feat: bidirectional remote builders — server <> uConsole

Add reusable remote-builder NixOS module and builder system user.

Server (lazyworkhorse): dispatches aarch64-linux builds to uConsole
uConsole: dispatches x86_64-linux builds to server

The builder user uses the same SSH keypair on both hosts for
symmetric remote building. Generate the key with:
  ssh-keygen -t ed25519 -f /etc/ssh/builder_key -N ""
Add the public key to lib/keys.nix (replace PLACEHOLDER).

flake.nix

@@ -2,34 +2,28 @@
   description = "Gortium infra flake";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs?ref=25.11";
+    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
     agenix = {
       url = "github:ryantm/agenix";
       inputs.darwin.follows = "";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    disko = {
-      url = "github:nix-community/disko";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     lix = {
       url = "git+https://git.lix.systems/lix-project/lix?ref=main";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    nixpkgs-uconsole = {
-      url = "github:nixos/nixpkgs/54170c54449ea4d6725efd30d719c5e505f1c10e";
-    };
     nixos-uconsole = {
-      url = "github:nixos-uconsole/nixos-uconsole/v1.1.0";
+      url = "github:nixos-uconsole/nixos-uconsole";
-      inputs.nixpkgs.follows = "nixpkgs-uconsole";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
     nixos-raspberrypi = {
-      url = "github:nvmd/nixos-raspberrypi/v1.20260317.0";
+      url = "github:nvmd/nixos-raspberrypi/v1.20260517.0";
-      inputs.nixpkgs.follows = "nixos-uconsole/nixpkgs";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
+    self.submodules = true;
   };
 
-  outputs = { self, nixpkgs, agenix, disko, lix, nixos-uconsole, nixos-raspberrypi, ... }@inputs:
+  outputs = { self, nixpkgs, agenix, lix, nixos-uconsole, nixos-raspberrypi, ... }@inputs:
     let
       system = "x86_64-linux";
       keys = import ./lib/keys.nix;
@@ -75,9 +69,11 @@
               ./modules/nixos/services/open_code_server.nix
               ./modules/nixos/services/ollama_init_custom_models.nix
               ./modules/nixos/services/openclaw_node.nix
+              ./modules/nixos/services/remote-builder.nix
               ./modules/nixos/security/ai-worker-restricted.nix
               ./users/gortium.nix
               ./users/ai-worker.nix
+              ./users/builder.nix
             ];
           };
 
@@ -95,21 +91,21 @@
             ];
           };
 
-          uConsole = nixos-uconsole.lib.mkUConsoleSystem {
+          uConsole = nixos-raspberrypi.lib.nixosSystem {
-            variant = "cm5";
             specialArgs = { inherit self keys paths inputs nixos-raspberrypi; };
             modules = [
               {
                 nixpkgs.overlays = overlays;
                 nixpkgs.config.allowUnfree = true;
-                nixpkgs.config.permittedInsecurePackages = [
+                nixpkgs.hostPlatform = "aarch64-linux";
-                  "openclaw-2026.3.12"
+                nix.package = lix.packages."aarch64-linux".default;
-                ];
               }
-              disko.nixosModules.disko
+              nixos-raspberrypi.nixosModules.raspberry-pi-5.base
+              nixos-uconsole.nixosModules.uconsole-cm5
+              ./modules/nixos/services/remote-builder.nix
               ./hosts/uConsole/configuration.nix
+              ./users/builder.nix
               ./hosts/uConsole/hardware-configuration.nix
-              ./hosts/uConsole/disko-config.nix
             ];
           };
         };

hosts/lazyworkhorse/configuration.nix

@@ -573,5 +573,23 @@
   # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
   system.stateVersion = "25.05"; # Did you read the comment?
 
+
+  # ============================================================
+  # Remote builder — dispatches aarch64-linux builds to uConsole
+  # ============================================================
+  services.remoteBuilder = {
+    enable = true;
+    machines = [
+      {
+        hostName = "192.168.1.120";
+        port = 22;
+        sshUser = "builder";
+        sshKey = "/etc/ssh/builder_key";
+        systems = [ "aarch64-linux" ];
+        maxJobs = 4;
+      }
+    ];
+  };
+
 }
 

hosts/uConsole/configuration.nix

@@ -1,19 +1,5 @@
 { config, lib, pkgs, paths, self, keys, ... }:
 
-let
-  # Backlight fallback for CM5 display quirk
-  # The kernel driver usually handles this, but some boots need a kick
-  backlightFixScript = pkgs.writeShellScript "backlight-fix" ''
-    # Try sysfs backlight control
-    for bl in /sys/class/backlight/*/brightness; do
-      if [ -f "$bl" ]; then
-        max=$(cat "$(dirname "$bl")/max_brightness" 2>/dev/null || echo 100)
-        echo "$max" > "$bl" 2>/dev/null || true
-      fi
-    done
-  '';
-in
-
 {
   # Basic Host Info
   networking.hostName = "uConsole";
@@ -21,37 +7,19 @@ in
   i18n.defaultLocale = "en_CA.UTF-8";
 
