workaround elctron issues, fix firewall for syncthing, set uphostkey0 as builder to steveej-t14

nix/os/devices/sj-bm-hostkey0/configuration.nix

@@ -11,11 +11,11 @@
   ...
 }: {
   disabledModules = [
-    # "services/networking/hostapd.nix"
   ];
 
   imports = [
     nodeFlake.inputs.disko.nixosModules.disko
+    nodeFlake.inputs.srvos.nixosModules.roles-nix-remote-builder
     repoFlake.inputs.sops-nix.nixosModules.sops
 
     ../../profiles/common/user.nix
@@ -35,8 +35,19 @@
         inherit pkgs;
       };
 
-      home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix {
-        inherit pkgs;
+      home-manager.users.steveej = { pkgs, ... }: {
+        imports = [
+          ../../../home-manager/configuration/text-minimal.nix
+        ];
+
+        home.packages = [
+          pkgs.nil
+          pkgs.rnix-lsp
+          pkgs.nixd
+          pkgs.nixpkgs-fmt
+          pkgs.alejandra
+          pkgs.nixfmt
+        ];
       };
 
       programs.zsh.enable = true;
@@ -45,6 +56,11 @@
     }
   ];
 
+  roles.nix-remote-builder.schedulerPublicKeys = [
+    # TODO: make this a reference to the private key's secret
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC8FHuK0k86iBWq41+NAhVwJqH1ZpGJe+q01m7iLviz6 root@steveej-t14"
+  ];
+
   services.openssh.enable = true;
   services.openssh.settings.PermitRootLogin = "yes";
 
@@ -141,4 +157,10 @@
   #   home.packages = with pkgs; [
   #   ];
   # };
+
+  virtualisation.libvirtd.enable = true;
+
+  boot.binfmt.emulatedSystems = [
+    "aarch64-linux"
+  ];
 }

nix/os/devices/sj-bm-hostkey0/flake.nix

@@ -59,15 +59,6 @@
       native = mkNixosConfiguration {
         inherit system;
       };
-
-      # cross = mkNixosConfiguration {
-      #   extraModules = [
-      #     {
-      #       nixpkgs.buildPlatform.system = "x86_64-linux";
-      #       nixpkgs.hostPlatform.system = system;
-      #     }
-      #   ];
-      # };
     };
   };
 }

nix/os/devices/steveej-t14/system.nix

@@ -7,6 +7,23 @@
   ...
 }: let
   passwords = import ../../../variables/passwords.crypt.nix;
+
+  localTcpPorts = [
+    22
+
+    # syncthing
+    22000
+
+    # iperf3
+    5201
+  ];
+
+  localUdpPorts = [
+    # syncthing
+    22000
+    21027
+  ];
+
 in {
   imports = [
     ../../snippets/nix-settings-holo-chain.nix
@@ -19,6 +36,20 @@ in {
     ];
   };
 
+  nix.distributedBuilds = true;
+  nix.buildMachines = [
+    {
+      hostName = repoFlake.colmena.sj-bm-hostkey0.deployment.targetHost;
+      # TODO: make this a reference
+      sshUser = "nix-remote-builder";
+      protocol = "ssh-ng";
+      system = "x86_64-linux";
+      maxJobs = 24;
+      speedFactor = 100;
+      supportedFeatures = repoFlake.nixosConfigurations.router0-dmz0.config.nix.settings.system-features ++ [];
+    }
+  ];
+
   networking.extraHosts = ''
   '';
 
@@ -37,28 +68,10 @@ in {
   services.openssh.openFirewall = false;
 
   # TODO: upstream feature for inverse rule to work: `! --in-interface zt+`
-  networking.firewall.interfaces."eth+".allowedTCPPorts = [
-    22
-
-    # syncthing
-    22000
-
-    # iperf3
-    5201
-
-    # used on holochain hackathon for cache reverse proxy
-    80
-  ];
-  networking.firewall.interfaces."eth+".allowedUDPPorts = [
-    # syncthing
-    22000
-    21027
-  ];
-
-  networking.firewall.interfaces."wlan+".allowedTCPPorts = [
-    # used on holochain hackathon for cache reverse proxy
-    80
-  ];
+  networking.firewall.interfaces."eth+".allowedTCPPorts = localTcpPorts;
+  networking.firewall.interfaces."eth+".allowedUDPPorts = localUdpPorts;
+  networking.firewall.interfaces."wlan+".allowedTCPPorts = localTcpPorts;
+  networking.firewall.interfaces."wlan+".allowedUDPPorts = localUdpPorts;
 
   networking.firewall.logRefusedConnections = false;
   networking.usePredictableInterfaceNames = false;

nix/os/snippets/nix-settings.nix

@@ -12,14 +12,14 @@
     "nixpkgs=${pkgs.path}"
   ];
 
-  nix.experimental-features = [
+  nix.settings.experimental-features = [
     "nix-command"
     "flakes"
     "ca-derivations"
     "impure-derivations"
   ];
 
-  nix.system-features = [
+  nix.settings.system-features = [
     "recursive-nix"
     "big-parallel"
     "kvm"