wip

sharing /var somehow doesnt work. for example nginx fails because of
lacking permissions to access /var/log/nginx. this also happens when
run-vm is started as root. thats why only /var/lib is shared which still
allows application persistency between tests

machines/.sops.yaml

@@ -11,7 +11,6 @@ keys:
   - &machine_durruti age1xu6kxpf8p0r8d6sgyl0m20p5hmw35nserl7rejuzm66eql0ur4mq03u0vp
   - &machine_vpn age1v6uxwej4nlrpfanr9js7x6059mtvyg4fw50pzt0a2kt3ahk7edlslafeuh
   - &machine_fanny age14dpm6vaycd6u34dkndcktpamqgdyj4aqccjnl5533dsza05hxuds0tjfnf
-  - &machine_nextcloud age1w07s4y2uh0xd322ralyyh79545lvxzqncd0s65q9cx4ttlqv5u9s7y78gr
   #this dummy key is used for testing.
   - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
 creation_rules:
@@ -91,6 +90,6 @@ creation_rules:
     - pgp:
       - *admin_kalipso
       - *admin_kalipso_dsktp
+      - *machine_durruti
       age:
-      - *admin_atlan
-      - *machine_nextcloud
+      - *admin_atlan

machines/configuration.nix

@@ -3,6 +3,7 @@
 , nixpkgs
 , sops-nix
 , inputs
+, microvm
 , nixos-hardware
 , home-manager
 , ...
@@ -34,15 +35,15 @@ let
             };
           };
         })
-
         sops-nix.nixosModules.sops
+        microvm.nixosModules.microvm
       ];
     }
   ];
   defaultModules = baseModules;
 
   makeMicroVM = hostName: ipv4Addr: macAddr: modules: [
-    inputs.microvm.nixosModules.microvm
+    self.nixosModules.malobeo.metrics
     {
       microvm = {
         hypervisor = "cloud-hypervisor";
@@ -80,6 +81,13 @@ let
         ];
       };
 
+      malobeo.metrics = {
+        enable = true;
+        enablePromtail = true;
+        logNginx = false;
+        lokiHost = "10.0.0.14";
+      };
+      
       systemd.network.enable = true;
       
       systemd.network.networks."20-lan" = {
@@ -194,5 +202,4 @@ in
     specialArgs.self = self;
     modules = defaultModules ++ [ ./testvm ];
   };
-
 }

machines/durruti/configuration.nix

@@ -19,6 +19,8 @@ with lib;
   imports = [
     inputs.tasklist.nixosModules.malobeo-tasklist
 
+    ./documentation.nix
+
     ../modules/malobeo_user.nix
     ../modules/sshd.nix
     ../modules/minimal_tools.nix

machines/durruti/host_config.nix

@@ -43,26 +43,6 @@ in
       };
     };
 
-    services.nginx.virtualHosts."cloud.malobeo.org" = {
-      forceSSL = true;
-      enableACME= true;
-      locations."/" = {
-        proxyPass = "http://10.0.0.10";
-        extraConfig = ''
-        '';
-      };
-    };
-
-    services.nginx.virtualHosts."grafana.malobeo.org" = {
-      forceSSL = true;
-      enableACME= true;
-      locations."/" = {
-        proxyPass = "http://10.0.0.10";
-        extraConfig = ''
-        '';
-      };
-    };
-
     services.nginx.virtualHosts."status.malobeo.org" = {
       forceSSL = true;
       enableACME= true;
@@ -78,5 +58,11 @@ in
       enableACME= true;
       locations."/".proxyPass = "http://${cfg.host_ip}:8080";
     };
+
+    services.nginx.virtualHosts."booking.dynamicdiscord.de" = {
+      forceSSL = true;
+      enableACME= true;
+      locations."/".proxyPass = "http://${cfg.host_ip}:80";
+    };
   };
 }

machines/fanny/configuration.nix

@@ -26,14 +26,7 @@ in
     cacheurl = "https://cache.dynamicdiscord.de";
   };
 
