mkSandboxSystem: make restricted network optional

1 files changed, 4 insertions, 2 deletions

diff --git a/lib/mk-sandbox-system.nix b/lib/mk-sandbox-system.nix
index a840dbe..bbe0238 100644
--- a/lib/mk-sandbox-system.nix
+++ b/lib/mk-sandbox-system.nix
@@ -3,6 +3,7 @@
 , name ? "sandbox"
 , user ? "dummy"
 , config ? { }
+, restrictNetwork ? true  # to be replaced with virtualisation.restrictNetwork
 }:
 
 with nixpkgs.lib;
@@ -70,13 +71,14 @@ in rec {
 
   apps.${name} = {
     type = "app";
-    program = toString (pkgs.writeShellScript "sandbox-vm" ''
+    program = toString (pkgs.writeShellScript "sandbox-vm" (
+    (pkgs.lib.optionalString restrictNetwork ''
       # Isolate from network
       # Stopgap solution until this is merged:
       # https://github.com/NixOS/nixpkgs/pull/200225
       QEMU_NET_OPTS="restrict=yes,''${QEMU_NET_OPTS:+,$QEMU_NET_OPTS}"
       export QEMU_NET_OPTS
-
+    '') + ''
       # Save current directory for mounting in VM
       SHARED_CWD=$PWD
       export SHARED_CWD