raito/shared-public-infra
0
1
Fork 3
Code Issues Pull requests 1 Packages Projects Releases Wiki Activity

bagel-container: provision a user with Nix store perms for remote builds

Browse source
This commit is contained in:
Pierre Bourdon 2024-06-24 20:54:42 +02:00
parent 1b1c6b2849
commit d5cf620e0a
1 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
modules/bagel-container.nix
View file

@ -30,4 +30,17 @@
networkConfig.Address = [ "172.16.100.1/24" ]; networkConfig.Address = [ "172.16.100.1/24" ];
networkConfig.IPMasquerade = true; networkConfig.IPMasquerade = true;
}; };
# Configure a local Nix builder account, since getting sandboxing and KVM
# working inside the container will be tricky.
users.users.bagel-builder = {
isSystemUser = true;
group = "nogroup";
home = "/var/empty";
shell = "/bin/sh";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAvUT9YBig9LQPHgypIBHQuC32XqDKxlFZ2CfgDi0ZKx"
];
};
nix.settings.trusted-users = [ "bagel-builder" ];
} }