more sandbox config
This commit is contained in:
root
parent
0f1a81c2aa
commit
6447486643
6 changed files with 533 additions and 90 deletions
|
|
@ -1,104 +1,234 @@
|
|||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
impermanence,
|
||||
sops-nix,
|
||||
home-manager,
|
||||
...
|
||||
}:
|
||||
let
|
||||
impermanenceModule = impermanence.nixosModules.impermanence;
|
||||
sopsModule = sops-nix.nixosModules.sops;
|
||||
homeManagerModule = home-manager.nixosModules.home-manager;
|
||||
in
|
||||
{
|
||||
microvm.host.useNotifySockets = true;
|
||||
microvm.vms."sandbox" = {
|
||||
config = {
|
||||
users.users.root = {
|
||||
password = "";
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh"
|
||||
config =
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [
|
||||
impermanenceModule
|
||||
sopsModule
|
||||
homeManagerModule
|
||||
];
|
||||
};
|
||||
users.users.sandbox = {
|
||||
isNormalUser = true;
|
||||
uid = 1001;
|
||||
group = "users";
|
||||
extraGroups = [
|
||||
"video"
|
||||
"render"
|
||||
];
|
||||
password = "";
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh"
|
||||
];
|
||||
};
|
||||
services.openssh.enable = true;
|
||||
|
||||
boot.kernelModules = [
|
||||
"drm"
|
||||
"virtio_gpu"
|
||||
];
|
||||
boot.blacklistedKernelModules = lib.mkForce [ ];
|
||||
|
||||
environment.sessionVariables = {
|
||||
WAYLAND_DISPLAY = "wayland-1";
|
||||
DISPLAY = ":0";
|
||||
QT_QPA_PLATFORM = "wayland";
|
||||
GDK_BACKEND = "wayland";
|
||||
XDG_SESSION_TYPE = "wayland";
|
||||
};
|
||||
|
||||
hardware.graphics.enable = true;
|
||||
system.stateVersion = lib.trivial.release;
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
xdg-utils
|
||||
ungoogled-chromium
|
||||
ghostty
|
||||
tmux
|
||||
waypipe
|
||||
pciutils
|
||||
];
|
||||
|
||||
microvm = {
|
||||
vsock = {
|
||||
cid = 3;
|
||||
ssh.enable = true;
|
||||
sops.defaultSopsFile = ./secrets/sandbox.yaml;
|
||||
sops.age.keyFile = "/.persist/secrets/age-keys.txt";
|
||||
sops.secrets."root-password-hash" = {
|
||||
neededForUsers = true;
|
||||
};
|
||||
writableStoreOverlay = "/nix/.rw-store";
|
||||
# graphics.enable = true;
|
||||
mem = 4096;
|
||||
interfaces = [
|
||||
{
|
||||
type = "user";
|
||||
id = "vm-1";
|
||||
mac = "02:00:00:01:01:01";
|
||||
}
|
||||
sops.secrets."sandbox-password-hash" = {
|
||||
neededForUsers = true;
|
||||
};
|
||||
sops.secrets."deepseek-api-key" = {
|
||||
owner = "sandbox";
|
||||
mode = "0400";
|
||||
};
|
||||
|
||||
fileSystems."/.persist".neededForBoot = true;
|
||||
|
||||
users.users.root = {
|
||||
hashedPasswordFile = config.sops.secrets."root-password-hash".path;
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh"
|
||||
];
|
||||
};
|
||||
users.users.host = {
|
||||
isNormalUser = true;
|
||||
uid = 1000;
|
||||
group = "users";
|
||||
};
|
||||
users.users.sandbox = {
|
||||
isNormalUser = true;
|
||||
uid = 1001;
|
||||
group = "users";
|
||||
extraGroups = [
|
||||
"video"
|
||||
"render"
|
||||
];
|
||||
hashedPasswordFile = config.sops.secrets."sandbox-password-hash".path;
