···

       
1
       
1
       
 
       
{ config, lib, pkgs, ... }:

     

       
2
       
2
       
 
       


     

       
3
       
3
       
-
       
let

     

       
4
       
4
       
-
       
  serveOnly = pkgs.writeScript "nix-store-serve" ''

     

       
5
       
5
       
-
       
    #!${pkgs.stdenv.shell}

     

       
6
       
6
       
-
       
    if [ "$SSH_ORIGINAL_COMMAND" != "nix-store --serve" ]; then

     

       
7
       
7
       
-
       
      echo 'Error: You are only allowed to run `nix-store --serve'\'''!' >&2

     

       
8
       
8
       
-
       
      exit 1

     

       
9
       
9
       
-
       
    fi

     

       
10
       
10
       
-
       
    exec /run/current-system/sw/bin/nix-store --serve

     

       
11
       
11
       
-
       
  '';

     

       
3
       
3
       
+
       
with lib;

     

       
12
       
4
       
 
       


     

       
13
       
13
       
-
       
  inherit (lib) mkIf mkOption types;

     

       
14
       
14
       
-
       
in {

     

       
5
       
5
       
+
       
{

     

       
15
       
6
       
 
       
  options = {

     

       
16
       
7
       
 
       
    nix.sshServe = {

     

       
17
       
8
       
 
       
      enable = mkOption {

     

       
18
       
18
       
-
       
        description = "Whether to enable serving the nix store over ssh.";

     

       
9
       
9
       
+
       
        description = "Whether to enable serving the Nix store as a binary cache via SSH.";

     

       
19
       
10
       
 
       
        default = false;

     

       
20
       
11
       
 
       
        type = types.bool;

     

       
21
       
12
       
 
       
      };

     
···

       
24
       
15
       
 
       


     

       
25
       
16
       
 
       
  config = mkIf config.nix.sshServe.enable {

     

       
26
       
17
       
 
       
    users.extraUsers.nix-ssh = {

     

       
27
       
27
       
-
       
      description = "User for running nix-store --serve.";

     

       
18
       
18
       
+
       
      description = "Nix SSH substituter user";

     

       
28
       
19
       
 
       
      uid = config.ids.uids.nix-ssh;

     

       
29
       
20
       
 
       
      shell = pkgs.stdenv.shell;

     

       
30
       
21
       
 
       
    };

     
···

       
38
       
29
       
 
       
        PermitTTY no

     

       
39
       
30
       
 
       
        PermitTunnel no

     

       
40
       
31
       
 
       
        X11Forwarding no

     

       
41
       
41
       
-
       
        ForceCommand ${serveOnly}

     

       
32
       
32
       
+
       
        ForceCommand ${config.nix.package}/bin/nix-store --serve

     

       
42
       
33
       
 
       
      Match All

     

       
43
       
34
       
 
       
    '';

     

       
44
       
35
       
 
       
  };