vmsilo/flake.nix

{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    wayland-proxy-virtwl = {
      url = "git+https://git.dsg.is/dsg/wayland-proxy-virtwl.git?submodules=1";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    crosvm = {
      url = "git+https://git.dsg.is/dsg/crosvm.git?ref=vmsilo&submodules=1";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    treefmt-nix = {
      url = "github:numtide/treefmt-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs =
    {
      self,
      nixpkgs,
      wayland-proxy-virtwl,
      crosvm,
      treefmt-nix,
    }:
    let
      eachSystem = nixpkgs.lib.genAttrs [
        "x86_64-linux"
        "aarch64-linux"
      ];

      # Build NixOS-based rootfs as qcow2 image
      makeRootfsNixos =
        system:
        {
          guestPrograms ? [ ],
          guestConfig ? [ ],
        }:
        let
          pkgs = nixpkgs.legacyPackages.${system};
        in
        pkgs.callPackage (import ./rootfs-nixos) {
          inherit guestPrograms guestConfig;
          wayland-proxy-virtwl = wayland-proxy-virtwl.packages.${system}.default;
        };

      # Build vmsilo-balloond Rust binary
      buildVmsiloBalloond =
        system:
        let
          pkgs = nixpkgs.legacyPackages.${system};
        in
        pkgs.rustPlatform.buildRustPackage {
          pname = "vmsilo-balloond";
          version = "0.1.0";
          src = ./vmsilo-balloond;
          cargoLock = {
            lockFile = ./vmsilo-balloond/Cargo.lock;
          };
        };

      # Build vmsilo-tray Rust binaries
      buildVmsiloTray =
        system:
        let
          pkgs = nixpkgs.legacyPackages.${system};
        in
        pkgs.rustPlatform.buildRustPackage {
          pname = "vmsilo-tray";
          version = "0.1.0";
          src = ./vmsilo-tray;
          cargoLock = {
            lockFile = ./vmsilo-tray/Cargo.lock;
          };
        };

      # treefmt configuration
      treefmtConfig = {
        projectRootFile = "flake.nix";
        programs.nixfmt.enable = true;
      };
    in
    {
      formatter = eachSystem (
        system:
        (treefmt-nix.lib.evalModule nixpkgs.legacyPackages.${system} treefmtConfig).config.build.wrapper
      );

      packages = eachSystem (system: {
        default = makeRootfsNixos system { };
        rootfs-nixos = makeRootfsNixos system { };
        vmsilo-balloond = buildVmsiloBalloond system;
        vmsilo-tray = buildVmsiloTray system;
        decoration-tests =
          let
            pkgs = nixpkgs.legacyPackages.${system};
          in
          pkgs.stdenv.mkDerivation {
            pname = "decoration-tests";
            version = "0.1.0";
            src = ./wayland_decoration_tests;
            nativeBuildInputs = with pkgs; [
              wayland-scanner
              pkg-config
            ];
            buildInputs = [ pkgs.wayland ];
            makeFlags = [
              "WAYLAND_PROTOCOLS=${pkgs.wayland-protocols}/share/wayland-protocols"
              "PLASMA_WAYLAND_PROTOCOLS=${pkgs.kdePackages.plasma-wayland-protocols}/share/plasma-wayland-protocols"
              "WLR_PROTOCOLS=${pkgs.wlr-protocols}/share/wlr-protocols"
            ];
            installPhase = ''
              mkdir -p $out/bin
              cp test-csd-request test-no-decoration-protocol test-mode-none test-server-decoration-none test-fullscreen test-layer-shell test-large-popup test-subsurface-overflow test-ssd-request $out/bin/
            '';
          };
        sommelier = nixpkgs.legacyPackages.${system}.callPackage ./packages/sommelier.nix { };
      });

      devShells = eachSystem (system: {
        default =
          let
            pkgs = nixpkgs.legacyPackages.${system};
          in
          pkgs.mkShell {
            buildInputs = with pkgs; [
              # Rust toolchain
              cargo
              rustc
              rust-analyzer
              rustfmt
              clippy

