more microvm rice

nixos/htz/vms/default.nix

@@ -0,0 +1,30 @@
+{ lib, pkgs, addressList, ... }:
+let genVMConfig = { name, config ? {}, ro-store ? true }: {
+  restartIfChanged = true;
+  pkgs = pkgs;
+  config = config // {
+    microvm = {
+      shares = lib.mkIf (ro-store == true) [{
+        source = "/nix/store";
+        mountPoint = "/nix/.ro-store";
+        tag = "ro-store";
+        proto = "virtiofs";
+      }];
+      interfaces = [
+        {
+          type = "tap";
+          id = name;
+          mac = addressList.${name}.mac;
+        }
+      ];
+    };
+  } // import ./vmDefaults.nix { inherit name addressList; };
+};
+in {
+  microvm.vms = {
+    vm-test = genVMConfig {
+      name = "vm-test";
+      config = import ./vm-test.nix { inherit pkgs addressList; };
+    };
+  };
+}

nixos/htz/vms/vm-test.nix

@@ -0,0 +1,14 @@
+{ addressList, ... }: {
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [80];
+    allowedUDPPorts = [];
+    logRefusedConnections = true;
+  };
+  services.nginx.enable = true;
+  services.nginx.virtualHosts."default_server" = {
+    addSSL = false;
+    enableACME = false;
+  };
+  system.stateVersion = "23.11";
+}

nixos/htz/vms/vmDefaults.nix

@@ -0,0 +1,37 @@
+{ name, addressList, ...}: {
+  systemd.network = {
+    enable = true;
+    networks."20-lan" = {
+      matchConfig.Type = "ether";
+      networkConfig = {
+        Address = [(addressList.${name}.ipv4 + addressList.${name}.subnet)];
+        Gateway = "10.0.0.1";
+        DNS = ["1.1.1.1"];
+        IPv6AcceptRA = true;
+        DHCP = "no";
+      };
+    };
+  };
+  services.openssh.enable = true;
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [22];
+    allowedUDPPorts = [];
+    logRefusedConnections = true;
+  };
+  users.users = {
+    root = {
+      openssh.authorizedKeys.keys = [
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEV8yjC8g68hoIi5021A6MR0ggMy++8KjmtXMzyOir2c root@htz''
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILU2TUxKyGKoZ68IG4hw23RmxVf72u5K9W0StkgTr0b2 e@t14'' ];
+    };
+    e = {
+      isNormalUser = true;
+      extraGroups = [ "wheel" ];
+      openssh.authorizedKeys.keys = [
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEV8yjC8g68hoIi5021A6MR0ggMy++8KjmtXMzyOir2c root@htz''
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILU2TUxKyGKoZ68IG4hw23RmxVf72u5K9W0StkgTr0b2 e@t14''
+      ];
+    };
+  };
+}