2026-07-25

configuration.nix

@@ -9,18 +9,18 @@
   ...
 }:
 {
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+
   sops.defaultSopsFile = ./secrets/home.yaml;
   sops.age.keyFile = "/.persist/root/.config/sops/age/keys.txt";
   sops.secrets."root/ssh/desktop" = {
     path = "/root/.ssh/desktop";
     mode = "0600";
   };
-  nix.settings.experimental-features = [
-    "nix-command"
-    "flakes"
-  ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 
   boot.initrd.systemd.enable = true;
   boot.loader.systemd-boot.enable = true;

kernel/default.nix

@@ -56,6 +56,7 @@ in
         keepEnv = true;
         persist = true;
         setEnv = [
+          "HOME=/root"
           "EDITOR"
           "TERM"
         ];

microvm/sandbox.nix

@@ -26,6 +26,13 @@ in
           homeManagerModule
         ];
 
+        nix.settings.experimental-features = [
+          "nix-command"
+          "flakes"
+        ];
+        nix.nixPath = [ "nixpkgs=${pkgs.path}" ];
+        nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+
         sops.defaultSopsFile = ./secrets/sandbox.yaml;
         sops.age.keyFile = "/.persist/secrets/age-keys.txt";
         sops.secrets."root-password-hash" = {
@@ -187,17 +194,17 @@ in
             {
               mountPoint = "/var";
               image = "var.img";
-              size = 256;
+              size = 2 * 1024;
             }
             {
               mountPoint = "/nix/.rw-store";
               image = "nix-store-overlay.img";
-              size = 512;
+              size = 2 * 1024;
             }
             {
               mountPoint = "/.persist";
               image = "persist.img";
-              size = 1;
+              size = 2 * 1024;
             }
           ];
           shares = [

networking.nix

@@ -19,6 +19,7 @@
   services.tailscale-netns = {
     enable = true;
     instances.work = {
+      extraDaemonFlags = [ "--accept-routes=false" ];
     };
   };