-  nix = {
-    settings.experimental-features = [ "nix-command" "flakes" ];
-    #always update microvms
-    extraOptions = ''
-      tarball-ttl = 0
-    '';
-  };
-
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
 
   malobeo.disks = {
     enable = true;
@@ -60,7 +53,7 @@ in
   };
 
   services.malobeo.microvm.enableHostBridge = true;
-  services.malobeo.microvm.deployHosts = [ "overwatch" "infradocs" "nextcloud" "durruti" ];
+  services.malobeo.microvm.deployHosts = [ "infradocs" "nextcloud" "overwatch" ];
 
   networking = {
     firewall = {
@@ -74,7 +67,6 @@ in
       locations."/" = {
         proxyPass = "http://10.0.0.11:9000";
         extraConfig = ''
-          proxy_set_header Host $host;
         '';
       };
     };
@@ -83,16 +75,6 @@ in
       locations."/" = {
         proxyPass = "http://10.0.0.13";
         extraConfig = ''
-          proxy_set_header Host $host;
-        '';
-      };
-    };
-
-    virtualHosts."grafana.malobeo.org" = {
-      locations."/" = {
-        proxyPass = "http://10.0.0.14";
-        extraConfig = ''
-          proxy_set_header Host $host;
         '';
       };
     };

machines/infradocs/configuration.nix

@@ -1,4 +1,4 @@
-{ self, config, lib, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, ... }:
 
 with lib;
 
@@ -9,18 +9,16 @@ with lib;
   };
 
   imports = [
-    self.nixosModules.malobeo.metrics
     ../durruti/documentation.nix
     ../modules/malobeo_user.nix
     ../modules/sshd.nix
   ];
 
-  malobeo.metrics = {
-    enable = true;
-    enablePromtail = true;
-    logNginx = true;
-    lokiHost = "10.0.0.14";
-  };
+  networking.firewall.allowedTCPPorts = [ 9002 ];
+
+  malobeo.metrics.logNginx = lib.mkForce true;
+
+  users.users.promtail.extraGroups = [ "nginx" "systemd-journal" ];
 
   system.stateVersion = "22.11"; # Did you read the comment?
 }

machines/modules/malobeo/microvm_host.nix

@@ -86,6 +86,12 @@ in
     in
     builtins.listToAttrs (map mapperFunc cfg.deployHosts);
 
+    systemd.tmpfiles.rules = builtins.concatLists (map (name: [
+      "d /var/lib/microvms/${name}/var 0755 root root - -"
+      "d /var/lib/microvms/${name}/etc 0755 root root - -"
+      "d /${name} 0755 root root - -"
+    ]) cfg.deployHosts);
+
     systemd.services = builtins.foldl' (services: name: services // {
       "microvm-update@${name}" = {
         description = "Update MicroVMs automatically";

machines/nextcloud/configuration.nix

@@ -1,4 +1,4 @@
-{ config, self, lib, pkgs,  ... }:
+{ config, lib, pkgs,  ... }:
 
 with lib;
 
@@ -17,20 +17,12 @@ with lib;
   };
 
   imports = [
-    self.nixosModules.malobeo.metrics
     ../modules/malobeo_user.nix
     ../modules/sshd.nix
     ../modules/minimal_tools.nix
     ../modules/autoupdate.nix
   ];
 
-  malobeo.metrics = {
-    enable = true;
-    enablePromtail = true;
-    logNginx = true;
-    lokiHost = "10.0.0.14";
-  };
-
   services.nextcloud = {
     enable = true;
     package = pkgs.nextcloud30;

