modules/desktop/virtualisation/qemu.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

{ pkgs, ... }:
{
  environment.systemPackages = with pkgs; [
    qemu_kvm
    qemu
  ];

  hardware.pulseaudio.extraConfig = ''
    load-module module-native-protocol-unix auth-group=qemu-libvirtd socket=/tmp/pulse-socket
  '';

  boot.kernelModules = [ "vfio-pci" ];

  networking.firewall.trustedInterfaces = [
    "virbr0"
    "br0"
  ];

  services.udev.extraRules = ''
    SUBSYSTEM=="vfio", OWNER="root", GROUP="kvm"
  '';

  virtualisation.libvirtd.qemu = {
    package = pkgs.qemu_kvm;
    runAsRoot = true;
    swtpm.enable = true;

    ovmf = {
      enable = true;

      packages = [
        (pkgs.OVMFFull.override {
          secureBoot = true;
          tpmSupport = true;
        }).fd
      ];
    };

    verbatimConfig = ''
      namespaces = []

      dynamic_ownership = 0
    '';
  };
}