git.scottworley.com Git - nixos-qemu-vm-isolation/blob - modules/qemu-vm-isolation.nix

   1 { config, lib, modulesPath, pkgs, ... }:
   2 let
   3   inherit (lib)
   4     escapeShellArg mkForce mkIf mkMerge mkOption mkVMOverride optional;
   5
   6   cfg = config.virtualisation.qemu.isolation;
   7
   8   storeMountPath = if config.virtualisation.writableStore then
   9     "/nix/.ro-store"
  10   else
  11     "/nix/store";
  12
  13   hostPkgs = config.virtualisation.host.pkgs;
  14
  15   storeContents =
  16     hostPkgs.closureInfo { rootPaths = config.virtualisation.additionalPaths; };
  17
  18   nixStoreImages = {
  19     ext4 = "${
  20         import (modulesPath + "/../lib/make-disk-image.nix") {
  21           inherit pkgs config lib;
  22           additionalPaths = [ storeContents ];
  23           onlyNixStore = true;
  24           label = "nix-store";
  25           partitionTableType = "none";
  26           installBootLoader = false;
  27           diskSize = "auto";
  28           additionalSpace = "0M";
  29           copyChannel = false;
  30         }
  31       }/nixos.img";
  32     erofs = "${
  33         hostPkgs.runCommand "nix-store-image" { } ''
  34           mkdir $out
  35           ${hostPkgs.gnutar}/bin/tar --create \
  36             --absolute-names \
  37             --verbatim-files-from \
  38             --transform 'flags=rSh;s|/nix/store/||' \
  39             --files-from ${storeContents}/store-paths \
  40             | ${hostPkgs.erofs-utils}/bin/mkfs.erofs \
  41               --force-uid=0 \
  42               --force-gid=0 \
  43               -L nix-store \
  44               -U eb176051-bd15-49b7-9e6b-462e0b467019 \
  45               -T 0 \
  46               --tar=f \
  47               $out/nix-store.img
  48         ''
  49       }/nix-store.img";
  50     squashfs =
  51       "${hostPkgs.callPackage (modulesPath + "/../lib/make-squashfs.nix") {
  52         storeContents = config.virtualisation.additionalPaths;
  53       }}";
  54   };
  55
  56 in {
  57   options = {
  58     virtualisation.qemu.isolation.nixStoreFilesystemType = mkOption {
  59       description = ''
  60         What filesystem to use for the guest's Nix store.
  61
  62         erofs is more compact than ext4, but less mature.
  63
  64         squashfs support currently requires a dubious kludge that results in these
  65         VMs not being able to mount any other squashfs volumes besides the nix store.
  66       '';
  67       type = lib.types.enum [ "ext4" "erofs" "squashfs" ];
  68       default = "ext4";
  69     };
  70   };
  71   config = mkMerge [
  72     {
  73       boot.initrd.kernelModules =
  74         optional (cfg.nixStoreFilesystemType == "erofs") "erofs";
  75
  76       nixpkgs.overlays = optional (cfg.nixStoreFilesystemType == "squashfs")
  77         (final: prev: {
  78           util-linux = prev.util-linux.overrideAttrs (old: {
  79             patches = (old.patches or [ ])
  80               ++ [ ./libblkid-squashfs-nix-store-kludge.patch ];
  81           });
  82         });
  83
  84       fileSystems = mkVMOverride {
  85         "${storeMountPath}" = {
  86           fsType = cfg.nixStoreFilesystemType;
  87           options = [ "ro" ];
  88           neededForBoot = true;
  89           label = "nix-store";
  90         };
  91       };
  92
  93       system.build.nixStoreImage =
  94         nixStoreImages."${cfg.nixStoreFilesystemType}";
  95
  96       virtualisation = {
  97
  98         sharedDirectories = mkForce { };
  99
 100         qemu.drives = [{
 101           file = config.system.build.nixStoreImage;
 102           driveExtraOpts = {
 103             format = "raw";
 104             read-only = "on";
 105             werror = "report";
 106           };
 107         }];
 108
 109       };
 110     }
 111     (mkIf (cfg.nixStoreFilesystemType == "ext4") {
 112       # We use this to disable fsck runs on the ext4 nix store image because stage-1
 113       # fsck crashes (maybe because the device is read-only?), halting boot.
 114       boot.initrd.checkJournalingFS = false;
 115     })
 116   ];
 117 }