···

       
325
       
 
       
      hydron = 298;

     

       
326
       
 
       
      cfssl = 299;

     

       
327
       
 
       
      cassandra = 300;

     

       
0
       
 
       

     

       
328
       
 
       


     

       
329
       
 
       
      # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!

     

       
330
       
 
       


     
···

       
610
       
 
       
      hydron = 298;

     

       
611
       
 
       
      cfssl = 299;

     

       
612
       
 
       
      cassandra = 300;

     

       
0
       
 
       

     

       
613
       
 
       


     

       
614
       
 
       
      # When adding a gid, make sure it doesn't match an existing

     

       
615
       
 
       
      # uid. Users and groups with the same name should have equal

     

···

       
325
       
 
       
      hydron = 298;

     

       
326
       
 
       
      cfssl = 299;

     

       
327
       
 
       
      cassandra = 300;

     

       
328
       
+
       
      qemu-libvirtd = 301;

     

       
329
       
 
       


     

       
330
       
 
       
      # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!

     

       
331
       
 
       


     
···

       
611
       
 
       
      hydron = 298;

     

       
612
       
 
       
      cfssl = 299;

     

       
613
       
 
       
      cassandra = 300;

     

       
614
       
+
       
      qemu-libvirtd = 301;

     

       
615
       
 
       


     

       
616
       
 
       
      # When adding a gid, make sure it doesn't match an existing

     

       
617
       
 
       
      # uid. Users and groups with the same name should have equal

     

···

       
17
       
 
       
    ${optionalString cfg.qemuOvmf ''

     

       
18
       
 
       
      nvram = ["/run/libvirt/nix-ovmf/OVMF_CODE.fd:/run/libvirt/nix-ovmf/OVMF_VARS.fd"]

     

       
19
       
 
       
    ''}

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
20
       
 
       
    ${cfg.qemuVerbatimConfig}

     

       
21
       
 
       
  '';

     

       
22
       
 
       


     
···

       
56
       
 
       
      '';

     

       
57
       
 
       
    };

     

       
58
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
59
       
 
       
    virtualisation.libvirtd.qemuVerbatimConfig = mkOption {

     

       
60
       
 
       
      type = types.lines;

     

       
61
       
 
       
      default = ''

     
···

       
109
       
 
       
    boot.kernelModules = [ "tun" ];

     

       
110
       
 
       


     

       
111
       
 
       
    users.groups.libvirtd.gid = config.ids.gids.libvirtd;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
112
       
 
       


     

       
113
       
 
       
    systemd.packages = [ pkgs.libvirt ];

     

       
114
       
 
       


     

···

       
17
       
 
       
    ${optionalString cfg.qemuOvmf ''

     

       
18
       
 
       
      nvram = ["/run/libvirt/nix-ovmf/OVMF_CODE.fd:/run/libvirt/nix-ovmf/OVMF_VARS.fd"]

     

       
19
       
 
       
    ''}

     

       
20
       
+
       
    ${optionalString (!cfg.qemuRunAsRoot) ''

     

       
21
       
+
       
      user = "qemu-libvirtd"

     

       
22
       
+
       
      group = "qemu-libvirtd"

     

       
23
       
+
       
    ''}

     

       
24
       
 
       
    ${cfg.qemuVerbatimConfig}

     

       
25
       
 
       
  '';

     

       
26
       
 
       


     
···

       
60
       
 
       
      '';

     

       
61
       
 
       
    };

     

       
62
       
 
       


     

       
63
       
+
       
    virtualisation.libvirtd.qemuRunAsRoot = mkOption {

     

       
64
       
+
       
      type = types.bool;

     

       
65
       
+
       
      default = true;

     

       
66
       
+
       
      description = ''

     

       
67
       
+
       
        If true,  libvirtd runs qemu as root.

     

       
68
       
+
       
        If false, libvirtd runs qemu as unprivileged user qemu-libvirtd.

     

       
69
       
+
       
        Changing this option to false may cause file permission issues

     

       
70
       
+
       
        for existing guests. To fix these, manually change ownership

     

       
71
       
+
       
        of affected files in /var/lib/libvirt/qemu to qemu-libvirtd.

     

       
72
       
+
       
      '';

     

       
73
       
+
       
    };

     

       
74
       
+
       


     

       
75
       
 
       
    virtualisation.libvirtd.qemuVerbatimConfig = mkOption {

     

       
76
       
 
       
      type = types.lines;

     

       
77
       
 
       
      default = ''

     
···

       
125
       
 
       
    boot.kernelModules = [ "tun" ];

     

       
126
       
 
       


     

       
127
       
 
       
    users.groups.libvirtd.gid = config.ids.gids.libvirtd;

     

       
128
       
+
       


     

       
129
       
+
       
    # libvirtd runs qemu as this user and group by default

     

       
130
       
+
       
    users.extraGroups.qemu-libvirtd.gid = config.ids.gids.qemu-libvirtd;

     

       
131
       
+
       
    users.extraUsers.qemu-libvirtd = {

     

       
132
       
+
       
      uid = config.ids.uids.qemu-libvirtd;

     

       
133
       
+
       
      isNormalUser = false;

     

       
134
       
+
       
      group = "qemu-libvirtd";

     

       
135
       
+
       
    };

     

       
136
       
 
       


     

       
137
       
 
       
    systemd.packages = [ pkgs.libvirt ];

     

       
138