machines/brawndo: Use a more sensible Nix config

We want to have sandboxed builds and a read-only store. Might make sense
to apply this to all machines in the long term.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>

1 files changed, 6 insertions, 1 deletions

diff --git a/machines/aszlig/managed/brawndo.nix b/machines/aszlig/managed/brawndo.nix
index 76a45c96..ae7a361c 100644
--- a/machines/aszlig/managed/brawndo.nix
+++ b/machines/aszlig/managed/brawndo.nix
@@ -42,7 +42,12 @@ in {
     networkmanager.enable = true;
   };
 
-  nix.maxJobs = 4;
+  nix = {
+    maxJobs = 4;
+    useSandbox = true;
+    readOnlyStore = true;
+    buildCores = 0;
+  };
 
   nixpkgs.config = {
     allowUnfree = true; # XXX: More granularity!