sodium: build kernel with ccache

hosts/sodium.pop.ts.hillion.co.uk/default.nix

@@ -41,6 +41,19 @@
     #   };
     # };
 
+    ## Use ccache for building the Linux kernel
+    programs.ccache.enable = true;
+    nix.settings.extra-sandbox-paths = [ config.programs.ccache.cacheDir ];
+    fileSystems."${config.programs.ccache.cacheDir}" = {
+      device = "${config.custom.dns.authoritative.ipv4.uk.co.hillion.ts.storage.tywin}:/ccache";
+      fsType = "nfs";
+      options = [ "x-systemd.automount" "noauto" "x-systemd.idle-timeout=600" ];
+    };
+    programs.ccache.packageNames = [
+      # linux_rpi5 overrides from linux_rpi4
+      "linux_rpi4"
+    ];
+
     ## Custom Services
     custom.locations.autoServe = true;
 

hosts/tywin.storage.ts.hillion.co.uk/default.nix

@@ -67,6 +67,15 @@
       interval = "Wed, 02:00";
     };
 
+    ## NFS
+    services.nfs.server = {
+      enable = true;
+      exports = ''
+        /export           ${config.custom.dns.authoritative.ipv4.uk.co.hillion.ts.pop.sodium}(ro,fsid=0,no_subtree_check)
+        /export/ccache    ${config.custom.dns.authoritative.ipv4.uk.co.hillion.ts.pop.sodium}(rw,no_subtree_check)
+      '';
+    };
+
     ## Backups
     ### Git
     age.secrets."git/git_backups_ecdsa".file = ../../secrets/git/git_backups_ecdsa.age;
@@ -238,8 +247,19 @@
 
     ## Networking
     networking.nameservers = lib.mkForce [ ]; # Trust the DHCP nameservers
-    networking.firewall.interfaces."tailscale0".allowedTCPPorts = [
-      80 # Caddy (restic.tywin.storage.ts.)
-    ];
+    networking.firewall = {
+      trustedInterfaces = [ "tailscale0" ];
+      allowedTCPPorts = lib.mkForce [
+      ];
+      allowedUDPPorts = lib.mkForce [ ];
+      interfaces = {
+        eth0 = {
+          allowedTCPPorts = lib.mkForce [
+          ];
+          allowedUDPPorts = lib.mkForce [
+          ];
+        };
+      };
+    };
   };
 }

hosts/tywin.storage.ts.hillion.co.uk/hardware-configuration.nix

@@ -67,6 +67,11 @@
       fsType = "btrfs";
     };
 
+  fileSystems."/export/ccache" = {
+    device = "/data/ccache";
+    options = [ "bind" ];
+  };
+
   swapDevices = [ ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking