desktop/microvm/sandbox.nix

{
  impermanence,
  sops-nix,
  home-manager,
  ...
}:
let
  impermanenceModule = impermanence.nixosModules.impermanence;
  sopsModule = sops-nix.nixosModules.sops;
  homeManagerModule = home-manager.nixosModules.home-manager;
in
{
  microvm.host.useNotifySockets = true;
  microvm.vms."sandbox" = {
    config =
      {
        config,
        pkgs,
        lib,
        ...
      }:
      {
        imports = [
          impermanenceModule
          sopsModule
          homeManagerModule
        ];

        nix.settings.experimental-features = [
          "nix-command"
          "flakes"
        ];
        nix.nixPath = [ "nixpkgs=${pkgs.path}" ];
        nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

        sops.defaultSopsFile = ./secrets/sandbox.yaml;
        sops.age.keyFile = "/.persist/secrets/age-keys.txt";
        sops.secrets."root-password-hash" = {
          neededForUsers = true;
        };
        sops.secrets."sandbox-password-hash" = {
          neededForUsers = true;
        };
        sops.secrets."deepseek-api-key" = {
          owner = "sandbox";
          mode = "0400";
        };

        fileSystems."/.persist".neededForBoot = true;

        users.users.root = {
          hashedPasswordFile = config.sops.secrets."root-password-hash".path;
          openssh.authorizedKeys.keys = [
            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh"
          ];
        };
        users.users.host = {
          isNormalUser = true;
          uid = 1000;
          group = "users";
        };
        users.users.sandbox = {
          isNormalUser = true;
          uid = 1001;
          group = "users";
          extraGroups = [
            "video"
            "render"
          ];
          hashedPasswordFile = config.sops.secrets."sandbox-password-hash".path;
          openssh.authorizedKeys.keys = [
            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh"
          ];
        };
        services.openssh.enable = true;

        boot.kernelModules = [
          "drm"
          "virtio_gpu"
        ];
        boot.blacklistedKernelModules = lib.mkForce [ ];

        environment.sessionVariables = {
          WAYLAND_DISPLAY = "wayland-1";
          DISPLAY = ":0";
          QT_QPA_PLATFORM = "wayland";
          GDK_BACKEND = "wayland";
          XDG_SESSION_TYPE = "wayland";
        };

        hardware.graphics.enable = true;
        system.stateVersion = lib.trivial.release;

        environment.systemPackages = with pkgs; [
          xdg-utils
          tmux
          waypipe
          opencode
          fd
          ripgrep
          podman-compose
          claude-code
        ];

        environment.persistence."/.persist" = {
          enable = true;
          hideMounts = true;
          users.sandbox = {
            directories = [
              ".local/share/opencode"
              ".claude"
            ];
            files = [
              ".claude.json"
            ];
          };

        };

        home-manager = {
          useGlobalPkgs = true;
          users.sandbox = {
            home.stateVersion = "26.11";
            xdg.configFile."containers/containers.conf".text = ''
              [engine]
              compose_warning_logs=false
              events_logger="file"

              [containers]
              log_driver="k8s-file"
            '';
            xdg.configFile."opencode/opencode.json".text = builtins.toJSON {
              "$schema" = "https://opencode.ai/config.json";
              provider = {
                deepseek = {
                  npm = "@ai-sdk/openai-compatible";
                  name = "DeepSeek";
                  options = {
                    baseURL = "https://api.deepseek.com";
                    apiKey = "{file:${config.sops.secrets."deepseek-api-key".path}}";
                  };
                  models = {
                    "deepseek-v4-pro" = {
                      name = "DeepSeek-V4-Pro";
                      limit = {
                        context = 1048576;
                        output = 262144;
                      };
                      options = {
                        reasoningEffort = "high";
                        thinking.type = "enabled";
                      };
                    };
                    "deepseek-v4-flash" = {
                      name = "DeepSeek-V4-Flash";
                      limit = {
                        context = 1048576;
                        output = 262144;
                      };
                      options = {
                        reasoningEffort = "high";
                        thinking.type = "enabled";
                      };
                    };
                  };
                };
              };
            };
          };
        };

        virtualisation.containers.enable = true;
        virtualisation.podman = {
          enable = true;
          dockerCompat = true;
          defaultNetwork.settings.dns_enabled = true;
        };
        microvm = {
          vsock = {
            cid = 3;
            ssh.enable = true;
          };
          writableStoreOverlay = "/nix/.rw-store";
          # graphics.enable = true;
          mem = 4096;
          interfaces = [
            {
              type = "user";
              id = "vm-1";
              mac = "02:00:00:01:01:01";
            }
          ];
          volumes = [
            {
              mountPoint = "/var";
              image = "var.img";
              size = 2 * 1024;
            }
            {
              mountPoint = "/nix/.rw-store";
              image = "nix-store-overlay.img";
              size = 2 * 1024;
            }
            {
              mountPoint = "/.persist";
              image = "persist.img";
              size = 2 * 1024;
            }
          ];
          shares = [
            {
              proto = "virtiofs";
              tag = "projects";
              source = "/home/user/dev";
              mountPoint = "/home/sandbox/dev";
            }
            {
              proto = "virtiofs";
              tag = "work";
              source = "/home/user/work";
              mountPoint = "/home/sandbox/work";
            }
            {
              proto = "virtiofs";
              tag = "nixos";
              source = "/etc/nixos";
              mountPoint = "/etc/nixos";
            }
            {
              proto = "virtiofs";
              tag = "screenshots";
              source = "/home/user/pictures";
              mountPoint = "/home/sandbox/pictures";
              readOnly = true;
            }
            {
              proto = "virtiofs";
              tag = "ro-store";
              source = "/nix/store";
              mountPoint = "/nix/.ro-store";
              readOnly = true;
            }
          ];
          hypervisor = "qemu";
        };
      };
  };
}