From 35d9300facd27d3419342e49ff59fbf13ebce446 Mon Sep 17 00:00:00 2001
From: Grisha Shipunov
Date: Sun, 26 Jul 2026 12:00:45 +0000
Subject: factor out microvm common code

---
 microvms/lib/default.nix      | 85 +++++++++++++++++++++++++++++++++++++++++++
 microvms/miniflux/default.nix | 60 ++----------------------------
 2 files changed, 88 insertions(+), 57 deletions(-)
 create mode 100644 microvms/lib/default.nix

diff --git a/microvms/lib/default.nix b/microvms/lib/default.nix
new file mode 100644
index 0000000..bdcc07f
--- /dev/null
+++ b/microvms/lib/default.nix
@@ -0,0 +1,85 @@
+{ lib, config, ... }:
+{
+  options.oxalab.vm.number =
+    with lib;
+    mkOption {
+      type = types.nullOr types.int;
+      default = null;
+    };
+
+  config =
+    let
+      vmMac = n:
+        assert n >= 0 && n <= 4294967295;
+        let
+          hex = lib.fixedWidthString 8 "0" (lib.toHexString n);
+        in
+          "02:00:"
+          + "${builtins.substring 0 2 hex}:"
+          + "${builtins.substring 2 2 hex}:"
+          + "${builtins.substring 4 2 hex}:"
+          + "${builtins.substring 6 2 hex}";
+    in
+      {
+        sops.defaultSopsFile = ../${config.networking.hostName}/secrets.yaml;
+        sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+        microvm = {
+          hypervisor = "cloud-hypervisor";
+          vsock.cid = 3 + config.oxalab.vm.number;
+          interfaces =
+            [
+              {
+                type = "tap";
+                id = "uvm-${config.networking.hostName}";
+                mac = vmMac config.oxalab.vm.number;
+              }
+            ];
+          shares = [
+            {
+              source = "/nix/store";
+              mountPoint = "/nix/.ro-store";
+              tag = "store";
+              proto = "virtiofs";
+              socket = "store.socket";
+            }
+          ]
+          ++
+          map
+            (dir: {
+              source = dir;
+              mountPoint = "/${dir}";
+              tag = dir;
+              proto = "virtiofs";
+              socket = "${dir}.socket";
+            })
+            [
+              "etc"
+              "var"
+              "home"
+            ];
+        };
+
+        networking.useNetworkd = true;
+        networking.firewall.enable = lib.mkForce false; # firewalling done by the host
+
+        systemd.network = {
+          enable = true;
+          networks."11-host" = {
+            matchConfig.MACAddress = vmMac config.oxalab.vm.number;
+            networkConfig = {
+              Address = "10.99.99." + lib.toString (10 + config.oxalab.vm.number)  + "/24";
+              DHCP = "no";
+            };
+            routes = [
+              {
+                Gateway = "10.99.99.1";
+                Destination = "0.0.0.0/0";
+                Metric = 1024;
+              }
+            ];
+          };
+        };
+      };
+
+}
diff --git a/microvms/miniflux/default.nix b/microvms/miniflux/default.nix
index d2f024f..89235c1 100644
--- a/microvms/miniflux/default.nix
+++ b/microvms/miniflux/default.nix
@@ -1,13 +1,11 @@
 { config, lib, ... }:
-let
-  mac = "02:00:00:00:00:04";
-in
 {
   imports = [
+    ../lib
     ./miniflux.nix
   ];
-  sops.defaultSopsFile = ./secrets.yaml;
-  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  oxalab.vm.number = 4;
 
   sops.secrets = {
     "wg/0xa-proxy" = {
@@ -16,62 +14,10 @@ in
   };
 
   microvm = {
-    hypervisor = "cloud-hypervisor";
-    vsock.cid = 3 + 4;
     mem = 1 * 1024;
     vcpu = 2;
-    interfaces = [
-      {
-        type = "tap";
-        id = "uvm-miniflux";
-        mac = mac;
-      }
-    ];
-    shares = [
-      {
-        source = "/nix/store";
-        mountPoint = "/nix/.ro-store";
-        tag = "store";
-        proto = "virtiofs";
-        socket = "store.socket";
-      }
-    ]
-    ++
-      map
-        (dir: {
-          source = dir;
-          mountPoint = "/${dir}";
-          tag = dir;
-          proto = "virtiofs";
-          socket = "${dir}.socket";
-        })
-        [
-          "etc"
-          "var"
-          "home"
-        ];
   };
 
-  networking.useNetworkd = true;
-  networking.firewall.enable = lib.mkForce false; # firewalling done by the host
-
-  systemd.network = {
-    enable = true;
-    networks."11-host" = {
-      matchConfig.MACAddress = mac;
-      networkConfig = {
-        Address = "10.99.99.14/24";
-        DHCP = "no";
-      };
-      routes = [
-        {
-          Gateway = "10.99.99.1";
-          Destination = "0.0.0.0/0";
-          Metric = 1024;
-        }
-      ];
-    };
-  };
 
   networking.hostName = "miniflux";
   system.stateVersion = "24.11";
-- 
cgit v1.3.1