blob: 2cad795fd82d2dd28109764646fac823de00ee27 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
|
{ config, lib, ... }:
let
mac = "02:00:00:00:00:07";
in
{
imports = [
./navidrome.nix
];
sops.defaultSopsFile = ./secrets.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.secrets = {
"wg/0xa-proxy" = {
owner = config.users.users.systemd-network.name;
};
};
microvm = {
hypervisor = "cloud-hypervisor";
vsock.cid = 3 + 7;
mem = 3 * 1024;
vcpu = 2;
interfaces = [
{
type = "tap";
id = "uvm-stream";
mac = mac;
}
];
shares = [
{
source = "/nix/store";
mountPoint = "/nix/.ro-store";
tag = "store";
proto = "virtiofs";
}
]
++
map
(dir: {
source = dir;
mountPoint = "/${dir}";
tag = dir;
proto = "virtiofs";
})
[
"etc"
"var"
"home"
];
};
networking.useNetworkd = true;
networking.firewall.enable = lib.mkForce false; # firewalling done by the host
systemd.network = {
enable = true;
networks."11-host" = {
matchConfig.MACAddress = mac;
networkConfig = {
Address = "10.99.99.17/24";
DHCP = "no";
};
routes = [
{
Gateway = "10.99.99.1";
Destination = "0.0.0.0/0";
Metric = 1024;
}
];
};
};
networking.hostName = "stream";
system.stateVersion = "25.05";
}
|
