Allow disabling QEMU VM-specific options

This commit is contained in:
Nicolas Jeannerod 2025-02-12 11:03:25 +01:00 committed by Kiara Grouwstra
parent 8d2bda17f1
commit 0d8d418a91
Signed by: kiara
SSH key fingerprint: SHA256:COspvLoLJ5WC5rFb9ZDe5urVCkK4LJZOsjfF4duRJFU
2 changed files with 79 additions and 49 deletions

View file

@ -1,62 +1,84 @@
{ modulesPath, ... }:
{ config, lib, ... }:
let
inherit (lib) mkIf mkMerge;
in
{
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
config = mkMerge [
{
boot.loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
}
boot = {
loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
(mkIf config.procolixVm.isQemuVm {
initrd = {
availableKernelModules = [
"ata_piix"
"uhci_hcd"
"virtio_pci"
"virtio_scsi"
"sd_mod"
"sr_mod"
];
kernelModules = [ "dm-snapshot" ];
};
};
boot.initrd = {
availableKernelModules = [
"ata_piix"
"uhci_hcd"
"sd_mod"
"sr_mod"
disko.devices.disk.main = {
device = "/dev/sda";
type = "disk";
# from `/profiles/qemu-guest.nix`
"virtio_net"
"virtio_pci"
"virtio_mmio"
"virtio_blk"
"virtio_scsi"
"9p"
"9pnet_virtio"
];
kernelModules = [
"dm-snapshot"
content = {
type = "gpt";
# from `/profiles/qemu-guest.nix`
"virtio_balloon"
"virtio_console"
"virtio_rng"
"virtio_gpu"
];
};
partitions = {
MBR = {
priority = 0;
size = "1M";
type = "EF02";
};
disko.devices.disk.main = {
device = "/dev/sda";
type = "disk";
ESP = {
priority = 1;
size = "500M";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
};
};
content = {
type = "gpt";
root = {
priority = 2;
size = "100%";
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/";
partitions = {
MBR = {
priority = 0;
size = "1M";
type = "EF02";
};
ESP = {
priority = 1;
size = "500M";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
};
};
root = {
priority = 2;
size = "100%";
content = {
type = "filesystem";
format = "ext4";
mountpoint = "/";
};
};
};
};
};
};
};
})
];
}

View file

@ -175,5 +175,13 @@ in
this for testing machines, as it is a security hole for so many reasons.
'';
};
isQemuVm = mkOption {
description = ''
Whether the machine is a QEMU VM. This will import all the necessary
things.
'';
default = true;
};
};
}