2 files changed, 91 insertions(+), 4 deletions(-)

M config.scm
A modules/ruther/services/nix.scm

@@ 5,6 5,7 @@
 (define-module (config))
 
 (use-modules
+ (guix gexp)
  (nongnu packages linux)
  (nongnu system linux-initrd)
  (nongnu packages firmware)


@@ 23,6 24,7 @@
  (ruther services system)
  (ruther services bind)
  (ruther services nix-gl)
+ (ruther services nix)
  (ruther services netbird)
  (ruther packages netbird)
  (ruther bootloader grub)


@@ 260,7 262,6 @@
                        zip unzip
                        wget curl
                        vim
-                       nix
                        polkit ;; get pktty
                        fwupd-nonfree
                        netbird


@@ 304,20 305,48 @@
               ;; Let's use GUI apps from Nixpkgs, because, why not?
               nixos-opengl-driver-service
 
-              (service nix-service-type
+              ;; Prefer the builder's LAN address, then fall back to WireGuard.
+              (extra-special-file
+               "/root/.ssh/config"
+               (mixed-text-file
+                "root-ssh-config"
+                "Host edge-ruther-builder\n"
+                "  HostName edge-ruther.local\n"
+                "  HostKeyAlias edge-ruther.local\n"
+                "  BatchMode yes\n"
+                "  ConnectTimeout 5\n"
+                "  ProxyUseFdpass yes\n"
+                "  ProxyCommand "
+                (file-append bash "/bin/sh")
+                " -c '"
+                (file-append netcat-openbsd "/bin/nc")
+                " -F -w 2 edge-ruther.local %p || exec "
+                (file-append netcat-openbsd "/bin/nc")
+                " -F -w 10 192.168.32.12 %p'\n"))
+
+              (service nix-service-type/raised-nofile
                        (nix-configuration
                         (extra-config
                          '("experimental-features = nix-command flakes\n"
                            "extra-platforms = i686-linux aarch64-linux\n"
                            "keep-outputs = true\n"
-                           "keep-derivations = true\n"))))
+                           "keep-derivations = true\n"
+
+                           "extra-trusted-public-keys = edge-1:sGPnKl9kRZ1Tv8xqC8qdMfdpPpeZ0HDE38/eEmGOCGk=\n"
+                           "fallback = true\n"
+
+                           "builders = ssh-ng://nixremote@edge-ruther-builder x86_64-linux /root/.ssh/id_ed25519 8 2 big-parallel,kvm\n"
+                           "builders-use-substitutes = true\n"))))
               ;; TODO: contribute this to the nix service
               (simple-service 'nix-etc-d etc-profile-d-service-type
                               (list
                                (file-append nix "/etc/profile.d/nix-daemon.sh")
                                (file-append nix "/etc/profile.d/nix.sh")))
 
-              ;; Vivado or Matlab can crash because they open too many files
+              ;; Vivado or Matlab can crash because they open too many files.
+              ;; Note: @nixbld limits are set on the nix-daemon shepherd
+              ;; service itself (see (ruther services nix)); PAM limits don't
+              ;; apply because nixbld users never log in.
               (service pam-limits-service-type
                        (list
                         (pam-limits-entry "@wheel" 'hard 'nofile '50000)

@@ 0,0 1,58 @@
+;; Custom nix-daemon service that raises its NOFILE rlimit.
+;;
+;; The stock (gnu services nix) nix-daemon is started by shepherd with the
+;; default 1024/4096 open-files rlimit.  Build processes run as @nixbld are
+;; spawned as children of the daemon, so they inherit that limit — PAM limits
+;; for @nixbld are ineffective because nixbld users never log in.
+;;
+;; This module re-exports a service type that inherits from nix-service-type
+;; but replaces its shepherd-root-service-type extension with one that passes
+;; #:resource-limits to make-forkexec-constructor.
+
+(define-module (ruther services nix)
+  #:use-module (srfi srfi-1)
+  #:use-module (guix gexp)
+  #:use-module (gnu services)
+  #:use-module (gnu services nix)
+  #:use-module (gnu services shepherd)
+  #:export (nix-service-type/raised-nofile))
+
+;; The nix-configuration-* accessors are not exported from (gnu services nix),
+;; so reach in with @@.
+(define nix-configuration-package
+  (@@ (gnu services nix) nix-configuration-package))
+(define nix-configuration-build-directory
+  (@@ (gnu services nix) nix-configuration-build-directory))
+(define nix-configuration-extra-options
+  (@@ (gnu services nix) nix-configuration-extra-options))
+
+(define (nix-shepherd-service/raised-nofile config)
+  (let ((package (nix-configuration-package config))
+        (build-directory (nix-configuration-build-directory config))
+        (extra-options (nix-configuration-extra-options config)))
+    (list
+     (shepherd-service
+      (provision '(nix-daemon))
+      (documentation "Run nix-daemon with a raised NOFILE rlimit.")
+      (requirement '(user-processes file-system-/nix/store))
+      (start #~(make-forkexec-constructor
+                (list (string-append #$package "/bin/nix-daemon")
+                      #$@extra-options)
+                #:environment-variables
+                (list (string-append "TMPDIR=" #$build-directory)
+                      "PATH=/run/current-system/profile/bin")
+                #:resource-limits
+                '((nofile 1048576 1048576))))
+      (respawn? #f)
+      (stop #~(make-kill-destructor))))))
+
+(define nix-service-type/raised-nofile
+  (service-type
+   (inherit nix-service-type)
+   (extensions
+    (cons (service-extension shepherd-root-service-type
+                             nix-shepherd-service/raised-nofile)
+          (filter (lambda (ext)
+                    (not (eq? (service-extension-target ext)
+                              shepherd-root-service-type)))
+                  (service-type-extensions nix-service-type))))))