flake.nix

{
  description = "Qubix: declarative Hyper-V appliance factory for NixOS VMs";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
    nixos-generators = {
      url = "github:nix-community/nixos-generators";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = { self, nixpkgs, nixos-generators }:
  let
    system = "x86_64-linux";
    lib = nixpkgs.lib;
    pkgs = import nixpkgs {
      inherit system;
      config.allowUnfreePredicate = pkg:
        builtins.elem (lib.getName pkg) [
          "spotify"
        ];
    };

    # GitHub repository that publishes release assets.  `qubixctl -Command up`
    # downloads images from here when it is not asked to build them in WSL.
    releaseRepo = "PhysShell/qubix";

    # Evaluate a machine's NixOS config.  The Hyper-V manifest is derived from
    # evaluated machine configs so that settings like hostName, static
    # networking and the home-disk contract have one source of truth: the
    # machine file.  No more keeping two files in sync by hand.
    #
    # The Hyper-V image module is part of the evaluation so that
    # `nixosConfigurations.*` describe exactly the system that ends up in the
    # VHDX (root filesystem, growPartition, Hyper-V guest services included).
    evalMachine = modules: lib.nixosSystem {
      inherit system pkgs;
      modules = modules ++ imageModules;
      specialArgs = { inherit self; };
    };

    # The upstream Hyper-V image module plus Qubix's override of it (see
    # profiles/image/hyperv.nix).  Both the `nixosConfigurations.*` evaluation
    # and the nixos-generators build path have to see the same pair, or the
    # VHDX would stop matching the config the manifest and the tests describe.
    # nixos-generators imports the upstream module itself; Nix keys modules by
    # path, so naming it twice is free.
    imageModules = [
      "${nixpkgs}/nixos/modules/virtualisation/hyperv-image.nix"
      ./profiles/image/hyperv.nix
    ];

    # Extract network-related manifest fields from an evaluated NixOS config.
    # Returns an empty attrset when no static IP is configured (DHCP mode).
    mkNetworkFields = cfg:
      let net = cfg.qubix.network;
      in lib.optionalAttrs (net.staticIp != null) {
        staticIp    = net.staticIp;
        gatewayIp   = net.gateway;
        # Derive subnet from staticIp + prefixLength (correct for /17-/24).
        natSwitchSubnet =
          let parts = lib.splitString "." net.staticIp;
          in "${builtins.elemAt parts 0}.${builtins.elemAt parts 1}"
           + ".${builtins.elemAt parts 2}.0/${toString net.prefixLength}";
      };

    # One manifest entry per machine.  Everything the Windows controller needs
    # to create the VM, find the images and open the RDP window lives here.
    mkMachineManifest = { name, cfg }: {
      # Nix package names, used by the WSL build path.
      package     = "${name}-vhdx";
      homePackage = "${name}-home-vhdx";

      # Derived from the machine config — only one place to change.
      vmName   = "qubix-${cfg.networking.hostName}";
      hostName = cfg.networking.hostName;

      # Used in DHCP mode; ignored when staticIp is present.
      switchName = "Default Switch";
      cpuCount           = 2;

      # Startup, not "how much it needs".  Hyper-V has to find the whole
      # startup amount before the guest exists, and only then does Dynamic
      # Memory - which qubixctl enables between 1 and this maximum - let
      # hv_balloon give the surplus back.  A 4 GiB floor is what a host with
      # other things running refuses first, and the appliance does not want
      # it: tests/xrdp-session.nix brings up Xorg under xrdp, Openbox and
      # Spotify with its window mapped and maximised in a 2 GiB VM, which is
      # the whole kiosk.  The maximum stays at 6 GiB because Spotify's cache
      # is what grows, and growing is what Dynamic Memory is for.
      memoryStartupBytes = 2147483648;
      maxMemoryBytes     = 6442450944;
      vmRoot    = "C:\\HyperV\\Qubix";
      wslDistro = "NixOS";

      homeDisk = {
        inherit (cfg.qubix.homeDisk) enable label sizeMiB;
      };

      # RDP window the controller opens after boot.  The lab password is
      # already public in this repo; storing it in Windows Credential Manager
      # for one-click connects does not make it any less public.
      rdp = {
        user     = "rdp";
        password = cfg.qubix.labPassword;
        width    = 1280;
        height   = 800;
      };

      # GitHub release assets, as produced by the `${name}-release` package.
      release = {
        repo        = releaseRepo;
        systemAsset = "${name}.vhdx.gz";
        homeAsset   = "${name}-home.vhdx.gz";
        sumsAsset   = "SHA256SUMS";
      };

      # Network fields are present only when qubix.network.staticIp is set
      # in the machine file.  Nothing to change here when toggling static IP.
    } // mkNetworkFields cfg;

    spotibox      = evalMachine [ ./machines/spotibox.nix ];
    spotiboxDebug = evalMachine [ ./machines/spotibox-debug.nix ];

    qubixManifest = {
      schemaVersion = 2;
      machines = {
        spotibox = mkMachineManifest { name = "spotibox"; cfg = spotibox.config; };
      };
    };

    mkHypervImage = modules:
      nixos-generators.nixosGenerate {
        inherit system pkgs lib;
        nixosSystem = lib.nixosSystem;
        format = "hyperv";
        modules = modules ++ imageModules;
        specialArgs = {
          inherit self;
        };
      };

