builders/netboot: add separate firmware_part output

common/nix.nix

@@ -14,7 +14,7 @@
 
   # Use our cache and trust its signing key. Still use cache.nixos.org as
   # fallback.
-  nix.settings.substituters = [ "https://bagel-cache.s3-web.delroth.net/" ];
+  nix.settings.substituters = [ "https://cache.forkos.org/" ];
   nix.settings.trusted-public-keys = [
     "cache.forkos.org:xfXIUJO1yiEITJmYsVmNDa9BFSlgTh/YqZ+4ei1EhQg="
   ];

flake.lock

@@ -64,11 +64,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1722339507,
+        "lastModified": 1722939563,
-        "narHash": "sha256-CdkQx6l0CuPtU9tMw3u73PAMhj+8YUAlTUVyrTCZas8=",
+        "narHash": "sha256-lMe8aXgF550iQLRaoU+yn8yYQ4x2qiyqANgsFyjfWwA=",
         "ref": "refs/heads/non-flakes",
-        "rev": "15963fa0e687cb39660aadf147402c955d671029",
+        "rev": "4a162a8aa5dad6cecdb33bd8534e67e0bdaeb13f",
-        "revCount": 292,
+        "revCount": 295,
         "type": "git",
         "url": "https://git.lix.systems/lix-project/buildbot-nix.git"
       },

services/baremetal-builder/default.nix

@@ -44,10 +44,20 @@ in
       ];
     };
     nix.settings = {
-      trusted-users = [ "builder" "buildbot" ];
       inherit ((import ./assignments.nix).${config.networking.hostName}) max-jobs cores;
     };
 
+    services.openssh.extraConfig = ''
+      Match User buildbot
+        AllowAgentForwarding no
+        AllowTcpForwarding no
+        PermitTTY no
+        PermitTunnel no
+        X11Forwarding no
+        ForceCommand ${config.nix.package.out}/bin/nix-daemon --store /mnt --stdio
+      Match All
+    '';
+
     nixpkgs.hostPlatform = "x86_64-linux";
     hardware.cpu.intel.updateMicrocode = true;
 

services/baremetal-builder/netboot.nix

@@ -75,6 +75,7 @@ in
             system.build.usbImage = pkgs.callPackage ({ stdenv, runCommand, dosfstools, e2fsprogs, mtools, libfaketime, util-linux, nukeReferences }:
               runCommand "boot-img-${node.config.networking.hostName}" {
                 nativeBuildInputs = [ dosfstools e2fsprogs libfaketime mtools util-linux ];
+                outputs = [ "out" "firmware_part" ];
               } ''
                 export img=$out
                 truncate -s 40M $img
@@ -123,6 +124,8 @@ in
                 # Verify the FAT partition before copying it.
                 fsck.vfat -vn firmware_part.img
                 dd conv=notrunc if=firmware_part.img of=$img seek=$START count=$SECTORS
+
+                cp firmware_part.img $firmware_part
               ''
             ) {};
           }