services/baremetal-builder/default.nix

@@ -44,10 +44,20 @@ in
       ];
     };
     nix.settings = {
-      trusted-users = [ "builder" "buildbot" ];
       inherit ((import ./assignments.nix).${config.networking.hostName}) max-jobs cores;
     };
 
+    services.openssh.extraConfig = ''
+      Match User buildbot
+        AllowAgentForwarding no
+        AllowTcpForwarding no
+        PermitTTY no
+        PermitTunnel no
+        X11Forwarding no
+        ForceCommand ${config.nix.package.out}/bin/nix-daemon --store /mnt --stdio
+      Match All
+    '';
+
     nixpkgs.hostPlatform = "x86_64-linux";
     hardware.cpu.intel.updateMicrocode = true;
 

services/gerrit/one-way-sync.nix

@@ -29,7 +29,7 @@ let
       echo "Current ref: $EXPECTED_REF"
       git worktree add -f "$RUNTIME_DIRECTORY"/${name} refs/remotes/origin/${localRefspec}
       cd "$RUNTIME_DIRECTORY"/${name}
-      git pull origin ${localRefspec} --no-rebase
+      git pull origin ${localRefspec}
       EXPECTED_REF=$(git rev-list refs/remotes/origin/${localRefspec} | head -1)
       git config user.name Fork-o-Tron
       git config user.email noreply@forkos.org