    # A UUID that is a function of its name: the name's SHA-256 cut to the
    # 8-4-4-4-12 shape, with RFC 9562's version (8, custom) and variant bits
    # set.  The same name gives the same UUID on every machine, every build.
    stableUuid = name:
      let
        h = builtins.hashString "sha256" name;
        at = start: len: builtins.substring start len h;
        # The variant is the top two bits of octet 8, binary 10.
        variant = builtins.elemAt [ "8" "9" "a" "b" ]
          (lib.mod (lib.fromHexString (at 16 1)) 4);
      in "${at 0 8}-${at 8 4}-8${at 13 3}-${variant}${at 17 3}-${at 20 12}";

    # Pre-formatted, labelled, empty ext4 disk for /home as a dynamic VHDX.
    # The guest mounts it by label (profiles/storage/persistent-home.nix), the
    # host copies it next to the VM once and never touches it again.
    #
    # The filesystem is the same bytes on every build.  mke2fs draws the UUID
    # and the directory hash seed at random unless told otherwise, and ext4's
    # metadata checksums are seeded from the UUID, so a random one does not
    # change 16 bytes but every checksummed structure: two builds of one
    # commit differed in some 6,300 bytes across 551 blocks.  Both are derived from
    # what the disk is instead - the machine and the label - and
    # SOURCE_DATE_EPOCH fixes the timestamps mke2fs writes, which stdenv
    # happens to set as well; tests/home-seed.nix pins the UUID.  The VHDX
    # around it is not reproducible: qemu-img writes fresh GUIDs into its
    # headers and metadata, and a sequence number and log entries of its own.
    mkHomeSeed = cfg:
      let
        hd = cfg.qubix.homeDisk;
        fsUuid = stableUuid "qubix-home-seed:${cfg.networking.hostName}:${hd.label}";
      in pkgs.runCommand "qubix-home-${cfg.networking.hostName}.vhdx" {
        nativeBuildInputs = [ pkgs.e2fsprogs pkgs.qemu-utils ];
        passthru = { inherit fsUuid; };
      } ''
        raw="$TMPDIR/home.raw"
        truncate -s ${toString hd.sizeMiB}M "$raw"
        SOURCE_DATE_EPOCH=1 mkfs.ext4 -q -F -L ${lib.escapeShellArg hd.label} -m 0 \
          -U ${fsUuid} \
          -E lazy_itable_init=1,lazy_journal_init=1,hash_seed=${fsUuid} "$raw"
        qemu-img convert -f raw -O vhdx -o subformat=dynamic "$raw" "$out"
      '';

    # Everything one GitHub release needs, gzip'd so that Windows can unpack
    # it with nothing but .NET (no zstd/7-Zip dependency on the host).
    mkReleaseBundle = { name, systemImage, homeImage, manifest }:
      pkgs.runCommand "qubix-release-${name}" {
        nativeBuildInputs = [ pkgs.pigz ];
      } ''
        mkdir -p "$out"
        vhdx=$(find -L ${systemImage} -type f -name '*.vhdx' -print -quit)
        test -n "$vhdx" || { echo "no .vhdx in ${systemImage}" >&2; exit 1; }
        pigz -9 -n -c "$vhdx" > "$out/${name}.vhdx.gz"
        pigz -9 -n -c ${homeImage} > "$out/${name}-home.vhdx.gz"
        cp ${manifest} "$out/manifest.json"
        cd "$out"
        sha256sum ${name}.vhdx.gz ${name}-home.vhdx.gz manifest.json > SHA256SUMS
      '';

    manifestJson = (pkgs.formats.json { }).generate "qubix-manifest.json" qubixManifest;
  in {
    # Exposed for introspection (`nix eval`, `nixos-rebuild build-vm`, tests).
    nixosConfigurations = {
      spotibox       = spotibox;
      spotibox-debug = spotiboxDebug;
    };

    packages.${system} = {
      spotibox-vhdx = mkHypervImage [
        ./machines/spotibox.nix
      ];

      spotibox-debug-vhdx = mkHypervImage [
        ./machines/spotibox-debug.nix
      ];

      spotibox-home-vhdx = mkHomeSeed spotibox.config;

      spotibox-release = mkReleaseBundle {
        name = "spotibox";
        systemImage = self.packages.${system}.spotibox-vhdx;
        homeImage = self.packages.${system}.spotibox-home-vhdx;
        manifest = manifestJson;
      };

      qubix-manifest-json = manifestJson;

      # The systems the images are made of.  A VHDX is its `toplevel` closure
      # plus a filesystem around it, and toplevel builds without KVM, so this
      # is what `tools/closure.sh` measures and what the CI closure budget
      # gates on.  It is also the fastest way to check "does this change even
      # build" without waiting for an image.
      spotibox-toplevel       = spotibox.config.system.build.toplevel;
      spotibox-debug-toplevel = spotiboxDebug.config.system.build.toplevel;

      default = self.packages.${system}.spotibox-vhdx;
    };

    checks.${system} = {
      spotibox-basic =
        import ./tests/spotibox-basic.nix {
          inherit pkgs;
        };

      spotibox-appliance-split =
        import ./tests/appliance-split.nix {
          inherit pkgs lib;
          prod = spotibox.config;
          debug = spotiboxDebug.config;
        };

      spotibox-xrdp-session =
        import ./tests/xrdp-session.nix {
          inherit pkgs;
        };

      spotibox-xrdp-audio =
        import ./tests/xrdp-audio.nix {
          inherit pkgs;
        };

      spotibox-kernel-contract =
        import ./tests/kernel-contract.nix {
          inherit pkgs lib;
          prod = spotibox.config;
          debug = spotiboxDebug.config;
        };

      spotibox-home-seed-identity =
        import ./tests/home-seed.nix {
          inherit pkgs lib;
          seed = self.packages.${system}.spotibox-home-vhdx;
        };
    };
  };
}