]> git.scottworley.com Git - nixos-qemu-vm-isolation/blob - modules/qemu-vm-isolation.nix
a9bf0dfc8177d28376c004c3aafd964ec5e19de6
[nixos-qemu-vm-isolation] / modules / qemu-vm-isolation.nix
1 { config, lib, modulesPath, pkgs, ... }:
2 let
3 inherit (lib) findSingle mkForce mkVMOverride;
4
5 lookupDriveDeviceName = driveName: driveList:
6 (findSingle (drive: drive.name == driveName)
7 (throw "Drive ${driveName} not found")
8 (throw "Multiple drives named ${driveName}") driveList).device;
9
10 storeMountPath = if config.virtualisation.writableStore then
11 "/nix/.ro-store"
12 else
13 "/nix/store";
14
15 in {
16
17 boot.initrd.availableKernelModules = [ "squashfs" ];
18
19 fileSystems = mkVMOverride {
20 "${storeMountPath}" = {
21 device =
22 lookupDriveDeviceName "nixstore" config.virtualisation.qemu.drives;
23 fsType = "squashfs";
24 options = [ "ro" ];
25 neededForBoot = true;
26 };
27 };
28
29 system.build.squashfsStore =
30 pkgs.callPackage (modulesPath + "/../lib/make-squashfs.nix") {
31 storeContents = config.virtualisation.additionalPaths;
32 };
33
34 virtualisation = {
35
36 # This should be the default.
37 bootDevice = lookupDriveDeviceName "root" config.virtualisation.qemu.drives;
38
39 sharedDirectories = mkForce { };
40
41 qemu.drives = [{
42 name = "nixstore";
43 file = "${config.system.build.squashfsStore}";
44 driveExtraOpts = {
45 format = "raw";
46 read-only = "on";
47 werror = "report";
48 };
49 }];
50
51 };
52 }