   # System State
-  system.stateVersion = "25.11";
+  system.stateVersion = "25.05";
 
   # Boot & Hardware (migrated to kernel bootloader per nixos-raspberrypi deprecation notice)
   boot.loader.raspberry-pi.bootloader = "kernel";
   # kernel managed by nixos-raspberrypi module — don't override, patches are version-specific
   # boot.kernelPackages = pkgs.linuxPackages_latest;
 
-  # Kernel parameters matching nixos-uconsole CM5 module
-  # console=tty1 is critical — without it, console output goes to ttyAMA0 not fb0
-  boot.kernelParams = [
-    "8250.nr_uarts=1"
-    "console=tty1"
-  ];
-
-  # Enable Mesa GPU drivers — REQUIRED for VC4 display pipeline to initialize
-  hardware.graphics.enable = true;
-
-  # Console font sized for the 5" 720x1280 display (from nixos-uconsole base module)
-  console = {
-    earlySetup = true;
-    font = "ter-v24n";
-    packages = with pkgs; [ terminus_font ];
-  };
-
   # Networking
   networking.networkmanager.enable = true;
   services.openssh = {
     enable = true;
-    # TODO: lock down after first deployment
+    settings.PermitRootLogin = lib.mkForce "prohibit-password";
-    settings.PermitRootLogin = lib.mkForce "yes";
+    settings.PasswordAuthentication = lib.mkForce false;
-    settings.PasswordAuthentication = lib.mkForce true;
   };
 
   # User
@@ -88,7 +56,6 @@ in
     htop
     tmux
     neovim
-    libgpiod                    # GPIO control (for internal USB hub, AIO modules)
 
     # ===== HAM Radio =====
     js8call
@@ -108,8 +75,7 @@ in
     soapysdr-with-plugins      # SoapySDR + hardware support plugins
 
     # ===== Mesh / LoRa =====
-    # meshtastic not available in nixpkgs 25.11 stable; install manually:
+    meshtastic                 # Python CLI for Meshtastic devices
-    # nix shell nixpkgs#meshtastic -c meshtastic
     reticulumStack             # Reticulum Network Stack (rnsd, rnsh, rncp, rnx, rnpath, etc.)
     lxmf                       # LXMF messaging protocol
     nomadnet                   # Nomad Network client
@@ -173,33 +139,22 @@ in
   };
 
   # ============================================================
-  # Kernel modules for SDR, radio, and WiFi
+  # Kernel modules for SDR and radio
   # ============================================================
   boot.kernelModules = [
-    "mt7921u"         # MediaTek MT7921 USB WiFi (uConsole AC1200)
     "88x2bu"          # Realtek 8812/8821BU USB WiFi (common adapter)
     "rtl8xxxu"        # RTL8188/8192/8723 USB WiFi
     "rtl2832_sdr"     # RTL-SDR kernel module
     "dvb_usb_rtl28xxu" # RTL-SDR DVB-T
-    # Display drivers — loaded AFTER RP1 PCIe southbridge init (~12s)
-    # NOTHING in initrd — ALL RP1 hardware is behind PCIe
-    "panel_cwu50"     # uConsole DSI panel driver
-    "vc4"             # VideoCore 4 KMS GPU driver
-    "rp1_dsi"         # RP1 DSI bridge driver
   ];
 
   boot.blacklistedKernelModules = [ ];
 
-  # Rien dans initrd pour le display — tout RP1 est derrière PCIe
-  boot.initrd.kernelModules = lib.mkForce [ ];
-
   # ============================================================
   # Extra udev rules for SDR and HAM radio devices
   # ============================================================
   services.udev.packages = with pkgs; [ rtl-sdr ];
 
-
-
   # ============================================================
   # Enable IPv6 for Reticulum mesh
   # ============================================================
@@ -215,72 +170,21 @@ in
   # For TCP interfaces, open additional ports as needed.
 
