system/desktop
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

more sandbox config

Browse source
This commit is contained in:
root 2026-07-18 18:59:14 -03:00
parent 0f1a81c2aa
commit 6447486643
No known key found for this signature in database
6 changed files with 533 additions and 90 deletions
Download patch file Download diff file Expand all files Collapse all files

310
microvm/sandbox.nix
View file

@ -1,104 +1,234 @@
{
config,
pkgs,
lib,
impermanence,
sops-nix,
home-manager,
...
}:
let
impermanenceModule = impermanence.nixosModules.impermanence;
sopsModule = sops-nix.nixosModules.sops;
homeManagerModule = home-manager.nixosModules.home-manager;
in
{
microvm.host.useNotifySockets = true;
microvm.vms."sandbox" = {
config = {
users.users.root = {
password = "";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh"
config =
{
config,
pkgs,
lib,
...
}:
{
imports = [
impermanenceModule
sopsModule
homeManagerModule
];
};
users.users.sandbox = {
isNormalUser = true;
uid = 1001;
group = "users";
extraGroups = [
"video"
"render"
];
password = "";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh"
];
};
services.openssh.enable = true;
boot.kernelModules = [
"drm"
"virtio_gpu"
];
boot.blacklistedKernelModules = lib.mkForce [ ];
environment.sessionVariables = {
WAYLAND_DISPLAY = "wayland-1";
DISPLAY = ":0";
QT_QPA_PLATFORM = "wayland";
GDK_BACKEND = "wayland";
XDG_SESSION_TYPE = "wayland";
};
hardware.graphics.enable = true;
system.stateVersion = lib.trivial.release;
environment.systemPackages = with pkgs; [
xdg-utils
ungoogled-chromium
ghostty
tmux
waypipe
pciutils
];
microvm = {
vsock = {
cid = 3;
ssh.enable = true;
sops.defaultSopsFile = ./secrets/sandbox.yaml;
sops.age.keyFile = "/.persist/secrets/age-keys.txt";
sops.secrets."root-password-hash" = {
neededForUsers = true;
};
writableStoreOverlay = "/nix/.rw-store";
# graphics.enable = true;
mem = 4096;
interfaces = [
{
type = "user";
id = "vm-1";
mac = "02:00:00:01:01:01";
}
sops.secrets."sandbox-password-hash" = {
neededForUsers = true;
};
sops.secrets."deepseek-api-key" = {
owner = "sandbox";
mode = "0400";
};
fileSystems."/.persist".neededForBoot = true;
users.users.root = {
hashedPasswordFile = config.sops.secrets."root-password-hash".path;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh"
];
};
users.users.host = {
isNormalUser = true;
uid = 1000;
group = "users";
};
users.users.sandbox = {
isNormalUser = true;
uid = 1001;
group = "users";
extraGroups = [
"video"
"render"
];
hashedPasswordFile = config.sops.secrets."sandbox-password-hash".path;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh"
];
};
services.openssh.enable = true;
boot.kernelModules = [
"drm"
"virtio_gpu"
];
volumes = [
{
mountPoint = "/var";
image = "var.img";
size = 256;
}
{
mountPoint = "/nix/.rw-store";
image = "nix-store-overlay.img";
size = 512;
}
boot.blacklistedKernelModules = lib.mkForce [ ];
environment.sessionVariables = {
WAYLAND_DISPLAY = "wayland-1";
DISPLAY = ":0";
QT_QPA_PLATFORM = "wayland";
GDK_BACKEND = "wayland";
XDG_SESSION_TYPE = "wayland";
};
hardware.graphics.enable = true;
system.stateVersion = lib.trivial.release;
environment.systemPackages = with pkgs; [
xdg-utils
tmux
waypipe
opencode
fd
ripgrep
podman-compose
];
shares = [
{
proto = "virtiofs";
tag = "projects";
source = "/home/user/dev";
mountPoint = "/home/user/dev";
}
{
proto = "virtiofs";
tag = "ro-store";
source = "/nix/store";
mountPoint = "/nix/.ro-store";
readOnly = true;
}
];
hypervisor = "qemu";
environment.persistence."/.persist" = {
enable = true;
hideMounts = true;
users.sandbox = {
directories = [
".local/share/opencode"
".claude"
];
files = [
".claude.json"
];
};
};
home-manager = {
useGlobalPkgs = true;
users.sandbox = {
home.stateVersion = "26.11";
xdg.configFile."containers/containers.conf".text = ''
[engine]
compose_warning_logs=false
events_logger="file"
[containers]
log_driver="k8s-file"
'';
xdg.configFile."opencode/opencode.json".text = builtins.toJSON {
"$schema" = "https://opencode.ai/config.json";
provider = {
deepseek = {
npm = "@ai-sdk/openai-compatible";
name = "DeepSeek";
options = {
baseURL = "https://api.deepseek.com";
apiKey = "{file:${config.sops.secrets."deepseek-api-key".path}}";
};
models = {
"deepseek-v4-pro" = {
name = "DeepSeek-V4-Pro";
limit = {
context = 1048576;
output = 262144;
};
options = {
reasoningEffort = "high";
thinking.type = "enabled";
};
};
"deepseek-v4-flash" = {
name = "DeepSeek-V4-Flash";
limit = {
context = 1048576;
output = 262144;
};
options = {
reasoningEffort = "high";
thinking.type = "enabled";
};
};
};
};
};
};
};
};
virtualisation.containers.enable = true;
virtualisation.podman = {
enable = true;
dockerCompat = true;
defaultNetwork.settings.dns_enabled = true;
};
microvm = {
vsock = {
cid = 3;
ssh.enable = true;
};
writableStoreOverlay = "/nix/.rw-store";
# graphics.enable = true;
mem = 4096;
interfaces = [
{
type = "user";
id = "vm-1";
mac = "02:00:00:01:01:01";
}
];
volumes = [
{
mountPoint = "/var";
image = "var.img";
size = 256;
}
{
mountPoint = "/nix/.rw-store";
image = "nix-store-overlay.img";
size = 512;
}
{
mountPoint = "/.persist";
image = "persist.img";
size = 1;
}
];
shares = [
{
proto = "virtiofs";
tag = "projects";
source = "/home/user/dev";
mountPoint = "/home/sandbox/dev";
}
{
proto = "virtiofs";
tag = "work";
source = "/home/user/work";
mountPoint = "/home/sandbox/work";
}
{
proto = "virtiofs";
tag = "screenshots";
source = "/home/user/pictures";
mountPoint = "/home/sandbox/pictures";
readOnly = true;
}
{
proto = "virtiofs";
tag = "ro-store";
source = "/nix/store";
mountPoint = "/nix/.ro-store";
readOnly = true;
}
];
hypervisor = "qemu";
};
};
};
};
}