Sunset the build machine configuration and move it to the newer format. Setup the Forgejo Runner.

.sops.yaml

@@ -3,6 +3,7 @@ keys:
   - &server_songsheet age1la8yjuc2ws9pyx70rc83jd2084v5e08v8fvh6muvfzrl2ulp8fms6frs86
   - &server_traefik age1rdcs8y4fjfyagwt2q9599ax329thceersh6dg2f0p6nsghm5xufq00qu0p
   - &server_database age1k9ddvzypz986a7dt403ja6evql2agz0gehll79mx64zceteya38smxph8m
+  - &server_build_machine age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca
   - &server_christine age1kzsrlz86y5nqe4vaufv8chupq2hrf3avlmxsp3d5p9t5xj593deszslkmp
 creation_rules:
   - path_regex: nix-system-configs/secrets/songsheet/[^/]+\.(yaml|json|env|ini)$
@@ -29,3 +30,8 @@ creation_rules:
     key_groups:
       - age:
           - *admin_christine
+  - path_regex: nix-system-configs/secrets/build_machine/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+      - age:
+          - *admin_christine
+          - *server_build_machine

flake.nix

@@ -5,11 +5,13 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
   };
 
-  outputs = { self, nixpkgs, ... }:
+  outputs = {
-    let
+    self,
+    nixpkgs,
+    ...
+  }: let
     system = "x86_64-linux";
-    in
+  in {
-    {
     nixosConfigurations = {
       "nixos-local-wireguard-server" = nixpkgs.lib.nixosSystem {
         inherit system;
@@ -45,6 +47,11 @@
         inherit system;
         modules = [./nix-system-configs/modules/system/traefik.nix];
       };
+
+      "nixos-build-machine" = nixpkgs.lib.nixosSystem {
+        inherit system;
+        modules = [./nix-system-configs/modules/system/build_machine.nix];
+      };
     };
   };
 }

nix-system-configs/modules/secrets-config/notes.md

@@ -1,6 +1,7 @@
 To generate the keys beforehand
 ```ssh
 nix-shell -p age
-/var/lib/sops-nix/key.txt
+sudo mkdir /var/lib/sops-nix
+age-keygen -o /var/lib/sops-nix/key.txt
 ```
 And then update the .sops.yaml in the project directory accordingly.

nix-system-configs/modules/secrets-config/sops-build-machine.nix

@@ -0,0 +1,38 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  imports = let
+    # replace this with an actual commit id or tag
+    commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c";
+  in [
+    "${builtins.fetchTarball {
+      url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz";
+      # replace this with an actual hash
+      sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=";
+    }}/modules/sops"
+  ];
+
+  # This will add secrets.yml to the nix store
+  # You can avoid this by adding a string to the full path instead, i.e.
+  # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
+  sops.defaultSopsFile = ../../secrets/build_machine/secrets.yaml;
+  # This will automatically import SSH keys as age keys
+  #sops.age.sshKeyPaths = ["/home/nixosdd/.ssh/id_ed25519"];
+  # This is using an age key that is expected to already be in the filesystem
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  # This will generate a new key if the key specified above does not exist
+  sops.age.generateKey = true;
+
+  # Export individual WireGuard keys from the SOPS YAML as text secrets so they
+  # are available both as strings and as files (.path)
+  sops.secrets.":" = {
+    format = "yaml";
+    sopsFile = ../../secrets/build_machine/secrets.yaml;
+    owner = "root";
+    mode = "0400";
+  };
+
+}

