@@ -0,0 +1,74 @@
+let
+  homenet = "home.arpa";
+  pubnet = "alin.ovh";
+  tailnet = "fin-marlin.ts.net";
+
+  machines = {
+    r5 = {
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM1oPhD2wJA0MSQPqTBdjxWlNbZN0nOT9D9sxWJBFcS";
+      domains = [
+        homenet
+        tailnet
+      ];
+      builder = {
+        system = "aarch64-linux";
+        maxJobs = 4;
+      };
+    };
+    smrk = {
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINU03etY1me+35aJ7DTJID60cHlvYx6lV8A6V+OiR7hr";
+      domains = [
+        tailnet
+        pubnet
+      ];
+      builder = {
+        system = "x86_64-linux";
+      };
+    };
+    buk = {
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGHMu4LyHI2Kc3tC20lmBsVrofbebIR+y3wJ8EwUdjJV";
+      domains = [
+        pubnet
+        tailnet
+      ];
+      builder = {
+        system = "x86_64-linux";
+        maxJobs = 16;
+        speedFactor = 16;
+        supportedFeatures = [
+          "big-parallel"
+        ];
+      };
+    };
+    prefect = {
+      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGmHQIaiJAz9EZwu0anojtj9lO4gXN2YtWqk37WAROKW";
+      domains = [
+        tailnet
+        homenet
+      ];
+      builder = {
+        system = "x86_64-linux";
+        maxJobs = 16;
+        speedFactor = 8;
+        supportedFeatures = [
+          "nixos-test"
+          "kvm"
+          "big-parallel"
+        ];
+      };
+    };
+  };
+
+  canon = hostname: map (d: "${hostname}.${d}");
+in
+{
+  inherit homenet pubnet tailnet;
+
+  machines = builtins.mapAttrs (
+    name: machine:
+    machine
+    // {
+      extraHostNames = canon name machine.domains;
+    }
+  ) machines;
+}

@@ -5,10 +5,7 @@ "age1se1qwz9tsr7fq6m7rh3fj44fh6vcth53x9lcff9jeangg43v66vznxus3vp5mz" # marvin age-plugin-se
     ];
   };
 
-  machines = {
-    r5 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM1oPhD2wJA0MSQPqTBdjxWlNbZN0nOT9D9sxWJBFcS";
-    smrk = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINU03etY1me+35aJ7DTJID60cHlvYx6lV8A6V+OiR7hr";
-  };
+  inherit (import ../data) machines;
 
   secrets = with machines; {
     acme = [

@@ -5,6 +5,8 @@ ...
 }:
 {
   imports = [
+    ../roles/nix-build-client.nix
+
     ../settings/darwin.nix
     ../settings/programs/shell.nix
     ../settings/programs/base.nix

@@ -5,6 +5,7 @@ ...
 }:
 {
   imports = [
+    ./nix-build-client.nix
     ../settings/configuration/user.nix
 
     ../settings/programs/neovim.nix

@@ -0,0 +1,51 @@
+{
+  lib,
+  ...
+}:
+let
+  inherit (import ../../data) machines;
+
+  mkKnownHost =
+    name:
+    { publicKey, domains, ... }:
+    {
+      inherit publicKey;
+      extraHostNames = map (domain: "${name}.${domain}") domains;
+    };
+
+  mkBuilder =
+    {
+      system,
+      systems ? [ system ],
+      sshUser ? "nixremote",
+      protocol ? "ssh-ng",
+      ...
+    }@builder:
+    builder
+    // {
+      inherit
+        sshUser
+        systems
+        protocol
+        ;
+    };
+
+  mkBuildMachine =
+    hostName: machine:
+    (mkBuilder machine.builder)
+    // {
+      inherit hostName;
+    };
+in
+{
+  programs.ssh.knownHosts = lib.mapAttrs mkKnownHost machines;
+  nix = {
+    distributedBuilds = true;
+
+    buildMachines = lib.mapAttrsToList mkBuildMachine (lib.filterAttrs (n: v: v ? builder) machines);
+
+    settings = {
+      connect-timeout = 1;
+    };
+  };
+}

@@ -22,7 +22,7 @@ keep-outputs = true;
       warn-dirty = false;
 
       # https://jackson.dev/post/nix-reasonable-defaults/
-      connect-timeout = 5;
+      connect-timeout = lib.mkDefault 5;
       min-free = 128 * mb;
       max-free = 1 * gb;
       fallback = true;