]> git.scottworley.com Git - nixos-qemu-vm-isolation/blob - modules/qemu-vm-isolation.nix
260e9fec7323c985a53c0fc1f197b13c765af525
[nixos-qemu-vm-isolation] / modules / qemu-vm-isolation.nix
1 { config, lib, modulesPath, pkgs, ... }:
2 let
3 inherit (lib) findSingle mkForce mkIf mkMerge mkVMOverride;
4
5 lookupDriveDeviceName = driveName: driveList:
6 (findSingle (drive: drive.name == driveName)
7 (throw "Drive ${driveName} not found")
8 (throw "Multiple drives named ${driveName}") driveList).device;
9
10 storeMountPath = if config.virtualisation.writableStore then
11 "/nix/.ro-store"
12 else
13 "/nix/store";
14
15 in {
16
17 fileSystems = mkVMOverride {
18 "${storeMountPath}" = {
19 device =
20 lookupDriveDeviceName "nixstore" config.virtualisation.qemu.drives;
21 fsType = "ext4";
22 options = [ "ro" ];
23 neededForBoot = true;
24 };
25 };
26
27 # We use this to disable fsck runs on the ext4 nix store image because stage-1
28 # fsck crashes (maybe because the device is read-only?), halting boot.
29 boot.initrd.checkJournalingFS = false;
30
31 system.build.nixStoreImage =
32 import (modulesPath + "/../lib/make-disk-image.nix") {
33 inherit pkgs config lib;
34 additionalPaths = [
35 (config.virtualisation.host.pkgs.closureInfo {
36 rootPaths = config.virtualisation.additionalPaths;
37 })
38 ];
39 onlyNixStore = true;
40 label = "nix-store";
41 partitionTableType = "none";
42 installBootLoader = false;
43 diskSize = "auto";
44 additionalSpace = "0M";
45 copyChannel = false;
46 };
47
48 virtualisation = {
49
50 sharedDirectories = mkForce { };
51
52 qemu.drives = [{
53 name = "nixstore";
54 file = "${config.system.build.nixStoreImage}/nixos.img";
55 driveExtraOpts = {
56 format = "raw";
57 read-only = "on";
58 werror = "report";
59 };
60 }];
61
62 };
63 }