# The test VM: this exact system in QEMU, built with
#   nixos-rebuild build-vm --flake .#desktop      (or ./vm.sh)
# It shares the host's /nix/store, so it builds in seconds once the real
# system has. Only what can't work in a VM is changed: no NVIDIA, a virtual GPU,
# the configs copied in rather than linked to your checkout, and a password to
# get past the lock screen at login.
{ lib, ... }:
{
  virtualisation.vmVariant = {
    virtualisation = {
      memorySize = 8192;
      cores = 6;
      diskSize = 16384;
      resolution = {
        x = 1920;
        y = 1080;
      };
      # A virtual GPU with OpenGL passed through to the host (virgl); vm.sh
      # picks how it is displayed.
      qemu.options = [ "-device virtio-vga-gl" ];

      # ssh -p 2222 vizie@localhost, with the key vm.sh hands in (see there).
      forwardPorts = [
        {
          from = "host";
          host.address = "127.0.0.1";
          host.port = 2222;
          guest.port = 22;
        }
      ];
    };

    # /tmp/xchg is a folder shared with the host; vm.sh puts the public key
    # there. sshd won't read keys from under /tmp (anyone can write there), so
    # it is copied somewhere root owns at boot. Only the VM has this; the real
    # system's SSH logins are unchanged.
    services.openssh.authorizedKeysFiles = [ "/run/vm-ssh/authorized_keys" ];
    systemd.services.vm-ssh-key = {
      wantedBy = [ "sshd.service" ];
      before = [ "sshd.service" ];
      serviceConfig.Type = "oneshot";
      script = ''
        install -d -m755 /run/vm-ssh
        if [ -f /tmp/xchg/authorized_keys ]; then
          install -m644 /tmp/xchg/authorized_keys /run/vm-ssh/authorized_keys
        fi
      '';
    };

    dot.nvidia.enable = false;

    # The VM has no eno1 for systemd-networkd to bring up (NetworkManager does
    # its network), so don't hold the boot waiting for it.
    systemd.network.wait-online.enable = false;
    home-manager.users.vizie.dot.liveConfig = lib.mkForce false;

    # The VM's user has no password of its own to unlock the session with.
    users.users.vizie.initialPassword = "vizie";
  };
}