distributed builds failed with "Host key verification failed" on any client that had never manually SSH'd to nix-cache before, since nothing populated root's known_hosts for it. Wire nix-cache's host public key into programs.ssh.knownHosts via a new vars.nixCacheHostKey so every client picks it up automatically on rebuild. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
37 lines
1.1 KiB
Nix
37 lines
1.1 KiB
Nix
{ pkgs, vars, ... }:
|
|
|
|
{
|
|
# Install the remote builder key on each client host (do not commit private keys):
|
|
# sudo install -d -m 0700 /root/.ssh
|
|
# sudo install -m 0600 ./nixremote /root/.ssh/nixremote
|
|
# sudo ssh -i /root/.ssh/nixremote nixremote@nix-cache nix-store --version
|
|
# Trust nix-cache's SSH host key declaratively so the nix-daemon (root)
|
|
# can connect the first time without a manual ssh-keyscan/known_hosts
|
|
# step on every new client.
|
|
programs.ssh.knownHosts.${vars.nixCacheHost} = {
|
|
hostNames = [ vars.nixCacheHost ];
|
|
publicKey = vars.nixCacheHostKey;
|
|
};
|
|
|
|
nix = {
|
|
distributedBuilds = true;
|
|
|
|
buildMachines = [
|
|
{
|
|
hostName = vars.nixCacheHost;
|
|
sshUser = vars.remoteBuilderUser;
|
|
sshKey = "/root/.ssh/${vars.remoteBuilderUser}";
|
|
inherit (pkgs.stdenv.hostPlatform) system;
|
|
maxJobs = 4;
|
|
speedFactor = 2;
|
|
supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
|
|
}
|
|
];
|
|
|
|
settings = {
|
|
builders-use-substitutes = true;
|
|
max-jobs = "auto";
|
|
};
|
|
};
|
|
}
|