factor out microvm common code

1 files changed, 85 insertions, 0 deletions

diff --git a/microvms/lib/default.nix b/microvms/lib/default.nix
new file mode 100644
index 0000000..bdcc07f
--- /dev/null
+++ b/microvms/lib/default.nix
@@ -0,0 +1,85 @@
+{ lib, config, ... }:
+{
+  options.oxalab.vm.number =
+    with lib;
+    mkOption {
+      type = types.nullOr types.int;
+      default = null;
+    };
+
+  config =
+    let
+      vmMac = n:
+        assert n >= 0 && n <= 4294967295;
+        let
+          hex = lib.fixedWidthString 8 "0" (lib.toHexString n);
+        in
+          "02:00:"
+          + "${builtins.substring 0 2 hex}:"
+          + "${builtins.substring 2 2 hex}:"
+          + "${builtins.substring 4 2 hex}:"
+          + "${builtins.substring 6 2 hex}";
+    in
+      {
+        sops.defaultSopsFile = ../${config.networking.hostName}/secrets.yaml;
+        sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+        microvm = {
+          hypervisor = "cloud-hypervisor";
+          vsock.cid = 3 + config.oxalab.vm.number;
+          interfaces =
+            [
+              {
+                type = "tap";
+                id = "uvm-${config.networking.hostName}";
+                mac = vmMac config.oxalab.vm.number;
+              }
+            ];
+          shares = [
+            {
+              source = "/nix/store";
+              mountPoint = "/nix/.ro-store";
+              tag = "store";
+              proto = "virtiofs";
+              socket = "store.socket";
+            }
+          ]
+          ++
+          map
+            (dir: {
+              source = dir;
+              mountPoint = "/${dir}";
+              tag = dir;
+              proto = "virtiofs";
+              socket = "${dir}.socket";
+            })
+            [
+              "etc"
+              "var"
+              "home"
+            ];
+        };
+
+        networking.useNetworkd = true;
+        networking.firewall.enable = lib.mkForce false; # firewalling done by the host
+
+        systemd.network = {
+          enable = true;
+          networks."11-host" = {
+            matchConfig.MACAddress = vmMac config.oxalab.vm.number;
+            networkConfig = {
+              Address = "10.99.99." + lib.toString (10 + config.oxalab.vm.number)  + "/24";
+              DHCP = "no";
+            };
+            routes = [
+              {
+                Gateway = "10.99.99.1";
+                Destination = "0.0.0.0/0";
+                Metric = 1024;
+              }
+            ];
+          };
+        };
+      };
+
+}