ci: remote build on midnight

.github/workflows/nixos.yml

@@ -22,12 +22,18 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Clean up runner
+      - name: Setup Tailscale
+        uses: tailscale/github-action@84a3f23bb4d843bcf4da6cf824ec1be473daf4de
+        with:
+          authkey: "${{ secrets.TAILSCALE_PREAUTHKEY }}"
+          args: "--login-server=https://vpn.clicks.codes"
+
+      - name: Write out SSH key
+        env:
+          MIDNIGHT_SSH_KEY: ${{ secrets.MIDNIGHT_SSH_KEY }}
         run: |
-          # Commands taken from https://github.com/easimon/maximize-build-space/blob/master/action.yml
-          sudo rm -rf /usr/local/lib/android
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/hostedtoolcache/CodeQL
+          echo "$MIDNIGHT_SSH_KEY" > ../midnight_ssh_key
+          chmod 600 ../midnight_ssh_key
 
       - uses: actions/checkout@v4
 
@@ -52,10 +58,18 @@ jobs:
           sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
 
       - name: Build all systems
-        run: nix build -f ./nilla.nix packages.allNixOSSystems.result.x86_64-linux --show-trace
+        run: |
+          nix build \
+            -f ./nilla.nix packages.allNixOSSystems.result.x86_64-linux \
+            --eval-store auto --store "ssh-ng://remoteBuilds@midnight?ssh-key=$(realpath ../midnight_ssh_key)&base64-ssh-public-host-key=c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSU5wbnFKeDlBTGVSS0k0ekVvZnNIL0ZZMFJLaTVsWWtDRVMvR2NWbHNSWncgcm9vdEBhMWQyCg==" \
+            --show-trace
 
       - name: Build all homes
-        run: nix build -f ./nilla.nix packages.allHomes.result.x86_64-linux --show-trace
+        run: |
+          nix build \
+            -f ./nilla.nix packages.allHomes.result.x86_64-linux \
+            --eval-store auto --store "ssh-ng://remoteBuilds@midnight?ssh-key=$(realpath ../midnight_ssh_key)&base64-ssh-public-host-key=c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSU5wbnFKeDlBTGVSS0k0ekVvZnNIL0ZZMFJLaTVsWWtDRVMvR2NWbHNSWncgcm9vdEBhMWQyCg==" \
+            --show-trace
 
       - if: github.event_name == 'push'
         name: Push to release branch

systems/midnight/default.nix

@@ -6,5 +6,6 @@
   imports = [
     ./hardware-configuration.nix
     ./hostname.nix
+    ./remoteBuilds.nix
   ];
 }

systems/midnight/remoteBuilds.nix

@@ -0,0 +1,8 @@
+# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
+#
+# SPDX-License-Identifier: MIT
+{
+  users.users.remoteBuilds.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOCmfKIvQ6ZClOWi3jHKC8HTQ5Ewo4Kzw6VCJCzrn4ih ci"
+  ];
+}

systems/teal/headscale.nix

@@ -51,6 +51,11 @@ let
       src = [ "mostlyturquoise" ];
       dst = [ "tag:mostlyturquoise-minecraft-server:*" ];
     } # Used to let mostlyturquoise and their friends access their minecraft servers without giving people too many permissions
+    {
+      action = "accept";
+      src = [ "tag:ci" ];
+      dst = [ "midnight:*" ];
+    } # Used to let CI remotely build on midnight
   ];
 
   acls = [