hydra: set allowed URIs in restricted mode for flake inputs

2024-07-10 18:52:22 +02:00 · 2024-07-10 18:52:22 +02:00 · d2336262fb
parent f35cfbd567
commit d2336262fb
1 changed files with 9 additions and 0 deletions
--- a/services/hydra/default.nix
+++ b/services/hydra/default.nix
@ -64,6 +64,15 @@ in {
    # Can be removed once this is added to some common config template.
    nix.settings.trusted-users = [ "root" "hydra" "hydra-www" "@wheel" ];

+    # Because Hydra can't fetch flake inputs otherwise... also yes, this
+    # prefix-based matching is absurdly bad.
+    nix.settings.allowed-uris = [
+      "github:"
+      "https://github.com/"
+      "https://git.lix.systems/"
+      "https://git@git.lix.systems/"
+    ];
+
    services.hydra-dev = {
      enable = true;