blob: b9f29785dc73bfad96c74421842b8592ff8a8335 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
|
{
config,
lib,
inputs,
...
}:
let
cfg = config.os.srv.opnsense;
makePciArgs =
ids:
builtins.concatLists (
map (id: [
"-device"
"vfio-pci,host=${id},rombar=0"
]) ids
);
in
{
imports = [ inputs.microvm.nixosModules.host ];
options.os.srv.opnsense = {
enable = lib.mkEnableOption "enables an opnsense microvm";
pciIDs = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
example = [
"03:00.0"
"03:00.1"
];
description = "List of PCI bus addresses to pass through directly to OPNsense.";
};
vendorIDs = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
example = [ "8086:1563" ];
description = "List of Vendor:Device IDs to bind explicitly to the vfio-pci driver.";
};
imagePath = lib.mkOption {
type = lib.types.path;
default = /var/lib/microvm/images/opnsense.qcow2;
description = "Path to the OPNsense qcow2 drive image block.";
};
};
config = lib.mkIf cfg.enable {
boot = {
kernelParams = [
"intel_iommu=on"
"iommu=pt"
];
kernelModules = [
"vfio_pci"
"vfio"
"vfio_iommu_type1"
];
extraModprobeConfig = ''
options vfio-pci ids=${lib.concatStringsSep "," (lib.unique cfg.vendorIDs)}
'';
};
microvm.vms.opnsense = {
autostart = true;
config = {
imports = [ inputs.microvm.nixosModules.microvm ];
networking.hostName = "opnsense";
microvm = {
vcpu = 4;
mem = 4096;
hypervisor = "qemu";
interfaces = [
{
type = "bridge";
id = "vtnet0";
bridge = "br-srv";
}
];
qemu.extraArgs = [
"-machine"
"q35,accel=kvm,kernel-irqchip=on"
"-cpu"
"host,migratable=off,+invtsc"
]
++ (makePciArgs cfg.pciIDs);
};
};
};
};
}
|