machines/nextcloud/secrets.yaml

@@ -8,61 +8,72 @@ sops:
         - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqSk9GWktrZ3FsRHpOcTJp
-            Y3VWMytTRlhxVXJma1puT1lMRTN2NHBNV2xrCi8xYTFWeVN6RWl0Um9mZXpoKzFh
-            SjVFcGJRNlhkVUZQYXpEb0EwYzUvUjQKLS0tIGEvdGdMRGxvcndxMllZTWZqKzg1
-            aWlJOTdYV1JMM0dIWEFDSHRuQWdlcVUKsdwGZ3SkJEf4ALDhHUlSQJNKrFyWd7fW
-            WTGk66NJ2yD8ko/6OyB9J9U0WPbFLgr972H+klBq/IDmOx0hClbYNA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1w07s4y2uh0xd322ralyyh79545lvxzqncd0s65q9cx4ttlqv5u9s7y78gr
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoNzdib3Ztd0g0MlVqYVF6
-            cUtjZzEyY2FJYVRoT1p5RlJwYVQwUXVOUkNVCkp4V3hMYlJsaVN4RjlwQXNWS1Jt
-            aitzWVdOcUdrNHorenZGZU1iWFZzVjgKLS0tIGNGcTU5OUJLM3VzQk1uODFwS1hO
-            WG16Y25tMDkreGFnSFRKN1AybyttYWcKcLHJScp2Ozh0jIdi7Hb/tSjaCGorqXaC
-            9DIrQPHbPP1RIc6Ak8Kn30/BHEWV3VaiBCT3vfS9pNJQNjB4T+901g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmVGxsNmZ3Z0RIYmMyL0Mr
+            UUpaMEZLTCtQaGFrL1YwOVBicEtNRTVaVGhRCmhDSUgxYXpRcldaMngvOWJDdnNo
+            b2ZFbUdmcE9EV2E3SkMvZ1RpKzZmeU0KLS0tIE5hNmVFTXpBZFZ3bHYwQlJQaUtw
+            UFJmTVFaOTJXN09QLzY4emh5Z3hqRjAKXk1PSwR2x0H2cMN06fyigiusz8v2IRIg
+            S4ZTq/JX39U4QQHgWA1dFPfC636LNBo+QKdl/2mjwnXW7duqDJ+5kA==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2024-11-26T20:00:50Z"
     mac: ENC[AES256_GCM,data:qoY9SfpoU+8HfvD5v/1S6BOkbnZUmHIbtwr0tTSuPETjnFNgr1VVw9mnRatJKPYYFb9/rMZQWIqTY+iUIEkcTVyVXhd6ki5CHW+uxCeBIyMzq33rtEa/btkEUoii4iPieamBCIY21W0znE+edxfR04yRJtLxMICEbuW4Hjf6bwk=,iv:nG42fRgjpuIjPMYnn/6egEdzYolcUBsspaZ8zMv4888=,tag:C6apGoAvVLsWdLWSCwrx6w==,type:str]
     pgp:
-        - created_at: "2025-01-21T21:04:08Z"
+        - created_at: "2024-11-26T19:59:36Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQGMA5HdvEwzh/H7AQv/ejIylIgs3yeVcZriQTA8d/xyXTdFw6On422lTCDk3d0W
-            GOdV44vAzUzNX5tziQtLjectLUrKh9Qb9WaP4VnTCGI0XJ/dEtYRCkYMx8MjjbLl
-            8GqFi3Hw958Uykp9wt0iiP6BQ42Fo77EPxVcn21eHKZY0zg/vaeRXXeXSzkjzANs
-            NN/KFS06uFRJhmp+0z6hDRrHnpb0wd5JGjHOp96jK9LmpwfZZZlVpAHp04hOhlPV
-            cMmdjg9IRSubvbraTbDrgwB0h3JKdqovFDnAP/KvT+rw5xnVUVMq/3tUNq4MbfZb
-            CvQrXsjQJQbEhY+eAJZVRO07kX0+zMvIin4ss7Xt++qlo4/OvFvuGbnUhJE+hrBb
-            nkyGhbDrjpsfa3djCEZ0UxMAWtPeIQ7T8QMkGY+UKeJKxfOGSchARnfCtGD/rtsj