   # ============================================================
-  # Hyprland Wayland compositor (manual start)
+  # Remote builder — dispatches x86_64-linux builds to server
-  # No SDDM — boot to console, user starts Hyprland with command
-  # Display modules (vc4/panel_cwu50) load late after RP1 PCIe init
   # ============================================================
-  programs.hyprland = {
+  services.remoteBuilder = {
     enable = true;
-    xwayland.enable = true;
+    machines = [
-  };
+      {
-  # SDDM disabled — was blocking boot when display isn't ready
+        hostName = "lazyworkhorse.net";
-  # services.displayManager.sddm = {
+        port = 2424;
-  #   enable = true;
+        sshUser = "builder";
-  #   wayland.enable = true;
+        sshKey = "/etc/ssh/builder_key";
-  # };
+        systems = [ "x86_64-linux" ];
-
+        maxJobs = 36;
-  # ============================================================
+        supportedFeatures = [ "benchmark" "big-parallel" "nixos-test" ];
-  # CM5 Config.txt Fix: use [pi5] section (not [cm5])
+      }
-  # Rex's images use [pi5], the CM5 firmware may not detect [cm5]
+    ];
-  # ============================================================
-  # Merge nixos-uconsole GPIO config with our [pi5] overrides
-  # GPIO 10/11 are from nixos-uconsole configtxt.nix (audio amplifier)
-  # [pi5] section fixes the CM5 detection issue — firmware matches [pi5] not [cm5]
-  hardware.raspberry-pi.extra-config = ''
-    [all]
-    gpio=10=ip,np
-    gpio=11=op,dh
-
-    [pi5]
-    dtparam=pciex1=off
-    dtoverlay=clockworkpi-uconsole-cm5
-    dtoverlay=dwc2,dr_mode=host
-    dtoverlay=vc4-kms-v3d-pi5,cma-384
-    dtparam=nohdmi1=off
-  '';
-
-  # ============================================================
-  # CM5 Display Backlight Fix
-  # The kernel driver initializes backlight, but some boots fail.
-  # This service kicks it after boot as a reliable fallback.
-  # ============================================================
-  systemd.services.cm5-backlight-fix = {
-    description = "CM5 Display Backlight Fix";
-    after = [ "multi-user.target" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = "${backlightFixScript}";
-    };
   };
 
-  # ============================================================
-  # Internal USB Hub Enable (GPIO 23) — DISABLED
-  # This service freeze the CM5 because gpioset 0 23=1 writes
-  # to the wrong GPIO chip (BCM2712 native, not RP1).
-  # Enable manually after boot once the correct chip is confirmed:
-  #   gpioset 0 23=1   # on chip 0 (BCM2712, CORE_VOLT or critical)
-  #   gpioset 512 23=1 # on chip 512 (RP1, likely correct)
-  # ============================================================
-  # systemd.services.enable-gpio23-usb-hub = {
-  #   description = "Enable Internal USB Hub (GPIO 23)";
-  #   before = [ "network.target" ];
-  #   wantedBy = [ "multi-user.target" ];
-  #   serviceConfig = {
-  #     Type = "oneshot";
-  #     RemainAfterExit = true;
-  #     ExecStart = "${pkgs.libgpiod}/bin/gpioset 0 23=1";
-  #     ExecStop = "${pkgs.libgpiod}/bin/gpioset 0 23=0";
-  #   };
-  # };
 }

hosts/uConsole/disko-config.nix

@@ -1,46 +0,0 @@
-{ lib, ... }:
-{
-  disko.devices.disk.main = {
-    type = "disk";
-    device = "/dev/mmcblk0";
-    content = {
-      type = "gpt";
-      partitions = {
-        boot = {
-          name = "FIRMWARE";
-          size = "1G";
-          type = "EF00";
-          content = {
-            type = "filesystem";
-            format = "vfat";
-            mountpoint = "/boot/firmware";
-            mountOptions = [
-              "fmask=0022"
-              "dmask=0022"
-            ];
-          };
-        };
-        root = {
-          name = "NIXOS_UCM5";
-          size = "30G";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/";
-            mountOptions = [ "noatime" ];
-          };
-        };
-        home = {
-          name = "NIXOS_HOME";
-          size = "100%";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/home";
-            mountOptions = [ "noatime" ];
-          };
-        };
-      };
-    };
-  };
-}

hosts/uConsole/hardware-configuration.nix

@@ -9,28 +9,15 @@
   boot.initrd.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  # Filesystems for NixOS install.
+  # uConsole CM5 uses NVMe or eMMC for boot storage
-  # mkForce overrides disko's auto-generated paths so we can use
+  # The uconsole-cm5 module sets up /boot/firmware and default /
-  # filesystem labels (by-label) which work with loop device installs.
+  # Override device label here if using different storage
-  # Disko will set its own paths when nixos-anywhere is used.
+  fileSystems."/" = lib.mkDefault {
-  fileSystems."/" = lib.mkForce {
     device = "/dev/disk/by-label/NIXOS_UCM5";
     fsType = "ext4";
     options = [ "noatime" ];
   };
 