nix-system-configs/modules/secrets-config/sops-wireguard.nix

@@ -48,7 +48,4 @@
     owner = "root";
     mode = "0444";
   };
-
-
-
 }

nix-system-configs/modules/system/build_machine.nix

@@ -0,0 +1,294 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  options.local = {
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      default = "nixos-build-machine";
+      description = "System hostname";
+    };
+    username = lib.mkOption {
+      type = lib.types.str;
+      default = "nixosbm";
+      description = "Primary user username";
+    };
+    userDescription = lib.mkOption {
+      type = lib.types.str;
+      default = "NixOS Build Machine";
+      description = "Primary user description";
+    };
+    address = lib.mkOption {
+      type = lib.types.str;
+      default = "10.1.1.3";
+      description = "Static IP address";
+    };
+  };
+
+  imports = [
+    ../local/hostname_username.nix
+    ../local/networking_local.nix
+    ../bootloader/seabios-assigned-iso-at-birth.nix
+    ../lix-default.nix
+    ../secrets-config/sops-build-machine.nix
+  ];
+
+  config = {
+    # Local metadata
+    local.hostname = "nixos-build-machine";
+    local.username = "nixosbm";
+    local.userDescription = "NixOS Build Machine";
+    local.address = "10.1.1.3";
+
+    # Add Lix instead of Nix
+    nixpkgs.overlays = [
+      (final: prev: {
+        inherit
+          (prev.lixPackageSets.stable)
+          nixpkgs-review
+          nix-eval-jobs
+          nix-fast-build
+          colmena
+          ;
+      })
+    ];
+
+    nix.package = pkgs.lixPackageSets.stable.lix;
+
+    # Enable Rsync
+    services.rsync.enable = true;
+
+    # Passwordless sudo for wheel group
+    security.sudo.wheelNeedsPassword = false;
+
+    # Hardware U2F support - Passwordless sudo with hardware key
+    security.pam.u2f = {
+      enable = true;
+      settings = {
+        authfile = "/etc/u2f_keys";
+        cue = true;
+        pinverification = 0; # No PIN verification
+        userpresence = 1; # Require user presence (touch)
+      };
+    };
+
+    # Optimize builds
+    nix.settings = {
+      # Enable parallel building
+      max-jobs = "auto";
+      cores = 0; # Use all available cores
+
+      # Optimize store operations
+      auto-optimise-store = true;
+
+      # Build settings
+      sandbox = true;
+      keep-outputs = true;
+      keep-derivations = true;
+    };
+
+    # Enable distributed builds (optional, for your VM setup)
+    nix.buildMachines = [];
+    nix.distributedBuilds = false;
+
+    # Optimize garbage collection
+    nix.gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+
+    # Increase build speed with tmpfs for builds (if you have enough RAM)
+    # Comment out if low on memory
+    systemd.services.nix-daemon.environment = {
+      TMPDIR = "/tmp";
+    };
+    boot.tmp.useTmpfs = true;
+    boot.tmp.tmpfsSize = "50%"; # Adjust based on your 62GB RAM
+
+    # SSH Agent authentication
+    security.pam.sshAgentAuth.enable = true;
+
+    # Automatic upgrades
+    system.autoUpgrade = {
+      enable = true; # Set to true for automatic updates
+      dates = "daily";
+      allowReboot = false;
+    };
+
+    # Bootloader fallback settings are provided by the seabios import
+    # (seabios-assigned-iso-at-birth.nix)
+
+    # Enable Tailscale
+    services.tailscale.enable = true;
+
+    networking.hostName = local.hostname; # Define your hostname.
+
+    # Enable networking
+    networking.networkmanager.enable = true;
+
+    # Set your time zone.
+    time.timeZone = "Europe/Copenhagen";
+
+    # Select internationalisation properties.
+    i18n.defaultLocale = "en_AU.UTF-8";
+
+    i18n.extraLocaleSettings = {
+      LC_ADDRESS = "en_AU.UTF-8";
+      LC_IDENTIFICATION = "en_AU.UTF-8";
+      LC_MEASUREMENT = "en_AU.UTF-8";
+      LC_MONETARY = "en_AU.UTF-8";
+      LC_NAME = "en_AU.UTF-8";
+      LC_NUMERIC = "en_AU.UTF-8";
+      LC_PAPER = "en_AU.UTF-8";
+      LC_TELEPHONE = "en_AU.UTF-8";
+      LC_TIME = "en_AU.UTF-8";
+    };
+
+    # Configure keymap in X11
+    services.xserver.xkb = {
+      layout = "au";
+      variant = "";
+    };
+
+    # Define a user account. Don't forget to set a password with ‘passwd’.
+    users.users.nixosbm = {
+      isNormalUser = true;
+      description = "NixOS Build Machine";