              # Build dependencies
              pkg-config
            ];

            RUST_SRC_PATH = "${pkgs.rust.packages.stable.rustPlatform.rustLibSrc}";
          };

        decoration-tests =
          let
            pkgs = nixpkgs.legacyPackages.${system};
          in
          pkgs.mkShell {
            buildInputs = with pkgs; [
              wayland
              wayland-protocols
              kdePackages.plasma-wayland-protocols
              wlr-protocols
              wayland-scanner
              pkg-config
              gcc
            ];

            WAYLAND_PROTOCOLS = "${pkgs.wayland-protocols}/share/wayland-protocols";
            PLASMA_WAYLAND_PROTOCOLS = "${pkgs.kdePackages.plasma-wayland-protocols}/share/plasma-wayland-protocols";
            WLR_PROTOCOLS = "${pkgs.wlr-protocols}/share/wlr-protocols";
          };
      });

      # Helper function for building custom NixOS rootfs
      lib.makeRootfsNixos = makeRootfsNixos;

      nixosModules.default =
        {
          config,
          pkgs,
          lib,
          ...
        }:
        {
          imports = [ ./modules ];

          # Inject dependencies when module is enabled
          config = lib.mkIf config.programs.vmsilo.enable {
            programs.vmsilo._internal = {
              crosvm =
                if config.programs.vmsilo.nvidiaWeakenSandbox then
                  crosvm.packages.${pkgs.stdenv.hostPlatform.system}.crosvm-nvidia
                else
                  crosvm.packages.${pkgs.stdenv.hostPlatform.system}.default;
              wayland-proxy-virtwl = wayland-proxy-virtwl.packages.${pkgs.stdenv.hostPlatform.system}.default;
              sommelier = pkgs.callPackage ./packages/sommelier.nix { };
              vmsilo-balloond = buildVmsiloBalloond pkgs.stdenv.hostPlatform.system;
              vmsilo-tray = buildVmsiloTray pkgs.stdenv.hostPlatform.system;
            };
          };
        };
      nixosModules.optionalGuestSettings =
        # Some opinionated guest config (dark theme, etc). Not used by default.
        {
          config,
          pkgs,
          lib,
          ...
        }:
        {
          config = {
            qt.platformTheme = "kde";
            environment.etc."xdg/gtk-3.0/settings.ini".text = ''
              [Settings]
              gtk-theme-name=Adwaita-dark
              gtk-application-prefer-dark-theme=true
            '';

            environment.etc."xdg/gtk-4.0/settings.ini".text = ''
              [Settings]
              gtk-theme-name=Adwaita-dark
              gtk-application-prefer-dark-theme=true
            '';

            # KDE color scheme — xdg-desktop-portal-kde reads the window
            # background color from QApplication::palette() to report
            # org.freedesktop.appearance color-scheme. Without this, the
            # portal reports "prefer-light" and overrides the GTK dark
            # theme settings above for apps like Firefox.
            environment.etc."xdg/kdeglobals".text = ''
              [General]
              ColorScheme=BreezeDark

              [Colors:Window]
              BackgroundNormal=32,35,38
            '';
            fonts.packages = with pkgs; [ cascadia-code ];
          };
        };
      nixosModules.netvmSettings =
        # Guest settings for a networkmanager-based netvm. Not used by default.
        {
          config,
          pkgs,
          lib,
          ...
        }:
        {
          config = {
            programs.nm-applet.enable = true;
            boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
            hardware.enableAllFirmware = true;
            networking = {
              useDHCP = false;
              nat.enable = true;
              # TODO don't hard code this
              nat.externalInterface = "host";
              nat.internalInterfaces = [ "clients" ];
              nftables.enable = true;
              networkmanager.enable = true;
              networkmanager.wifi.powersave = true;
            };
          };
        };
    };
}