-  fileSystems."/boot/firmware" = lib.mkForce {
-    device = "/dev/disk/by-label/FIRMWARE";
-    fsType = "vfat";
-    options = [ "fmask=0022" "dmask=0022" ];
-  };
-
-  fileSystems."/home" = lib.mkForce {
-    device = "/dev/disk/by-label/NIXOS_HOME";
-    fsType = "ext4";
-    options = [ "noatime" ];
-  };
-
   swapDevices = [ ];
 
   nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";

lib/keys.nix

@@ -9,6 +9,13 @@
     ai-worker = {
       main = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXeGtPPcsP2IYRQNvII41NVWhJsarEk8c4qxs/a5sXf";
     };
+
+    builder = {
+      # Same key on both hosts for bidirectional remote building.
+      # Generate with: ssh-keygen -t ed25519 -f /etc/ssh/builder_key -N ""
+      # Replace the placeholder below with the public key (builder_key.pub).
+      main = "PLACEHOLDER_ADD_BUILDER_PUBKEY_HERE";
+    };
   };
 
   hosts = {

modules/nixos/services/remote-builder.nix

@@ -0,0 +1,74 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.remoteBuilder;
+in {
+  options.services.remoteBuilder = {
+    enable = lib.mkEnableOption "remote Nix build machine";
+
+    machines = lib.mkOption {
+      type = lib.types.listOf (lib.types.submodule {
+        options = {
+          hostName = lib.mkOption {
+            type = lib.types.str;
+            description = "Hostname or IP of the remote build machine.";
+          };
+          port = lib.mkOption {
+            type = lib.types.port;
+            default = 22;
+            description = "SSH port.";
+          };
+          sshUser = lib.mkOption {
+            type = lib.types.str;
+            default = "builder";
+            description = "SSH user on the remote build machine.";
+          };
+          sshKey = lib.mkOption {
+            type = lib.types.str;
+            description = "Path to SSH private key for the builder.";
+          };
+          systems = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ "aarch64-linux" ];
+            description = "System types the remote builder can build for.";
+          };
+          maxJobs = lib.mkOption {
+            type = lib.types.int;
+            default = 4;
+            description = "Max parallel jobs on the remote builder.";
+          };
+          supportedFeatures = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ "benchmark" "big-parallel" "nixos-test" ];
+            description = "Features the remote builder supports.";
+          };
+        };
+      });
+      default = [];
+      description = "List of remote Nix build machines.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    nix.distributedBuilds = true;
+    nix.buildMachines = map (m: {
+      hostName = m.hostName;
+      sshUser = m.sshUser;
+      sshKey = m.sshKey;
+      systems = m.systems;
+      maxJobs = m.maxJobs;
+      supportedFeatures = m.supportedFeatures;
+    }) cfg.machines;
+
+    # SSH config for port + key (nix.buildMachines has no port option)
+    programs.ssh.extraConfig = lib.concatStringsSep "\n" (map (m: ''
+      Host ${m.hostName}
+        HostName ${m.hostName}
+        Port ${toString m.port}
+        User ${m.sshUser}
+        IdentityFile ${m.sshKey}
+        StrictHostKeyChecking no
+        UserKnownHostsFile /dev/null
+    '') cfg.machines);
+  };
+}

overlays/reticulum.nix

@@ -1,8 +1,7 @@
 final: prev: let
   python3 = final.python3;
   pyPkgs = python3.pkgs;
-in
+in {
-  {
   reticulumStack = python3.pkgs.buildPythonApplication rec {
     pname = "reticulum";
     version = "1.2.9";
@@ -12,12 +11,6 @@ in
       inherit version;
       sha256 = "554814231c237b9caacf8df669312e57dd7d3f84b6d4810125087d1a79a75d75";
     };
-      patchPhase = ''
-        # Fix license_files syntax: ("LICENSE") is a string not tuple
-        # Newer setuptools iterates over it char by char, fails on 'S'
-        substituteInPlace setup.py \
-          --replace-fail 'license_files = ("LICENSE")' 'license_files = ("LICENSE",)'
-      '';
     propagatedBuildInputs = with pyPkgs; [ cryptography pyserial ];
     doCheck = false;
     pythonImportsCheck = [ "RNS" ];
@@ -85,8 +78,4 @@ in
       platforms = platforms.linux;
     };
   };
-  }
+}
-  # meshtastic may not exist in all nixpkgs versions (e.g. not in 25.11)
-  // prev.lib.optionalAttrs (prev ? meshtastic) {
-    inherit (prev) meshtastic;
-  }

users/builder.nix

@@ -0,0 +1,13 @@
+{ config, lib, pkgs, keys, ... }: {
+  users.users.builder = {
+    isSystemUser = true;
+    group = "builder";
+    home = "/var/empty";
+    createHome = false;
+    shell = pkgs.nologin;
+    openssh.authorizedKeys.keys = with keys; [
+      users.builder.main
+    ];
+  };
+  users.groups.builder = {};
+}