+      extraGroups = ["networkmanager" "wheel"];
+      packages = with pkgs; [];
+    };
+
+    # Remote builder server setup
+    users.users.nixremote = {
+      isNormalUser = true;
+      description = "Nix Remote Builder";
+      home = "/home/nixremote";
+      createHome = true;
+
+      # Lock the user account (no login shell)
+      shell = pkgs.shadow;
+
+      # SSH key for remote builds
+      openssh.authorizedKeys.keys = [
+        # Add the public key from your client machines here
+        # Example: "ssh-ed25519 AAAAC3... root@client-machine"
+      ];
+    };
+
+    systemd.tmpfiles.rules = [
+      "z /home/nixremote 0555 nixremote nixremote - -"
+      "z /home/nixremote/.ssh 0555 nixremote nixremote - -"
+    ];
+
+    # Allow unfree packages
+    nixpkgs.config.allowUnfree = true;
+
+    # List packages installed in system profile. To search, run:
+    # $ nix search wget
+    environment.systemPackages = with pkgs; [
+      wget
+      fastfetch
+      hyfetch
+      helix
+    ];
+
+    programs.gnupg.agent = {
+      enable = true;
+      enableSSHSupport = true;
+    };
+
+    # Enable the OpenSSH daemon.
+    services.openssh.enable = true;
+
+    # Network configuration for the build machine on the Proxmox bridge
+    networking.interfaces.ens18.ipv4.addresses = [
+      {
+        address = local.address;
+        #dns = "10.1.1.2";
+        prefixLength = 24;
+      }
+    ];
+    networking.defaultGateway = "10.1.1.1";
+    environment.etc."resolv.conf".text = ''
+      nameserver 10.1.1.2
+    '';
+
+    services.gitea-actions-runner = {
+      package = pkgs.forgejo-runner;
+      instances.default = {
+        enable = true;
+        name = "monolith";
+        url = "https://git.prg-radio.org";
+        # Obtaining the path to the runner token file may differ
+        # tokenFile should be in format TOKEN=<secret>, since it's EnvironmentFile for systemd
+        tokenFile = config.sops.secrets.runner_token.path;
+        labels = [
+          "lix:docker://git.lix.systems/lix-project/lix:latest"
+          "nix:docker://git.lix.systems/lix-project/lix:latest"
+          "ubuntu-bleeding-edge:docker://ubuntu:resolute"
+          "ubuntu-latest:docker://ubuntu:plucky"
+          "ubuntu-24.04:docker://ubuntu:noble"
+          "alpine:docker://alpine:edge"
+          "rust:docker://rust:trixie"
+          "python-315:docker://python:3.15.0a6-slim-trixie"
+        ];
+      };
+    };
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It‘s perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "25.11"; # Did you read the comment?
+
+    # Helpful commented examples for remote-build configuration retained from original
+    # THE FOLLOWING CODE BLOCK IS FOR COPYING TO OTHER CONFIGURATIONS, NOT FOR THIS FILE
+    #  nix.distributedBuilds = true;
+    #  nix.buildMachines = [
+    #    {
+    #      hostName = "nixos-build-machine";
+    #      system = "x86_64-linux";
+    #      sshUser = "nixremote";
+    #      sshKey = "/root/.ssh/nixremote";
+    #      maxJobs = 4;
+    #      speedFactor = 2;
+    #          supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
+    #    }
+    #  ];
+    #
+    # Generate SSH key for remote building
+    #systemd.services.generate-nixremote-key = {
+    #  description = "Generate SSH key for remote Nix builds";
+    #  wantedBy = [ "multi-user.target" ];
+    #  serviceConfig = {
+    #    Type = "oneshot";
+    #    RemainAfterExit = true;
+    #  };
+    #  script = ''
+    #    if [ ! -f /root/.ssh/nixremote ]; then
+    #      ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f /root/.ssh/nixremote -N "" -C "nix-remote-builder"
+    #    fi
+    #  '';
+    #};
+    #
+    #programs.ssh.extraConfig = ''
+    #  Host nixos-build-machine
+    #    HostName 192.168.1.175
+    #    IdentitiesOnly yes
+    #    IdentityFile /root/.ssh/nixremote
+    #    User nixremoteStrictHostKeyChecking accept-new
+    #'';
+    #
+    # Manual step required: After rebuilding the client, copy /root/.ssh/nixremote.pub
+    # from the client to the build machine's users.users.nixremote.openssh.authorizedKeys.keys list,
+    # then rebuild the build machine.
+    # i.e on the client: run "cat /root.ssh/nixremote.pub"
+    # and copy the output to the build machine's configuration.nix
+  };
+}
+

