Commit `0849c5b704c3`

Vincent Demeester <vincent@sbr.pm>

2026-09-10 14:39:00

feat(nix): use dedicated Nagoya builder key

Replace touch-required interactive authentication with a root-owned, restricted builder credential so Aomi can offload ARM builds without access to a user TPM agent or YubiKey interaction. Signed-off-by: Vincent Demeester <vincent@sbr.pm>

main

1 parent d96fd9c

Changed files (5)

imperative

nagoya

authorize-aomi-builder.sh

test-builder-key.sh

systems

common

fedora-work

gen-configs.nix

test-gen-configs.sh

globals.nix

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+# Authorize Aomi's dedicated Nix builder key on Nagoya.
+# Run from Aomi after installing /etc/nix/keys/nagoya-builder.pub.
+
+set -euo pipefail
+
+KEY_FILE="${KEY_FILE:-/etc/nix/keys/nagoya-builder.pub}"
+NAGOYA_HOST="${NAGOYA_HOST:-nagoya.vpn}"
+SSH_KEY="${SSH_KEY:-$HOME/.ssh/id_homelab_sk}"
+
+if [[ ! -r "$KEY_FILE" ]]; then
+	echo "Builder public key not readable: $KEY_FILE" >&2
+	exit 1
+fi
+
+public_key=$(<"$KEY_FILE")
+authorized_key="restrict,command=\"/nix/var/nix/profiles/default/bin/nix-daemon --stdio\" $public_key"
+
+printf '%s\n' "$authorized_key" |
+	ssh -i "$SSH_KEY" -o IdentitiesOnly=yes "vincent@$NAGOYA_HOST" \
+		'umask 077; mkdir -p ~/.ssh; touch ~/.ssh/authorized_keys; key=$(cat); grep -qxF "$key" ~/.ssh/authorized_keys || printf "%s\n" "$key" >> ~/.ssh/authorized_keys'

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+helper="$repo_root/imperative/nagoya/authorize-aomi-builder.sh"
+
+[[ -x "$helper" ]]
+grep -q 'restrict,command="/nix/var/nix/profiles/default/bin/nix-daemon --stdio"' "$helper"
+grep -q 'aomi-nagoya-builder' "$repo_root/globals.nix"
+grep -q 'nagoya = "trusted"' "$repo_root/globals.nix"

@@ -43,7 +43,7 @@ let
   '';
 
   nixMachines = pkgs.writeText "nix-machines" ''
-    ssh-ng://vincent@nagoya.vpn aarch64-linux /home/vdemeest/.ssh/id_homelab_sk 4 1
+    ssh-ng://vincent@nagoya.vpn aarch64-linux /etc/nix/keys/nagoya-builder 4 1
   '';
 
   sshKnownHosts = pkgs.writeText "ssh-known-hosts" ''

@@ -6,7 +6,7 @@ repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)
 generator="$repo_root/systems/common/fedora-work/gen-configs.nix"
 
 # Aomi delegates native ARM builds to Nagoya through its Nix daemon.
-grep -q 'ssh-ng://vincent@nagoya.vpn aarch64-linux /home/vdemeest/.ssh/id_homelab_sk 4 1' "$generator"
+grep -q 'ssh-ng://vincent@nagoya.vpn aarch64-linux /etc/nix/keys/nagoya-builder 4 1' "$generator"
 grep -q 'builders-use-substitutes = true' "$generator"
 grep -q '/etc/nix/machines' "$generator"
 grep -q '/etc/ssh/ssh_known_hosts' "$generator"

@@ -76,6 +76,10 @@ _: {
           kyushu = "trusted";
         };
       };
+      aomi-nagoya-builder = {
+        key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIuiAFmNPzh+hpnLfjCauNQWIuQ4JRBT7cD/y/5zjmZK aomi-nagoya-builder";
+        access.vincent.nagoya = "trusted";
+      };
       kyushu-tpm = {
         key = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBc8oKSsUPsgbOB+yrqLpxdI3lt0ONhlHhTwbnrobSgDat5J/w0ZOsHJUPNU/O2Hyqd9l0UXz3d7rnwfN1sO0tQ= vdemeest@kyushu-tpm";
         access.vincent = {

Commit 0849c5b704c3

Commit `0849c5b704c3`