alexion
e7d7eb14e1
Add a third auto-loaded kind beside the host and the module: the guest, a reusable definition under guests/ that a host enables like a module and that realizes its interior as a systemd-nspawn nested container. Split the shared base config so a guest can stand on it. base.nix now holds the substrate both bases share — the primary user, home-manager, and the unstable/stable overlays. system.nix keeps the host-only machinery, and a new guest.nix is the slim guest-base: it imports the full modules tree, pins the interior release, and auto-enables the toolkit bundle and SSH so any guest is workable on sight. Give modules.ssh a guest flavor. A host restores its host keys from secrets as before, while a guest sets hostKeys.restore = false, names no sops files, and self-generates a host key, so it holds no age key of its own. The lib grows a guest helper that declares the guests.<path> namespace with an enable and a backend field. Only the container backend is built; microvm is a reserved value that trips a clear build-time assertion rather than silently building nothing. A sample guest exercises the whole path, and neogaia enables it, so the guest interior builds through the existing nix flake check seam.
32 lines
1.1 KiB
Nix
32 lines
1.1 KiB
Nix
{
|
|
my,
|
|
inputs,
|
|
lib,
|
|
...
|
|
}:
|
|
# The guest-base: the slim foundation every nested guest's interior stands on.
|
|
# It imports the full modules tree so any module is available to enable inside a
|
|
# guest, and stands on the same shared base a host does.
|
|
{
|
|
imports = my.collectNixFiles (inputs.self + "/modules") ++ [
|
|
(inputs.self + "/base.nix")
|
|
|
|
# The modules tree reaches for these option namespaces, so they must be
|
|
# declared for the tree to evaluate even where a guest leaves them off.
|
|
inputs.sops-nix.nixosModules.sops
|
|
inputs.stylix.nixosModules.stylix
|
|
];
|
|
|
|
# A nested container has no per-host `default.nix` to pin its release.
|
|
system.stateVersion = "26.05";
|
|
|
|
# The baseline toolset and SSH access, so any guest shelled into is a workable
|
|
# environment without per-guest wiring.
|
|
modules.toolkit.enable = lib.mkDefault true;
|
|
modules.ssh.enable = lib.mkDefault true;
|
|
|
|
# A guest carries no host identity, so it presents a self-generated host key
|
|
# rather than restoring one from secrets.
|
|
modules.ssh.hostKeys.restore = lib.mkDefault false;
|
|
}
|