3 files changed, 70 insertions, 0 deletions
diff --git a/sys/virt/default.nix b/sys/virt/default.nix
new file mode 100644
index 0000000..1434bad
--- /dev/null
+++ b/sys/virt/default.nix
@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./libvirt.nix
+  ];
+}
diff --git a/sys/virt/dom/README.md b/sys/virt/dom/README.md
new file mode 100644
index 0000000..37073ba
--- /dev/null
+++ b/sys/virt/dom/README.md
@@ -0,0 +1 @@
+# This directory has been lustrated.
diff --git a/sys/virt/libvirt.nix b/sys/virt/libvirt.nix
new file mode 100644
index 0000000..ebbfbcd
--- /dev/null
+++ b/sys/virt/libvirt.nix
@@ -0,0 +1,64 @@
+{
+  config,
+  flakes,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.local.virt;
+
+  inherit (config.lib.local) importAll;
+
+  doms = mapAttrs (_: dom: dom {inherit config lib pkgs;}) (importAll {root = ./dom;});
+in {
+  options.local.virt = {
+    enable = mkEnableOption "hypervisor support";
+
+    dom =
+      mapAttrs
+      (name: _: {
+        enable = mkEnableOption "domain ${name}";
+      })
+      doms;
+  };
+
+  config = mkIf cfg.enable {
+    local.boot.impermanence.directories = [
+      {
+        directory = "/var/dom";
+        user = "root";
+        group = "qemu-libvirtd";
+        mode = "u=rwx,g=rx,o=";
+      }
+    ];
+
+    virtualisation = {
+      libvirt = {
+        enable = any (dom: dom.enable) (attrValues cfg.dom);
+
+        connections."qemu:///system".domains = let
+          makeDomain = def: {
+            active = true;
+            restart = false;
+            definition = flakes.nixvirt.lib.domain.writeXML def;
+          };
+        in
+          map makeDomain (attrValues (filterAttrs (name: _: cfg.dom.${name}.enable) doms));
+
+        swtpm.enable = true;
+      };
+
+      libvirtd = {
+        enable = true;
+
+        qemu = {
+          runAsRoot = false;
+
+          ovmf.enable = true;
+          swtpm.enable = true;
+        };
+      };
+    };
+  };
+}