1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
|
flake:
{ pkgs
, name ? "sandbox"
, user ? "dummy"
, config ? { }
, tools ? []
, envVars ? { }
}@params:
let
shellLib = flake.lib.shell { inherit pkgs; };
print = rec {
printSharedDir = name: { source, target, ... }: ''
echo -en ${shellLib.fmt.keyword target}": "
echo ${pkgs.lib.escapeShellArg source}
'';
printSharedDirs = sharedDirs: ''
${shellLib.fmt.printSectionTitle "SHARED DIRECTORIES (guest: host)"}
${shellLib.mapAttrsToLines printSharedDir sharedDirs}
'';
formatAddrPort = { address, port }: "${address}:${toString port}";
printForwardedPort = { from, proto, host, guest, }:
if from == "host" then ''
echo -n ${proto}' '
echo -en ${shellLib.fmt.keyword (formatAddrPort host)}
echo -n ' -> '
echo ${formatAddrPort guest}
'' else ''
echo -n ${proto}' '
echo -n ${formatAddrPort host}
echo -n ' <- '
echo -e ${shellLib.fmt.keyword (formatAddrPort guest)}
'';
printForwardedPorts = portForwards: ''
${shellLib.fmt.printSectionTitle "FORWARDED PORTS (host <-> guest)"}
${pkgs.lib.concatMapStringsSep "\n" printForwardedPort portForwards}
'';
printNetworkRestricted = isRestricted:
if isRestricted then "Restricted" else "Unrestricted";
printNetworkAllowed = isRestricted:
if isRestricted then "disallowed" else "allowed";
printRestrictedNetwork = isRestricted: ''
${shellLib.fmt.printSectionTitle "NETWORK ACCESS"}
echo -en ${shellLib.fmt.keyword (printNetworkRestricted isRestricted)}
echo -n ': local network and internet access '
echo ${printNetworkAllowed isRestricted}.
'';
};
in rec {
nixosConfigurations.${name} = pkgs.nixos
({ modulesPath, config, lib, pkgs, ... }: {
imports = [
(modulesPath + "/profiles/minimal.nix")
{ environment.noXlibs = false; } # avoid mass rebuild
(modulesPath + "/profiles/qemu-guest.nix")
(modulesPath + "/virtualisation/qemu-vm.nix")
params.config
];
system.stateVersion = lib.mkDefault lib.trivial.release;
networking = {
hostName = name;
firewall.enable = lib.mkDefault false;
};
users.users.${user} = {
isNormalUser = lib.mkDefault true;
password = lib.mkDefault "";
extraGroups = lib.mkDefault [ "wheel" ];
};
security.sudo.wheelNeedsPassword = lib.mkDefault false;
services.getty = {
autologinUser = lib.mkDefault user;
helpLine = lib.mkDefault ''
Press <CTRL-a> <x> to terminate the virtual machine.
'';
};
environment = {
variables = envVars;
systemPackages = tools;
interactiveShellInit = lib.mkBefore ''
${shellLib.ifSomeAttrs envVars shellLib.printEnvVars}
${shellLib.ifSomeList tools shellLib.printBins}
${shellLib.ifSomeAttrs config.virtualisation.sharedDirectories
print.printSharedDirs}
${shellLib.ifSomeList config.virtualisation.forwardPorts
print.printForwardedPorts}
${print.printRestrictedNetwork config.virtualisation.restrictNetwork}
'';
};
virtualisation = {
graphics = lib.mkDefault false;
diskImage = lib.mkDefault "$TMP_DISK";
sharedDirectories.host = {
source = "$SHARED_CWD";
target = "/mnt";
};
restrictNetwork = lib.mkDefault true;
};
});
packages.${name} = nixosConfigurations.${name}.config.system.build.vm;
apps.${name} = {
type = "app";
program = pkgs.lib.getExe (pkgs.writeShellScriptBin "sandbox-vm" (''
# Save current directory for mounting in VM
SHARED_CWD=$PWD
export SHARED_CWD
TMP_DISK="$(mktemp).qcow2"
export TMP_DISK
trap "rm -f \"$TMP_DISK\"" EXIT
${packages.${name}}/bin/run-${name}-vm
reset
echo "Exited virtual machine."
''));
};
}
|