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh"
|
||||
];
|
||||
};
|
||||
services.openssh.enable = true;
|
||||
|
||||
boot.kernelModules = [
|
||||
"drm"
|
||||
"virtio_gpu"
|
||||
];
|
||||
volumes = [
|
||||
{
|
||||
mountPoint = "/var";
|
||||
image = "var.img";
|
||||
size = 256;
|
||||
}
|
||||
{
|
||||
mountPoint = "/nix/.rw-store";
|
||||
image = "nix-store-overlay.img";
|
||||
size = 512;
|
||||
}
|
||||
boot.blacklistedKernelModules = lib.mkForce [ ];
|
||||
|
||||
environment.sessionVariables = {
|
||||
WAYLAND_DISPLAY = "wayland-1";
|
||||
DISPLAY = ":0";
|
||||
QT_QPA_PLATFORM = "wayland";
|
||||
GDK_BACKEND = "wayland";
|
||||
XDG_SESSION_TYPE = "wayland";
|
||||
};
|
||||
|
||||
hardware.graphics.enable = true;
|
||||
system.stateVersion = lib.trivial.release;
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
xdg-utils
|
||||
tmux
|
||||
waypipe
|
||||
opencode
|
||||
fd
|
||||
ripgrep
|
||||
podman-compose
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
proto = "virtiofs";
|
||||
tag = "projects";
|
||||
source = "/home/user/dev";
|
||||
mountPoint = "/home/user/dev";
|
||||
}
|
||||
{
|
||||
proto = "virtiofs";
|
||||
tag = "ro-store";
|
||||
source = "/nix/store";
|
||||
mountPoint = "/nix/.ro-store";
|
||||
readOnly = true;
|
||||
}
|
||||
];
|
||||
hypervisor = "qemu";
|
||||
|
||||
environment.persistence."/.persist" = {
|
||||
enable = true;
|
||||
hideMounts = true;
|
||||
users.sandbox = {
|
||||
directories = [
|
||||
".local/share/opencode"
|
||||
".claude"
|
||||
];
|
||||
files = [
|
||||
".claude.json"
|
||||
];
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
home-manager = {
|
||||
useGlobalPkgs = true;
|
||||
users.sandbox = {
|
||||
home.stateVersion = "26.11";
|
||||
xdg.configFile."containers/containers.conf".text = ''
|
||||
[engine]
|
||||
compose_warning_logs=false
|
||||
events_logger="file"
|
||||
|
||||
[containers]
|
||||
log_driver="k8s-file"
|
||||
'';
|
||||
xdg.configFile."opencode/opencode.json".text = builtins.toJSON {
|
||||
"$schema" = "https://opencode.ai/config.json";
|
||||
provider = {
|
||||
deepseek = {
|
||||
npm = "@ai-sdk/openai-compatible";
|
||||
name = "DeepSeek";
|
||||
options = {
|
||||
baseURL = "https://api.deepseek.com";
|
||||
apiKey = "{file:${config.sops.secrets."deepseek-api-key".path}}";
|
||||
};
|
||||
models = {
|
||||
"deepseek-v4-pro" = {
|
||||
name = "DeepSeek-V4-Pro";
|
||||
limit = {
|
||||
context = 1048576;
|
||||
output = 262144;
|
||||
};
|
||||
options = {
|
||||
reasoningEffort = "high";
|
||||
thinking.type = "enabled";
|
||||
};
|
||||
};
|
||||
"deepseek-v4-flash" = {
|
||||
name = "DeepSeek-V4-Flash";
|
||||
limit = {
|
||||
context = 1048576;
|
||||
output = 262144;
|
||||
};
|
||||
options = {
|
||||
reasoningEffort = "high";
|
||||
thinking.type = "enabled";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation.containers.enable = true;
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
defaultNetwork.settings.dns_enabled = true;
|
||||
};
|
||||
microvm = {
|
||||
vsock = {
|
||||
cid = 3;
|
||||
