builders: direct buildbot to /mnt store via ForceCommand

2024-08-06 13:26:35 +02:00 · 2024-08-06 13:26:35 +02:00 · dfd48f2179
parent b1c28cfc7c
commit dfd48f2179
1 changed files with 11 additions and 1 deletions
--- a/services/baremetal-builder/default.nix
+++ b/services/baremetal-builder/default.nix
@ -44,10 +44,20 @@ in
      ];
    };
    nix.settings = {
-      trusted-users = [ "builder" "buildbot" ];
      inherit ((import ./assignments.nix).${config.networking.hostName}) max-jobs cores;
    };

+    services.openssh.extraConfig = ''
+      Match User buildbot
+        AllowAgentForwarding no
+        AllowTcpForwarding no
+        PermitTTY no
+        PermitTunnel no
+        X11Forwarding no
+        ForceCommand ${config.nix.package.out}/bin/nix-daemon --store /mnt --stdio
+      Match All
+    '';
+
    nixpkgs.hostPlatform = "x86_64-linux";
    hardware.cpu.intel.updateMicrocode = true;