sops: convert hardcoded paths for remotebuilds to sops compliant ones

2026-10-21 16:41:49 -04:00
parent 23bb5beea3
commit bffbe851b5
6 changed files with 39 additions and 4 deletions
@@ -1,4 +1,5 @@
 {
+  config,
  pkgs,
  ...
 }:
@@ -35,8 +36,8 @@
    "remotebuild" = {
      isSystemUser = true;
      group = "remotebuild";
-      useDefaultShell = true;
-      openssh.authorizedKeys.keyFiles = [ ./remotebuild.pub ];
+      shell = pkgs.writeScript "nologin" "#!/bin/sh\necho 'Remote builds only.'";
+      openssh.authorizedKeys.keyFiles = [ config.sops.secrets."remotebuild_ssh_key_rsa.pub".path ];
    };
  };