fix: dev vm setup

modules/nixos/containerization.nix

@@ -0,0 +1,85 @@
+{ config, lib, pkgs, ... }:
+let
+  inherit (lib) mkEnableOption mkOption mkIf types mkMerge mkAfter optionals;
+  cfg = config.rsydn.containerization;
+in {
+  options.rsydn.containerization = {
+    docker = {
+      enable = mkOption {
+        type = types.bool;
+        default = true;
+        description =
+          "Enable the Docker daemon with sane defaults for development.";
+      };
+
+      autoPrune = mkOption {
+        type = types.submodule {
+          options = {
+            enable = mkOption {
+              type = types.bool;
+              default = true;
+              description =
+                "Automatically prune unused Docker data on a schedule.";
+            };
+            dates = mkOption {
+              type = types.str;
+              default = "weekly";
+              description =
+                "Systemd calendar expression for docker system prune.";
+            };
+            flags = mkOption {
+              type = types.listOf types.str;
+              default = [ "--all" "--volumes" ];
+              description = "Extra flags passed to docker system prune.";
+            };
+          };
+        };
+        default = { };
+        description = "Settings for automatic Docker pruning.";
+      };
+    };
+
+    k3s = {
+      enable =
+        mkEnableOption "Run a lightweight Kubernetes control plane with k3s.";
+
+      role = mkOption {
+        type = types.enum [ "server" "agent" ];
+        default = "server";
+        description = "Choose whether this node runs as a k3s server or agent.";
+      };
+
+      extraFlags = mkOption {
+        type = types.listOf types.str;
+        default = [ "--write-kubeconfig-mode=0644" ];
+        description = "Additional flags to pass to the k3s service.";
+      };
+    };
+  };
+
+  config = mkMerge [
+    (mkIf cfg.docker.enable {
+      virtualisation.docker = {
+        enable = true;
+        package = pkgs.docker;
+        enableOnBoot = true;
+        autoPrune = {
+          enable = cfg.docker.autoPrune.enable;
+          dates = cfg.docker.autoPrune.dates;
+          flags = cfg.docker.autoPrune.flags;
+        };
+      };
+    })
+
+    (mkIf cfg.k3s.enable {
+      services.k3s = {
+        enable = true;
+        role = cfg.k3s.role;
+        extraFlags = cfg.k3s.extraFlags;
+      };
+
+      networking.firewall.allowedTCPPorts =
+        mkAfter (optionals (cfg.k3s.role == "server") [ 6443 ]);
+    })
+  ];
+}

modules/nixos/hosts/dev-vm.nix

@@ -0,0 +1,32 @@
+{ lib, pkgs, ... }: {
+  networking.hostName = "dev-vm";
+  # Set the baseline NixOS release used for stateful data; bump on rebuilds.
+  system.stateVersion = lib.mkDefault "24.05";
+
+  # Boot loader configuration for VM
+  boot.loader.grub.enable = lib.mkDefault true;
+  boot.loader.grub.device = lib.mkDefault "/dev/vda";
+
+  # Root filesystem configuration for VM
+  fileSystems."/" = lib.mkDefault {
+    device = "/dev/vda1";
+    fsType = "ext4";
+  };
+
+  environment.systemPackages = with pkgs; [
+    coreutils
+    ast-grep
+    ripgrep
+    bat
+    tree
+    zip
+    unzip
+    htop
+    jq
+    psmisc # provides killall and friends
+    gh
+    tree-sitter
+  ];
+
+  imports = [ ../virtualization.nix ];
+}

modules/nixos/network.nix

@@ -0,0 +1,4 @@
+{ lib, ... }: {
+  networking.useDHCP = lib.mkDefault true;
+  networking.networkmanager.enable = lib.mkDefault true;
+}

modules/nixos/ssh.nix

@@ -0,0 +1,17 @@
+{ lib, ... }: {
+  services.openssh = {
+    enable = lib.mkDefault true;
+    openFirewall = lib.mkDefault true;
+    settings = {
+      PermitRootLogin = "no";
+      PasswordAuthentication = false;
+    };
+  };
+
+  # Run tailscale so the VM can be reached over the mesh network for SSH.
+  services.tailscale = {
+    enable = lib.mkDefault true;
+    useRoutingFeatures = lib.mkDefault "client";
+    extraUpFlags = lib.mkDefault [ "--ssh" ];
+  };
+}

modules/nixos/system.nix

@@ -1,10 +1,12 @@
-{ config, pkgs, lib, user, ... }: {
-  users.users.${user} = {
-    isNormalUser = lib.mkDefault true;
-    extraGroups = lib.mkDefault [ "wheel" "networkmanager" ];
-    home = lib.mkDefault "/home/${user}";
-    shell = lib.mkDefault pkgs.fish;
-  };
+{ lib, ... }: {
+  imports = [ ./users.nix ./network.nix ./ssh.nix ./containerization.nix ];
 
-  programs.fish.enable = lib.mkDefault true;
+  nix = {
+    settings.auto-optimise-store = lib.mkDefault true;
+    optimise.automatic = lib.mkDefault true;
+    gc = {
+      automatic = lib.mkDefault true;
+      dates = lib.mkDefault "weekly";
+    };
+  };
 }

modules/nixos/users.nix

@@ -0,0 +1,10 @@
+{ lib, pkgs, user, ... }: {
+  users.users.${user} = {
+    isNormalUser = lib.mkDefault true;
+    extraGroups = lib.mkDefault [ "wheel" "networkmanager" "docker" ];
+    home = lib.mkDefault "/home/${user}";
+    shell = pkgs.fish;
+  };
+
+  programs.fish.enable = lib.mkDefault true;
+}

modules/nixos/virtualization.nix

@@ -0,0 +1,31 @@
+{ lib, pkgs, ... }: {
+  # QEMU guest agent provides graceful shutdowns and metadata exchange.
+  # Disabled by default - enable in host overlay if needed.
+  services.qemuGuest.enable = lib.mkDefault false;
+
+  # Spice vdagent handles clipboard sync, display resize, and mouse integration.
+  services.spice-vdagentd.enable = lib.mkDefault true;
+
+  # Keep the VM clock in sync if timesyncd is not already enabled elsewhere.
+  services.timesyncd.enable = lib.mkDefault true;
+
+  # Ensure essential virtio drivers are available early during boot.
+  boot.initrd.kernelModules = lib.mkDefault [
+    "virtio_pci"
+    "virtio_blk"
+    "virtio_net"
+    "virtio_scsi"
+    "virtio_mmio"
+  ];
+
+  boot.kernelModules =
+    lib.mkDefault [ "virtio_balloon" "virtio_console" "virtio_rng" ];
+
+  # Provide udev rules to improve virtio device behaviour.
+  services.udev.extraRules = lib.mkDefault ''
+    ACTION=="add", SUBSYSTEM=="virtio", ATTR{device/driver_override}=""
+  '';
+
+  # Pull in a few helper tools useful when tuning the guest.
+  environment.systemPackages = with pkgs; [ spice-vdagent ];
+}