git.scottworley.com Git - nixos-qemu-vm-isolation/blob - modules/qemu-vm-isolation.nix

   1 { config, lib, modulesPath, pkgs, ... }:
   2 let
   3   inherit (lib) findSingle mkForce mkIf mkMerge mkVMOverride;
   4
   5   lookupDriveDeviceName = driveName: driveList:
   6     (findSingle (drive: drive.name == driveName)
   7       (throw "Drive ${driveName} not found")
   8       (throw "Multiple drives named ${driveName}") driveList).device;
   9
  10   storeMountPath = if config.virtualisation.writableStore then
  11     "/nix/.ro-store"
  12   else
  13     "/nix/store";
  14
  15 in {
  16
  17   fileSystems = mkVMOverride {
  18     "${storeMountPath}" = {
  19       device =
  20         lookupDriveDeviceName "nixstore" config.virtualisation.qemu.drives;
  21       fsType = "ext4";
  22       options = [ "ro" ];
  23       neededForBoot = true;
  24     };
  25   };
  26
  27   # We use this to disable fsck runs on the ext4 nix store image because stage-1
  28   # fsck crashes (maybe because the device is read-only?), halting boot.
  29   boot.initrd.checkJournalingFS = false;
  30
  31   system.build.nixStoreImage =
  32     import (modulesPath + "/../lib/make-disk-image.nix") {
  33       inherit pkgs config lib;
  34       additionalPaths = [
  35         (config.virtualisation.host.pkgs.closureInfo {
  36           rootPaths = config.virtualisation.additionalPaths;
  37         })
  38       ];
  39       onlyNixStore = true;
  40       label = "nix-store";
  41       partitionTableType = "none";
  42       installBootLoader = false;
  43       diskSize = "auto";
  44       additionalSpace = "0M";
  45       copyChannel = false;
  46     };
  47
  48   virtualisation = {
  49
  50     sharedDirectories = mkForce { };
  51
  52     qemu.drives = [{
  53       name = "nixstore";
  54       file = "${config.system.build.nixStoreImage}/nixos.img";
  55       driveExtraOpts = {
  56         format = "raw";
  57         read-only = "on";
  58         werror = "report";
  59       };
  60     }];
  61
  62   };
  63 }