ssh.enable = true;
|
||||
};
|
||||
writableStoreOverlay = "/nix/.rw-store";
|
||||
# graphics.enable = true;
|
||||
mem = 4096;
|
||||
interfaces = [
|
||||
{
|
||||
type = "user";
|
||||
id = "vm-1";
|
||||
mac = "02:00:00:01:01:01";
|
||||
}
|
||||
];
|
||||
volumes = [
|
||||
{
|
||||
mountPoint = "/var";
|
||||
image = "var.img";
|
||||
size = 256;
|
||||
}
|
||||
{
|
||||
mountPoint = "/nix/.rw-store";
|
||||
image = "nix-store-overlay.img";
|
||||
size = 512;
|
||||
}
|
||||
{
|
||||
mountPoint = "/.persist";
|
||||
image = "persist.img";
|
||||
size = 1;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
proto = "virtiofs";
|
||||
tag = "projects";
|
||||
source = "/home/user/dev";
|
||||
mountPoint = "/home/sandbox/dev";
|
||||
}
|
||||
{
|
||||
proto = "virtiofs";
|
||||
tag = "work";
|
||||
source = "/home/user/work";
|
||||
mountPoint = "/home/sandbox/work";
|
||||
}
|
||||
{
|
||||
proto = "virtiofs";
|
||||
tag = "screenshots";
|
||||
source = "/home/user/pictures";
|
||||
mountPoint = "/home/sandbox/pictures";
|
||||
readOnly = true;
|
||||
}
|
||||
{
|
||||
proto = "virtiofs";
|
||||
tag = "ro-store";
|
||||
source = "/nix/store";
|
||||
mountPoint = "/nix/.ro-store";
|
||||
readOnly = true;
|
||||
}
|
||||
];
|
||||
hypervisor = "qemu";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
18
microvm/secrets/sandbox.yaml
Normal file
18
microvm/secrets/sandbox.yaml
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
root-password-hash: ENC[AES256_GCM,data:YTQn1UGwgrlCD381u+Z7xXMgUoigKXp+Na1/Aj0GExikEeIs9SkBIcAyQ2Dw0FimL0wgG4z+AxFhdAnzRHcbecvvb3tRrTX3VjFt+CLPWscZar1jjNesPyV1inXI2IFW06twHbAl4oQHFQ==,iv:Va0B4aFUlavJd3AGzDbAnmAnAX3fEow4ByIQzfPbheM=,tag:OIjXY7ngZow7Y3tRFZ8iiA==,type:str]
|
||||
sandbox-password-hash: ENC[AES256_GCM,data:bxVKDAsk6ao0D+xIgAR2Sh1msoPJGEE8P0+O9YGZS/F+DZl33r/JQbNFYJzZgbHDqzLDbab0tnzyRwbfepT2eV/KWaroQDFcBCLJ07t4lTOtdJ3mR/dB1UftrCvvmoPubVrguDPvftQLAg==,iv:tDErYBYhfPrOKyH7W41SUAFgT54bA7QvUYmo35GWMIs=,tag:vNJVKrlCwCuZl4z8KFby2Q==,type:str]
|
||||
deepseek-api-key: ENC[AES256_GCM,data:pzg/7L92Ig+m3nhZBiYFSfdLuJFmamWWmPQwMxmctRS2kVQ=,iv:yCu+kPXkOxhfpVLlOvUpB/BwygedRaJviPe2D0tCW78=,tag:YTM7hx4UdZEsB9qfXs5LXQ==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzQXlvQWl3aWtSWjU5QWVN
|
||||
K3JGSzg0RElZSkVxNWFmTDNMNzVHckFuZkM4CnJiVDFDTTZ3cDBrTG5RR2RTR3A0
|
||||
RmdDSVA1T1dDbUZTNWJQNzB1K0dhYnMKLS0tIDk3VVJBSUFLVjMrdzV5MTFzRXlF
|
||||
N0ZZa3JnSXN2bHdLa1hoVFlmSUhXWWMK5JCznoaqS6svxcBl6UF9XqbfirZ9L2np
|
||||
/CTlYyWRadRvRmxrNkYNdgGn4V+is9FG+Et0u8JHAMvI7x/+W99yGA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1mr42xh9llvrggrvuawr5253qk7gygf4gcg9clqdvjecw3d6tj59qsqxswd
|
||||
lastmodified: "2026-07-18T18:23:56Z"
|
||||
mac: ENC[AES256_GCM,data:d/vRaH5vFzTkb8WopwIDb9Ku7n0EXUR5PyE/fmYhDWcCGX71PcM23Y1DPX1SCY6ydnpxqtGxfRiJOZMfIAx+tCBKX5Szj2aPnKXpogtukZbWWT4pF5jYWnlXcA9R7b9CY0sSAXIetyKhAaH086PJ2i2tAx8TiqZNkUFyoR6g0+E=,iv:R+cOmhYJnVPMjaiL5J0zbFUR69sNR78Gz5ea3CV6X6Y=,tag:RlaTyampHdMtmzvHskM4Dw==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.1
|
||||
Loading…
Add table
Add a link
Reference in a new issue