-            wuhqGya7g7WP78WzwASzlPwB5jpdQ29/zLWXR60lNCYu0UYSVYmlspZnKEB0FkLO
-            TNUrwXXMrM0XwMVaG/sF0lgBEPE6CTuE85evCHFyu6zhEAa7YimKAPIowcwYLSJ2
-            46KfttJAYnRnb68Kk9N5xcFyvhKyTx/6eMdxkgr2LMoSTBDUgZfG3rDQC+ZbFE3m
-            bUOvx3Ho80EC
-            =oQd6
+            hQGMA5HdvEwzh/H7AQv+KkX46UGQzLvhrk/VUCnnMdLEcNbYfk4h+sZJzs1riOGA
+            LAKYNeaeN6iLLeZX+T2/s5OT4WkIEKGg8/gziurdx01BR70M96Faubp6EVtdK44+
+            6F5BLLrDhlEKDNOx48qPwJdFjbYW4wZLWmv5nzwPmmRCKO7MoI9UHKq69msCor1i
+            ralbjlVHyKSuRfvflKAlxFoEqeB6H+ryc54g3stk1j2eFiMNuF/oKDJZT+XI5LHZ
+            Ai80DAWoUBYgpP4aWiNC075GPutdPlZ3mrGf5+7QnNm7GmNUdJN5VAWmI2NUGr1J
+            BLopnPFo4juWNsZkLMj2aAuKvGTkhz2PuFKfLj6Erpu82RAjadpFWx239n+i4Ryq
+            wSquYshpuiecLEejntTBKLEacwp+aPx8IHKnOOKBTdJj+YYaISiznQAlkF7WS+lg
+            MTZR85BvCxiPogujL7uhYSx1wM5FVkuAIPf1JOJCRvQt30eRRrR0VMrmqQ1Kl5OT
+            VMzZRIGIoC5vrKGeIIjJ0lgBWQ3bYFh/LGrwKetku6TRAH29mp/XwQqBC97RsUYb
+            EOxft5sUWaYrXK+z2yzCxOQBWKJISPgcyhdoKfYGnRkHXHi2Uay84oQP4co72eVF
+            cAhEJOxMw36e
+            =bSaN
             -----END PGP MESSAGE-----
           fp: c4639370c41133a738f643a591ddbc4c3387f1fb
-        - created_at: "2025-01-21T21:04:08Z"
+        - created_at: "2024-11-26T19:59:36Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA98TrrsQEbXUAQ//eu7YkPL7dU4AYWCZI7THsiJ51SOMahOXp/qC5yL18aZY
-            r4SpyNhFezGIJfMuhwBSZZBI/MNW6M+zMwIJ2wkioxUDnDvfVi10/cV6p85U75Jn
-            59e1afN+eekG2DCI6sWPmLy8jmYh4CQRdEurtfzquDOARZ4IHZjotP5AWI8OPHlM
-            FdK2jGXFVevQY0m619CNm78D2NEdlGe1QtLVSazWQ8MsDLfMnHTYFUy3EoSihzat
-            QkcR//8whzlLT/NcqKlnBDNBU7FvPov+ZdUmIw1mx2wp5f2sGp4m737Yhoey2aFL
-            qLXHDc91nVRcw95FBDNYlSH8a2AzT4sm4vFR5EkC6vrfz+v1pdg1Fc3dc++hPgE0
-            MYWn6f4v8lDhPhw2kpmAP4Oz4uPdmPgdfXKiIzr7qf3O5lIC6ZIIwoqhj2f0odj6
-            7anDUN5C3B5ruFU3UNJEBLrZelbmg4zf2hAtzfoi0L9paIZX5SCLP3PDbvdRbADc
-            oyC3Gw/DeddQ9ZeP+wYiwJ/614zRBmZRzQr9RFowf0gJBSS7TaWPCONfUJ/3eekX
-            or8JpLTD5PMQNoS0L4S41Cj+yOg/AlmHF/9yvj1GVTKT9rBj3Snki9NOmY2ZUQo3
-            BDdnsftA3w4q4iu06ojQkrjn/FJjmNzb83XR2WxrHFUAaY//nISyY/9uTsEhwFbS
-            WAFlKfmyVc7nLBI12i0yWLLy/tcVF3c8gtGfNmyoe/RIr+6EQmzUi0v+X49Tnzpj
-            8JAnE+4Jzm2ijqF4Ats5KoXqFiLUenJZQHJ3IFoI36n+hM4P/ICeZ4k=
-            =s9pl
