services/nomad/build/build-rsyncd.nomad: run an rsyncd for buildsync

this allows the builders to push packages to the glibc builder and run
xbps-sign-repos after each transfer. xbps-sign-repos also now only adds
the key to the repodata and cleans old signatures

services/nomad/build/build-rsyncd.nomad

@@ -0,0 +1,59 @@
+job "build-rsyncd" {
+  type = "service"
+  datacenters = ["VOID"]
+  namespace = "build"
+
+  group "rsync" {
+    count = 1
+    network {
+      mode = "host"
+    }
+
+    volume "root-pkgs" {
+      type = "host"
+      source = "root-pkgs"
+      read_only = false
+    }
+
+    task "rsyncd" {
+      driver = "docker"
+
+      vault {
+        policies = ["void-secrets-repomgmt"]
+      }
+
+      config {
+        image = "ghcr.io/void-linux/infra-rsync:202308" # TODO
+        volumes = [
+            "local/buildsync.conf:/etc/rsyncd.conf.d/buildsync.conf",
+        ]
+        network_mode = "host"
+      }
+
+      volume_mount {
+        volume = "root-pkgs"
+        destination = "/pkgs"
+      }
+
+      template {
+        data = file("xbps-clean-sigs")
+        destination = "local/xbps-clean-sigs"
+        perms = "0755"
+      }
+
+      template {
+        data = <<EOF
+[pkgs]
+path = /pkgs
+read only = no
+list = yes
+transfer logging = true
+timeout = 600
+exclude = - .* - *-repodata.* - *-stagedata.* - *.sig - *.sig2
+post-xfer exec = /local/xbps-clean-sigs
+EOF
+        destination = "local/buildsync.conf"
+      }
+    }
+  }
+}

services/nomad/build/xbps-clean-sigs

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+# Remove signatures that don't have a corresponding package.
+find /pkgs \( -name '*.xbps.sig' -o -name '*.xbps.sig2' \) -exec sh -c 'for x in "$@"; do [ -e "${x%.sig*}" ] || rm -- $x; done' _ {} +
+
+exit 0