Add build servers

lib/fudo/hosts.nix

@@ -106,6 +106,12 @@ let
           "SSH key of the host. Find with `ssh-keyscan`. Skip the hostname, just type and key.";
         default = null;
       };
+
+      build-pubkeys = mkOption {
+        type = listOf str;
+        description = "SSH public keys used to access the build server.";
+        default = [ ];
+      };
     };
   };
 
@@ -124,6 +130,8 @@ in {
     site = config.fudo.sites.${site-name};
     domain-name = host-cfg.domain;
     domain = config.fudo.domains.${domain-name};
+    has-build-servers = (length (attrNames site.build-servers)) > 0;
+    has-build-keys = (length host-cfg.build-pubkeys) > 0;
 
   in {
     networking = {
@@ -138,6 +146,17 @@ in {
       hosts = { "127.0.0.1" = [ "${hostname}.${domain-name}" "${hostname}" ]; };
     };
 
+    nix = mkIf
+      (has-build-servers && has-build-keys && site.enable-distributed-builds) {
+        buildMachines = mapAttrsToList (hostname: buildOpts: {
+          hostName = "${hostname}.${domain}";
+          maxJobs = buildOpts.max-jobs;
+          speedFactor = buildOpts.speed-factor;
+          supportedFeatures = buildOpts.supported-features;
+        }) site.build-servers;
+        distributedBuilds = true;
+      };
+
     time.timeZone = site.timezone;
 
     krb5.libdefaults.default_realm = domain.gssapi-realm;

lib/fudo/sites.nix

@@ -6,6 +6,9 @@ let
   site-name = config.fudo.hosts.${hostname}.site;
   site-cfg = config.fudo.sites.${site-name};
 
+  site-hosts = filterAttrs (hostname: hostOpts: hostOpts.site == site-name)
+    config.fudo.hosts;
+
   siteOpts = { site, ... }: {
     options = with types; {
       site = mkOption {
@@ -84,7 +87,12 @@ let
         default = null;
       };
 
-      enable-ssh-backdoor = mkEnableOption "Enable a backup SSH server in case of failures of the primary.";
+      enable-ssh-backdoor = mkOption {
+        type = bool;
+        description =
+          "Enable a backup SSH server in case of failures of the primary.";
+        default = true;
+      };
 
       dropbear-rsa-key-path = mkOption {
         type = str;
@@ -98,11 +106,68 @@ let
         default = "/etc/dropbear/host_ecdsa_key";
       };
 
-      dropbear-port = mkOption {
+      dropbear-ssh-port = mkOption {
         type = port;
         description = "Port to be used for the deploy SSH server.";
         default = 2112;
       };
+
+      enable-distributed-builds =
+        mkEnableOption "Enable distributed builds for the site.";
+
+      build-servers = mkOption {
+        type = attrsOf (submodule buildServerOpts);
+        description =
+          "List of hosts to be used as build servers for the local site.";
+        default = { };
+        example = {
+          my-build-host = {
+            port = 22;
+            systems = [ "i686-linux" "x86_64-linux" ];
+          };
+        };
+      };
+
+      build-user = mkOption {
+        type = str;
+        description = "User as which to run builds.";
+        default = "nix-site-builder";
+      };
+    };
+  };
+
+  buildServerOpts = { ... }: {
+    options = with types; {
+      port = mkOption {
+        type = port;
+        description = "SSH port at which to contact the server.";
+        default = 22;
+      };
+
+      systems = mkOption {
+        type = listOf str;
+        description =
+          "A list of systems for which this build server can build.";
+        default = [ "i686-linux" "x86_64-linux" ];
+      };
+
+      max-jobs = mkOption {
+        type = int;
+        description = "Max build allowed per-system.";
+        default = 1;
+      };
+
+      speed-factor = mkOption {
+        type = int;
+        description = "Weight to give this server, i.e. it's relative speed.";
+        default = 1;
+      };
+
+      supported-features = mkOption {
+        type = listOf str;
+        description = "List of features supported by this server.";
+        default = [ ];
+      };
     };
   };
 
@@ -114,19 +179,29 @@ in {
   };
 
   config = {
-    users.users.root.openssh.authorizedKeys.keys = mkIf (site-cfg.deploy-pubkey != null) [
-      site-cfg.deploy-pubkey
-    ];
+    users.users = {
+      root.openssh.authorizedKeys.keys =
+        mkIf (site-cfg.deploy-pubkey != null) [ site-cfg.deploy-pubkey ];
 
-    networking.firewall.allowedTCPPorts = mkIf site-cfg.enable-ssh-backdoor
-      [ site-cfg.dropbear-deploy-port ];
+      ${site-cfg.build-user} = mkIf
+        (any (build-host: build-host == config.instance.hostname)
+          (attrNames site-cfg.build-servers)) {
+            isSystemUser = true;
+            openssh.authorizedKeys.keys =
+              concatMap (hostOpts: hostOpts.build-pubkeys)
+              (attrValues site-hosts);
+          };
+    };
+
+    networking.firewall.allowedTCPPorts =
+      mkIf site-cfg.enable-ssh-backdoor [ site-cfg.dropbear-ssh-port ];
 
     systemd = mkIf site-cfg.enable-ssh-backdoor {
       sockets = {
         dropbear-deploy = {
           wantedBy = [ "sockets.target" ];
           socketConfig = {
-            ListenStream = "0.0.0.0:${toString site-cfg.dropbear-deploy-port}";
+            ListenStream = "0.0.0.0:${toString site-cfg.dropbear-ssh-port}";
             Accept = true;
           };
           unitConfig = { restartIfChanged = true; };
@@ -162,7 +237,7 @@ in {
           serviceConfig = {
             Type = "simple";
             ExecStart =
-              "${pkgs.dropbear}/bin/dropbear -F -i -m -s -j -k -r ${site-cfg.dropbear-rsa-key-path} -r ${site-cfg.dropbear-ecdsa-key-path}";
+              "${pkgs.dropbear}/bin/dropbear -F -i -w -m -j -k -r ${site-cfg.dropbear-rsa-key-path} -r ${site-cfg.dropbear-ecdsa-key-path}";
             ExecReload = "${pkgs.utillinux}/bin/kill -HUP $MAINPID";
             StandardInput = "socket";
           };