+            hQIMA98TrrsQEbXUARAAmG88ZDt43zj6dCJkYYVj7MGIhIviJzilTvX4+EfNobtA
+            tll60GYfRotKnwbuqzSVaaIcV+6cDQ5I1hG5WNFJSXm7DpJ0W1Ir1x2hpxektXFa
+            fQ+9HiCOfEqUu5PEynCAD1jN6CQLdl87hLQx9TqbZnHuUYPSH1o9Y6kbA/Vp3bpy
+            evJc8qa66WHYH1kjdEw+qneD5HzZQOLOtXZ7xkxjGbyMcYex9JfyGHohO5dpLg6B
+            3XrLlIWWERVz04MlnzlaMKfzhoMCU9ByqJSQ3VBm9kblQqu54fOZD2sN8j9ACEfL
+            YNC7Jm2rasVSqv09G1kso9/VNDw3kNCLvjnpE5rJRP7Ckfj+4FxQN/zPVUwQ1e1k
+            upoQ8MHyf1bJr8vspm/prm9zp+PRRTUwY1Yyts/ffj+CF5ec9M3jr/RSeEAdswsL
+            6dLKBL1LuLAjKXOuVnQ7E6gN940Y994sDFkbqEmzzCUHGcfxSF3IDn/qpkQlqerU
+            B/D43Yef+rtsUDyTA5RUpxKleGORcS4sV0BhQrNXeFclaMTyMr+AbOei4Y77qlD1
+            x/fHB3IT4Intvp9k4m6jJ86RtLpVhEoA4cHEdCCiXHzUpA6aVtNHVAOqT/aBykrf
+            uSm1wu/nl6yKbIwTJueli1OfQYKEYcUdjOrEOwXb+UDQKSohWZrMg0sj7/S6Pl/S
+            WAG1BZ20HXD2ZrVqESV87Pl04nKMqswrio+BINfAT9X3ya7L3DF69MR18bDt+ZIB
+            0F3+9WUREGI5in4S3hXNxrgfLNFl1YLklfWLYcx0HXJN3z6F2eJOUvM=
+            =aT3U
             -----END PGP MESSAGE-----
           fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+        - created_at: "2024-11-26T19:59:36Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA1kR3vWkIYVnARAAqFyuCtvu6AidWg/9+btEcjWv0sBZaIRpYfX3p2QECwCu
+            UYAtssvSHgHdBEQzU27MA/5CGmEreB3NhWrjGquv88RojLO1JuhNHGYPZKeIcBKr
+            I2oS79RKuYs+d2Qu0KUYDaVoY9M5YJsfkju2FOXqMNYlbqX+lDuWnisigj3n2N4e
+            OEBnVIpfPBQE6c1Z9DaQJE7MyBbKfg5YeWjlwwh+fCf1dV/nGp+QdD88F3dzWMoK
+            xNGt69TwZ8JUVmElAIJqLJTpyDI5xHQUw2A6ddPSTk/u363eHhOnZZUNAAm3FdO5
+            0x+4QhcBaH59S8WDZhw4MVmZN7v4+3l3mf7Rx/TXSz4oJg+U7RMgvc291/gowNVm
+            /cVhBlMYz4Ogx/OYR/t+nzq35r+eBungTB+dRXw7qTTfkCtNgp34JMCkGAq5WWnY
+            57H2HtssGiMF0qN4SfWxw7317oUmqHI2XvG0yWt42G++jNgIGbDOtuc/7wATEbhK
+            SBX2aLqDIB1OUwLHQeawyKkB0qGmRSVPkPg8JLwRp43ICETH1WPkY5m/a2slVlDj
+            qgdw00clTI5Fgu/5G5QBD4Ds9f9ZwjrMD4v+NYfGxa0ajisXl1X6CL1+YvQ6Uicf
+            QmIRJYxyVd0VoXScZnsk0T/XTKjJB/fRLRalA2PmlZ1v+gisCUz2dhM+OHtSjGTS
+            WAG5znRbP8UMVt02O0PgbzHYtIUAtQLCuBnzfEKJn721rqCXf7DXU3jrR73Ys6ce
+            VJzkVBMnBszF71GN56t0PaUYIDOnaGvgjMtHHtOCLQHSK7asnm/Bc+E=
+            =Znii
+            -----END PGP MESSAGE-----
+          fp: 4095412245b6efc14cf92ca25911def5a4218567
     unencrypted_suffix: _unencrypted
     version: 3.8.1

