os/hosts/chonk/libvirt-container.nix

{
  config,
  pkgs,
  ...
}: {
  networking.firewall.allowedTCPPorts = [4222];

  containers."libvirt-container" = {
    autoStart = true;

    bindMounts."/dev/kvm" = {
      hostPath = "/dev/kvm";
      isReadOnly = false;
    };

    allowedDevices = [
      {
        node = "/dev/kvm";
        modifier = "rw";
      }
      {
        node = "/dev/net/tun";
        modifier = "rw";
      }
      {
        node = "/dev/vnet*";
        modifier = "rw";
      }
    ];

    forwardPorts = [
      {
        hostPort = 4222;
      }
    ];

    enableTun = true;

    #extraFlags = [ "-U" ];

    config = {
      config,
      pkgs,
      ...
    }: {
      networking.firewall.enable = false;

      virtualisation.libvirtd.enable = true;
      security.polkit.enable = true;

      services.openssh = {
        enable = true;
        ports = [4222];
      };

      users.users.root = {
        openssh.authorizedKeys.keys = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAqkqMYgncrnczcW/0PY+Z+FmNXXpgw6D9JWTTwiainy hensoko@hensoko-tp-work"
          "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFro/k4Mgqyh8yV/7Zwjc0dv60ZM7bROBU9JNd99P/4co6fxPt1pJiU/pEz2Dax/HODxgcO+jFZfvPEuLMCeAl0= YubiKey #10593996 PIV Slot 9a @teutat3s"
        ];
      };

      system.stateVersion = "22.11";
    };
  };
}