@@ -35,6 +35,7 @@ ../roles/calendar-anonymiser.nix
     ../roles/forgejo-runner.nix
     ../roles/goatcounter.nix
     ../roles/mailer.nix
+    ../roles/nix-remote-builder.nix
     ../roles/push-notifications.nix
     ../roles/readeck.nix
     ../roles/redis-website.nix
@@ -63,10 +64,6 @@
   nix = {
     settings = {
       max-jobs = 2;
-      trusted-users = [
-        "root"
-        "nixremote"
-      ];
     };
 
     buildMachines = [
@@ -156,18 +153,6 @@
   security.sudo.extraConfig = ''
     Defaults:root,%wheel env_keep+=EDITOR
   '';
-
-  users.users.nixremote = {
-    shell = "/bin/sh";
-    isNormalUser = true;
-    home = "/var/lib/nixremote/";
-    createHome = true;
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPKGzXGgFm/4Da2KNl1wb7TC2YOu/baP/2eFVBaJY0Wq root@marvin"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIy9jFioBvV0JA0lc+De2N+vDOABGHgCECW6vkD33CE4 sourcehut"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIII7sWEwsm8JZiJ0LUnjSt0Kg1RXypG6p5AzP/R2n5ca actions@github.com"
-    ];
-  };
 
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions

@@ -12,6 +12,7 @@ ../roles/server.nix
     ../roles/ci.nix
     ../roles/reverse-proxy.nix
     ../roles/forgejo-runner.nix
+    ../roles/nix-remote-builder.nix
   ];
   system.stateVersion = "25.11";
 
@@ -31,17 +32,5 @@ nix = {
     settings = {
       max-jobs = 4;
     };
-  };
-
-  users.users.nixremote = {
-    shell = "/bin/sh";
-    isNormalUser = true;
-    home = "/var/lib/nixremote/";
-    createHome = true;
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPKGzXGgFm/4Da2KNl1wb7TC2YOu/baP/2eFVBaJY0Wq root@marvin"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIy9jFioBvV0JA0lc+De2N+vDOABGHgCECW6vkD33CE4 sourcehut"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIII7sWEwsm8JZiJ0LUnjSt0Kg1RXypG6p5AzP/R2n5ca actions@github.com"
-    ];
   };
 }

@@ -20,4 +20,9 @@ extraConfig = ''
       reverse_proxy ${ns.bindAddress}:${toString ns.port}
     '';
   };
+
+  users.users.nixremote.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIy9jFioBvV0JA0lc+De2N+vDOABGHgCECW6vkD33CE4 sourcehut"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIII7sWEwsm8JZiJ0LUnjSt0Kg1RXypG6p5AzP/R2n5ca actions@github.com"
+  ];
 }

@@ -0,0 +1,15 @@
+{
+  ...
+}:
+{
+  nix.settings.trusted-users = [ "nixremote" ];
+  users.users.nixremote = {
+    shell = "/bin/sh";
+    isNormalUser = true;
+    home = "/var/lib/nixremote/";
+    createHome = true;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPKGzXGgFm/4Da2KNl1wb7TC2YOu/baP/2eFVBaJY0Wq root@marvin"
+    ];
+  };
+}