machines/overwatch/configuration.nix

@@ -1,4 +1,4 @@
-{ config, self, lib, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, ... }:
 
 with lib;
 
@@ -9,19 +9,11 @@ with lib;
   };
 
   imports = [
-    self.nixosModules.malobeo.metrics
     ../modules/malobeo_user.nix
     ../modules/sshd.nix
   ];
 
-  networking.firewall.allowedTCPPorts = [ 80 3100 ];
-
-  malobeo.metrics = {
-    enable = true;
-    enablePromtail = true;
-    logNginx = false;
-    lokiHost = "10.0.0.14";
-  };
+  networking.firewall.allowedTCPPorts = [ 80 9080 9001 3100 ];
 
   services.grafana = {
     enable = true;
@@ -87,12 +79,12 @@ with lib;
           targets = [ "127.0.0.1:9002" ];
         }];
       }
-      #{
-      #  job_name = "durruti";
-      #  static_configs = [{
-      #    targets = [ "10.0.0.5:9002" ];
-      #  }];
-      #}
+      {
+        job_name = "durruti";
+        static_configs = [{
+          targets = [ "10.0.0.5:9002" ];
+        }];
+      }
       {
         job_name = "infradocs";
         static_configs = [{

machines/vpn/configuration.nix

@@ -17,6 +17,7 @@ with lib;
   };
 
   imports = [
+    inputs.self.nixosModules.malobeo.vpn
     ../modules/malobeo_user.nix
     ../modules/sshd.nix
     ../modules/minimal_tools.nix
@@ -34,27 +35,9 @@ with lib;
       locations."/" = {
         proxyPass = "http://10.100.0.101";
         extraConfig = ''
-          proxy_set_header Host $host;
         '';
       };
-    };
 
-    virtualHosts."cloud.malobeo.org" = {
-      locations."/" = {
-        proxyPass = "http://10.100.0.101";
-        extraConfig = ''
-          proxy_set_header Host $host;
-        '';
-      };
-    };
-
-    virtualHosts."grafana.malobeo.org" = {
-      locations."/" = {
-        proxyPass = "http://10.100.0.101";
-        extraConfig = ''
-          proxy_set_header Host $host;
-        '';
-      };
     };
   };
 

