darwinConfigurations/builder: init

Signed-off-by: Sefa Eyeoglu <[e-mail]>

darwinConfigurations/builder/configuration.nix

···
+{
+  inputs,
+  pkgs,
+  ...
+}: {
+  imports = [
+    inputs.srvos.darwinModules.server
+    ../common/openssh.nix
+    ../common/remote-build-provider.nix
+  ];
+
+  system.stateVersion = 5;
+
+  programs.zsh.enable = true;
+  programs.zsh.enableCompletion = false;
+  programs.bash.enable = true;
+  programs.bash.completion.enable = true;
+
+  services.nix-daemon.enable = true;
+
+  nix = {
+    package = pkgs.nix;
+    settings = {
+      "extra-experimental-features" = [
+        "nix-command"
+        "flakes"
+      ];
+      max-jobs = 4;
+      cores = 2;
+    };
+
+    gc = {
+      automatic = true;
+      user = "";
+      interval = {
+        Minute = 15;
+      };
+      options = let
+        gbFree = 50;
+      in "--max-freed $((${toString gbFree} * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | awk '{ print $4 }')))";
+    };
+    # If we drop below 20GiB during builds, free 20GiB
+    extraOptions = ''
+      min-free = ${toString (30 * 1024 * 1024 * 1024)}
+      max-free = ${toString (50 * 1024 * 1024 * 1024)}
+    '';
+  };
+}

darwinConfigurations/builder/default.nix

···
+{inputs, ...}: {
+  flake.darwinConfigurations = {
+    builder = inputs.darwin.lib.darwinSystem {
+      system = "aarch64-darwin";
+
+      modules = [
+        ./configuration.nix
+      ];
+
+      specialArgs = {
+        inherit inputs;
+      };
+    };
+  };
+}

darwinConfigurations/common/openssh.nix

···
+{
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJV9lYhi0kcwAAjPTMl6sycwCGkjrI0bvTIwpPuXkW2W scrumplex@andromeda"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG4jTPHOnfxvBOcVmExcU+j2u9Lsf1OoVG/ols2Met9/ scrumplex@dyson"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJiQEIN+AnXuJFNqw04h/LSGF1bu8cS5PjzgIpn5QTX1 termux@void"
+  ];
+}

darwinConfigurations/common/remote-build-provider.nix

···
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  environment = lib.concatStringsSep " " [
+    "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+  ];
+
+  authorizedNixStoreKey = key: "command=\"${environment} ${config.nix.package}/bin/nix-store --serve --store daemon --write\" ${key}";
+in {
+  users.knownUsers = ["bob-the-builder"];
+  users.users.bob-the-builder = {
+    uid = 502;
+    createHome = true;
+    home = "/Users/bob-the-builder";
+    shell = pkgs.bashInteractive;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP0NTTsagVihqSLWR9gHcH6cWkADIQdI1YKEuogq71Gw"
+    ];
+  };
+
+  nix.settings.trusted-users = ["bob-the-builder"];
+}

flake.lock

···
         "type": "github"
       }
     },
+    "darwin_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1730698801,
+        "narHash": "sha256-sq68bCmk4tCXSt5CoRNimfigIZSLJSpNi/gjFtNLjRE=",
+        "owner": "LnL7",
+        "repo": "nix-darwin",
+        "rev": "189d2d422c773fa065cc9c72e6806f007ebb9be0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "LnL7",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
     "devshell": {
       "inputs": {
         "nixpkgs": [
···
         "buildbot-nix": "buildbot-nix",
         "catppuccin": "catppuccin",
         "catppuccin-qt5ct": "catppuccin-qt5ct",
+        "darwin": "darwin_2",
         "disko": "disko",
         "flake-parts": "flake-parts",
         "git-hooks": "git-hooks",

flake.nix

···
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    darwin = {
+      url = "github:LnL7/nix-darwin";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     nixvim = {
       url = "github:nix-community/nixvim";
       inputs.nixpkgs.follows = "nixpkgs";
···
         ./nixosConfigurations/cosmos
         ./nixosConfigurations/eclipse
         ./nixosConfigurations/universe
+
+        ./darwinConfigurations/builder
 
         ./openwrt
 

nixosConfigurations/common/remote-build-consumer.nix

···
         speedFactor = 1;
         supportedFeatures = ["nixos-test" "benchmark" "big-parallel" "kvm"];
       }
+      {
+        hostName = "mini.scrumplex.net";
+        sshUser = "bob-the-builder";
+        sshKey = config.age.secrets."bob-the-builder.key".path;
+        system = "aarch64-darwin";
+        protocol = "ssh-ng";
+        maxJobs = 8;
+        speedFactor = 1;
+        supportedFeatures = ["nixos-test" "benchmark" "big-parallel" "apple-virt"];
+      }
     ];
     distributedBuilds = true;
     settings.builders-use-substitutes = true;