set up distributed builds

services/default.nix

@@ -2,9 +2,11 @@
   imports = [
     ./actual.nix
     ./audiobookshelf.nix
+    ./distributed-builds.nix
     ./forgejo.nix
     ./jellyfin.nix
     ./navidrome.nix
     ./pipewire-low-latency.nix
+    ./remote-builder.nix
   ];
 }

services/distributed-builds.nix

@@ -0,0 +1,45 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (builtins) elem;
+  inherit (lib) mkIf mkEnableOption mkOption types optional;
+  cfg = config.qenya.services.distributed-builds;
+in
+{
+  options.qenya.services.distributed-builds = {
+    enable = mkEnableOption "distributed builds";
+    keyFile = mkOption {
+      type = types.path;
+      description = ''
+        Path to the OpenSSH private key to be used for distributed builds.
+      '';
+    };
+    builders = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = ''
+        List of builders to attempt to use for distributed builds.
+      '';
+      example = [ "kalessin" ];
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [{
+      assertion = cfg ? keyFile;
+      message = "must specify a private key to be used for distributed builds";
+    }];
+
+    nix.distributedBuilds = true;
+    nix.settings.builders-use-substitutes = true;
+
+    nix.buildMachines =
+      (optional (elem "kalessin" cfg.builders) {
+        hostName = config.birdsong.hosts."kalessin".ipv4;
+        sshUser = "remotebuild";
+        sshKey = cfg.keyFile;
+        systems = [ "aarch64-linux" "x86_64-linux" ];
+        supportedFeatures = [ ];
+      });
+  };
+}

services/remote-builder.nix

@@ -0,0 +1,44 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib) mkIf mkOption mkEnableOption types;
+  cfg = config.qenya.services.remote-builder;
+in
+{
+  options.qenya.services.remote-builder = {
+    enable = mkEnableOption "remote builder";
+    authorizedKeys = {
+      keys = mkOption {
+        type = types.listOf types.singleLineStr;
+        default = [ ];
+        description = ''
+          A list of verbatim OpenSSH public keys that should be authorized to
+          use this remote builder. See
+          `users.users.<name>.openssh.authorizedKeys.keys`.
+        '';
+      };
+      keyFiles = mkOption {
+        type = types.listOf types.path;
+        default = [ ];
+        description = ''
+          A list of files each containing one OpenSSH public key that should be
+          authorized to use this remote builder. See
+          `users.users.<name>.openssh.authorizedKeys.keyFiles`.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.users.remotebuild = {
+      isSystemUser = true;
+      group = "nogroup";
+      shell = "/bin/sh";
+      openssh.authorizedKeys.keys = cfg.authorizedKeys.keys;
+      openssh.authorizedKeys.keyFiles = cfg.authorizedKeys.keyFiles;
+    };
+
+    nix.nrBuildUsers = 64;
+    nix.settings.trusted-users = [ "remotebuild" ];
+  };
+}