Nix daemon: allow setting sshPublicHostKey for buildMachines

[domenkozar]

Things done:

• Tested using sandboxing (nix-build --option build-use-chroot true or nix.useChroot on NixOS)
• Built on platform(s)
  • NixOS
  • OS X
  • Linux
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Fits CONTRIBUTING.md.

More

cc @edolstra

[peti]

I usually configure

  programs.ssh = {
    knownHosts."foo.cryp.to".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIObJL16zTudDie5u3Bu0XuC3BVlqeleb/9Ru8pObo9Bf";
    knownHosts."bar.cryp.to".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIF999GR+egNpI67jLR2A0zuyMp2iSVME/oDUNjeqZVa";
  };

in configuration.nix. Is that not sufficient?

[domenkozar]

See peti/hydra-tutorial#2 for background information.

[edolstra]

Yeah, programs.ssh.knownHosts is what we do for the static machines in the Delft buildfarm too.

[domenkozar]

So this should be abandoned all together then?

[Ericson2314]

As long as the functionality implemented in 2a7fbd57ccce6a309aebc13b076eaee096987a86 still exists in Nix, I don't see any reason not to do this. The commit message mentions various distributed settings in which it claims the known hosts method is not convenient, too.