nix-system-configs/secrets/build_machine/secrets.yaml

@@ -0,0 +1,25 @@
+runner_token: ENC[AES256_GCM,data:SZnND7nTNwrYrQDKkurH1SoZLygFkVbAJFFcCcuDRbqSGGV49TQizw==,iv:wY33GdeQ13xC7gRjVM4UiVgZbvtrfQPUuveUJw8Bj0k=,tag:dSL6gmKGYxZemecD/l5eRQ==,type:str]
+sops:
+    age:
+        - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WEE5MUJiK0tUSmZMMXVq
+            LzdON0trT0NYbXZXdkluak9xQVlHM0F2OVI4CnFmaEpEdEVMalgxQjJMalp3Mjl3
+            M3l2WXpQVnZjYmtNSEJIWVR5cWlUbEEKLS0tIDNtVHRnRVl5RWdmRmNXYVFRbkNq
+            TFZpeGwrM2V3aWRybGE2WVNQRW5QV0kKdJb7svK5k5rYMtfiTsJy5QE3+1MP04jz
+            zadKKK+kDaK+h4AmkFGLRoKLpJoEU2nEUo2FD4LxiGOOvSXmeOUxbw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1xtsm7kmql8794756ls53eu8pusyadk4lauadxx867tgsjhd38y5sj7elca
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGUEdoMkVyMjVsOG1LYkRW
+            M08xemlxRHU4THRidWZXZFhEdXFBV05YUFZRCjlpeERUbWVjY0cxMlk5elk1VHFn
+            UXgzNmVhbWh3MytRNXlJdkJ0ak4vQXcKLS0tIGZ1eEU2UjIxcmw1ZnVwTFVZSHMx
+            U3hva2JqWUdjR2JzTmpFanppUk5MTmsKwD8rlnddUQkgtuZLTgpmS4jGRmgNReUN
+            mEx0pxnWIIrLUGRgwE3WDbBVRTqVo1ai6BZY3FzBCnXU6zbNwYhqIg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-12T14:23:57Z"
+    mac: ENC[AES256_GCM,data:DorP7hsnq582LR5fQDFVBy6xtPEMIlvLKPYdK6h7Nq6ajAMquiU8i33IfMzEnLWC6oa4soiIZA+LBMlHR7LCKOQWvdHp8k8q08MbqlMLQO3yH/Lc+J2W8v1SQwPlEXUwF4DIuzCos0D1IfpD/f2gQ2SAmbIJkJHMkviJM76YiqY=,iv:Yzu0GjZhimt6Yk3bZvGfIHz55pPI/gZyJKv99SsSWec=,tag:/ytugAI8voXt0nb9uV8nlA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0