Merge feat/remote-builders into uconsole-cm5-incremental

Bidirectional remote building + rename uconsole-cm5 -> uConsole:
- Rename all uconsole-cm5 refs to uConsole (nixosSystem key, paths, module)
- Replace single-machine remote-builder module with multi-machine config
- Enable remote builder on lazyworkhorse -> uConsole (aarch64)
- Enable remote builder on uConsole -> lazyworkhorse (x86_64)
- Add builder system user + SSH key via agenix-rekey (secrets/builder_key.age)
- Add builder_key + gortium_password age secrets to all hosts
- Fix pre-existing bugs: missing modules in lazyworkhorse/cyt-pi,
  SSH config structure (hostKeys outside settings), cyt-pi inline user
- Remove obsolete openclaw-node service + module + age secrets

modules/nixos/services/remote-builder.nix

@@ -3,69 +3,71 @@ let
   cfg = config.services.remoteBuilder;
 in {
   options.services.remoteBuilder = {
-    enable = lib.mkEnableOption "remote Nix build machine (lazyworkhorse server)";
+    enable = lib.mkEnableOption "remote Nix build machine";
 
-    buildMachine = {
-      host = lib.mkOption {
-        type = lib.types.str;
-        default = "lazyworkhorse.net";
-        description = "Hostname or IP of the remote build machine.";
-      };
-      sshUser = lib.mkOption {
-        type = lib.types.str;
-        default = "ai-worker";
-        description = "SSH user on the remote build machine.";
-      };
-      port = lib.mkOption {
-        type = lib.types.port;
-        default = 2424;
-        description = "SSH port — added via ~root/.ssh/config since nix.buildMachines has no sshPort option.";
-      };
-      systems = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ "aarch64-linux" "x86_64-linux" ];
-        description = "System types the remote builder can build for.";
-      };
-      maxJobs = lib.mkOption {
-        type = lib.types.int;
-        default = 16;
-        description = "Max parallel jobs on the remote builder.";
-      };
-      supportedFeatures = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ "big-parallel" "nixos-test" "benchmark" ];
-        description = "Features the remote builder supports.";
-      };
-    };
-
-    fallbackLocal = lib.mkOption {
-      type = lib.types.bool;
-      default = true;
-      description = "Fall back to local build when remote builder is unreachable.";
+    machines = lib.mkOption {
+      type = lib.types.listOf (lib.types.submodule {
+        options = {
+          hostName = lib.mkOption {
+            type = lib.types.str;
+            description = "Hostname or IP of the remote build machine.";
+          };
+          port = lib.mkOption {
+            type = lib.types.port;
+            default = 22;
+            description = "SSH port.";
+          };
+          sshUser = lib.mkOption {
+            type = lib.types.str;
+            default = "builder";
+            description = "SSH user on the remote build machine.";
+          };
+          sshKey = lib.mkOption {
+            type = lib.types.str;
+            description = "Path to SSH private key for the builder.";
+          };
+          systems = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ "aarch64-linux" ];
+            description = "System types the remote builder can build for.";
+          };
+          maxJobs = lib.mkOption {
+            type = lib.types.int;
+            default = 4;
+            description = "Max parallel jobs on the remote builder.";
+          };
+          supportedFeatures = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ "benchmark" "big-parallel" "nixos-test" ];
+            description = "Features the remote builder supports.";
+          };
+        };
+      });
+      default = [];
+      description = "List of remote Nix build machines.";
     };
   };
 
   config = lib.mkIf cfg.enable {
     nix.distributedBuilds = true;
-    nix.buildMachines = [{
-      hostName = cfg.buildMachine.host;
-      sshUser = cfg.buildMachine.sshUser;
-      systems = cfg.buildMachine.systems;
-      maxJobs = cfg.buildMachine.maxJobs;
-      supportedFeatures = cfg.buildMachine.supportedFeatures;
-    }];
+    nix.buildMachines = map (m: {
+      hostName = m.hostName;
+      sshUser = m.sshUser;
+      sshKey = m.sshKey;
+      systems = m.systems;
+      maxJobs = m.maxJobs;
+      supportedFeatures = m.supportedFeatures;
+    }) cfg.machines;
 
-    nix.extraOptions = lib.optionalString cfg.fallbackLocal ''
-      builders-use-substitutes = true
-      fallback = true
-    '';
-
-    # SSH config for the remote builder (since nix.buildMachines has no port option)
-    programs.ssh.extraConfig = ''
-      Host ${cfg.buildMachine.host}
-        HostName ${cfg.buildMachine.host}
-        Port ${toString cfg.buildMachine.port}
-        User ${cfg.buildMachine.sshUser}
-    '';
+    # SSH config for port + key (nix.buildMachines has no port option)
+    programs.ssh.extraConfig = lib.concatStringsSep "\n" (map (m: ''
+      Host ${m.hostName}
+        HostName ${m.hostName}
+        Port ${toString m.port}
+        User ${m.sshUser}
+        IdentityFile ${m.sshKey}
+        StrictHostKeyChecking no
+        UserKnownHostsFile /dev/null
+    '') cfg.machines);
   };
 }