diff --git a/common/base-server.nix b/common/base-server.nix
index ec95eda..31de7de 100644
--- a/common/base-server.nix
+++ b/common/base-server.nix
@@ -31,7 +31,7 @@
     automatic = true;
     persistent = true;
     dates = lib.mkDefault "daily";
-    options = "--delete-older-than 30d";
+    options = lib.mkDefault "--delete-older-than 30d";
   };
 
   services.journald.extraConfig = "SystemMaxUse=512M";
diff --git a/services/default.nix b/services/default.nix
index 8daacc3..6cbad0f 100644
--- a/services/default.nix
+++ b/services/default.nix
@@ -14,5 +14,6 @@
     ./buildbot
     ./newsletter
     ./s3-revproxy
+    ./extra-builders
   ];
 }
diff --git a/services/extra-builders/default.nix b/services/extra-builders/default.nix
new file mode 100644
index 0000000..84ee7ae
--- /dev/null
+++ b/services/extra-builders/default.nix
@@ -0,0 +1,6 @@
+{
+  imports = [
+    # Remote builders
+    ./provider.nix
+  ];
+}
diff --git a/services/extra-builders/provider.nix b/services/extra-builders/provider.nix
new file mode 100644
index 0000000..c084fdd
--- /dev/null
+++ b/services/extra-builders/provider.nix
@@ -0,0 +1,46 @@
+## Tenant-specific build capacity.
+## This can come from anywhere and is not hold to the same level of responsibility that our build-infra has.
+{ pkgs, config, lib, nodes, ... }:
+let
+  inherit (lib) mkIf types mkEnableOption mkOption;
+  freeGbDiskSpace = 10;
+  cfg = config.bagel.builders.extra-build-capacity.provider;
+in
+{
+  options.bagel.builders.extra-build-capacity.provider = {
+    enable = mkEnableOption "providing of extra build capacity to other systems";
+
+    buildfarmPublicKeys = mkOption {
+      type = types.listOf types.str;
+      description = "SSH public keys to allow to connect for remote builds";
+    };
+
+    # TODO: register tenant in some deployment wide module
+    # so that the consumer side can just automatically generate buildMachines entries.
+    tenant = mkOption {
+      type = types.enum [ "lix" ];
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.groups.builders = {};
+    users.users.nix = {
+      openssh.authorizedKeys.keys = cfg.buildfarmPublicKeys;
+      extraGroups = [ "builders" ];
+      isNormalUser = true;
+    };
+
+    nix.settings.allowed-users = [ "@wheel" "@builders" ];
+    nix.settings.trusted-users = [ "@builders" ];
+
+    nix.gc.automatic = true;
+    nix.gc.dates = "hourly";
+    nix.gc.options = ''
+      --max-freed "$((${toString freeGbDiskSpace} * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | ${pkgs.gawk}/bin/awk '{ print $4 }')))"
+    '';
+    # Bump the open files limit so that non-root users can run NixOS VM tests, if supported at all.
+    security.pam.loginLimits = [
+      { domain = "*"; item = "nofile"; type = "-"; value = "20480"; }
+    ];
+  };
+}