1 files changed, 88 insertions, 0 deletions

diff --git a/lib/mk-sandbox-system.nix b/lib/mk-sandbox-system.nix
new file mode 100644
index 0000000..6135a01
--- /dev/null
+++ b/lib/mk-sandbox-system.nix
@@ -0,0 +1,88 @@
+{ nixpkgs
+, system
+, name ? "sandbox"
+, user ? "dummy"
+, config ? { }
+}:
+
+with nixpkgs.lib;
+
+let
+  pkgs = import nixpkgs { inherit system; };
+
+in rec {
+
+  nixosConfigurations.${name} = nixosSystem {
+    inherit system;
+
+    modules = [
+      (nixpkgs + "/nixos/modules/profiles/minimal.nix")
+      { environment.noXlibs = false; }  # avoid mass rebuild
+
+      (nixpkgs + "/nixos/modules/profiles/qemu-guest.nix")
+      (nixpkgs + "/nixos/modules/virtualisation/qemu-vm.nix")
+
+      ({ config, lib, pkgs, ... }: {
+
+        system.stateVersion = mkDefault "22.05";
+
+        networking = {
+          hostName = name;
+          firewall.enable = mkDefault false;
+        };
+
+        users.users.${user} = {
+          isNormalUser = mkDefault true;
+          password = mkDefault "";
+          extraGroups = mkDefault [ "wheel" ];
+        };
+
+        security.sudo.wheelNeedsPassword = mkDefault false;
+
+        services.getty = {
+          autologinUser = mkDefault user;
+          helpLine = mkDefault ''
+            Press <CTRL-a> <x> to terminate the virtual machine.
+            The working directory on the host is mounted to /mnt.
+          '';
+        };
+
+        virtualisation = {
+          graphics = mkDefault false;
+          diskImage = mkDefault "$(mktemp).qcow2";
+
+          sharedDirectories.host = {
+            source = "$SHARED_CWD";
+            target = "/mnt";
+          };
+
+          # Uncomment when this is merged:
+          # https://github.com/NixOS/nixpkgs/pull/200225
+          #restrictNetwork = mkDefault true;
+        };
+      })
+
+      config
+    ];
+  };
+
+  packages.${name} = nixosConfigurations.${name}.config.system.build.vm;
+
+  apps.${name} = {
+    type = "app";
+    program = toString (pkgs.writeShellScript "sandbox-vm" ''
+      # Isolate from network
+      # Stopgap solution until this is merged:
+      # https://github.com/NixOS/nixpkgs/pull/200225
+      QEMU_NET_OPTS="restrict=yes,''${QEMU_NET_OPTS:+,$QEMU_NET_OPTS}"
+      export QEMU_NET_OPTS
+
+      # Save current directory for mounting in VM
+      SHARED_CWD=$PWD
+      export SHARED_CWD
+
+      ${packages.${name}}/bin/run-${name}-vm
+    '');
+  };
+
+}