outputs.nix

@@ -12,6 +12,97 @@
 let filter_system = name: if name == utils.lib.system.i686-linux then false else true;
 in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems) ( system:
   let
+    baseModules = [
+      # make flake inputs accessiable in NixOS
+      { _module.args.inputs = inputs; }
+      {
+        imports = [
+          ({ pkgs, ... }: {
+            nix = {
+              extraOptions = ''
+                experimental-features = nix-command flakes
+              '';
+
+              settings = {
+                substituters = [
+                  "https://cache.dynamicdiscord.de"
+                  "https://cache.nixos.org/"
+                ];
+                trusted-public-keys = [
+                  "cache.dynamicdiscord.de:DKueZicqi2NhJJXz9MYgUbiyobMs10fTyHCgAUibRP4="
+                ];
+                trusted-users = [ "root" "@wheel" ];
+              };
+            };
+          })
+          sops-nix.nixosModules.sops
+          #microvm.nixosModules.microvm
+        ];
+      }
+    ];
+    defaultModules = baseModules;
+
+  makeMicroVM = hostName: ipv4Addr: macAddr: modules: [
+    self.nixosModules.malobeo.metrics
+    {
+      microvm = {
+        hypervisor = "cloud-hypervisor";
+        mem = 2560;
+        shares = [
+          {
+            source = "/nix/store";
+            mountPoint = "/nix/.ro-store";
+            tag = "store";
+            proto = "virtiofs";
+            socket = "store.socket";
+          }
+          {
+            source = "/var/lib/microvms/${hostName}/etc";
+            mountPoint = "/etc";
+            tag = "etc";
+            proto = "virtiofs";
+            socket = "etc.socket";
+          }
+          {
+            source = "/var/lib/microvms/${hostName}/var";
+            mountPoint = "/var";
+            tag = "var";
+            proto = "virtiofs";
+            socket = "var.socket";
+          }
+        ];
+
+        interfaces = [
+          {
+            type = "tap";
+            id = "vm-${hostName}";
+            mac = "${macAddr}";
+          }
+        ];
+      };
+
+      malobeo.metrics = {
+        enable = true;
+        enablePromtail = true;
+        logNginx = false;
+        lokiHost = "10.0.0.14";
+      };
+      
+      systemd.network.enable = true;
+      
+      systemd.network.networks."20-lan" = {
+        matchConfig.Type = "ether";
+        networkConfig = {
+          Address = [ "${ipv4Addr}/24" ];
+          Gateway = "10.0.0.1";
+          DNS = ["1.1.1.1"];
+          DHCP = "no";
+        };
+      };
+    }
+  ] ++ defaultModules ++ modules;
+
+
     pkgs-unstable = nixpkgs-unstable.legacyPackages."${system}";
     pkgs = nixpkgs.legacyPackages."${system}";
 
@@ -20,7 +111,17 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
         mem = pkgs.lib.mkForce 4096;
         hypervisor = pkgs.lib.mkForce "qemu";
         socket = pkgs.lib.mkForce null;
-        shares = pkgs.lib.mkForce ([
+
+
+        #needed for hosts that deploy imperative microvms (for example fanny)
+        writableStoreOverlay = pkgs.lib.mkIf options.writableStore "/nix/.rw-store";
+        volumes = pkgs.lib.mkIf options.writableStore [ {
+          image = "nix-store-overlay.img";
+          mountPoint = self.nixosConfigurations.${hostname}.config.microvm.writableStoreOverlay;
+          size = 2048;
+        } ];
+
+        shares = pkgs.lib.mkForce (pkgs.lib.optionals (!options.writableStore) [
           {
             tag = "ro-store";
             source = "/nix/store";
@@ -34,11 +135,18 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
             tag = "var";
           }
         ]);
+
         interfaces = pkgs.lib.mkIf (!options.withNetworking) (pkgs.lib.mkForce [{
           type = "user";
           id = "eth0";
           mac = "02:23:de:ad:be:ef";
         }]);
+
+        #if networking is disabled forward port 80 to still have access to webservices
+        forwardPorts = pkgs.lib.mkIf (!options.withNetworking) (pkgs.lib.mkForce [
+          { from = "host"; host.port = 8080; guest.port = 80; }
+        ]);
+
       };
 
       fileSystems = {
@@ -86,15 +194,59 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
       }];
     };
 
-    buildVM = host: networking: sopsDummy: disableDisko: varPath: (self.nixosConfigurations.${host}.extendModules {
+    buildVM = host: networking: sopsDummy: disableDisko: varPath: writableStore: (self.nixosConfigurations.${host}.extendModules {
         modules = [
-          (vmMicroVMOverwrites host { withNetworking = networking; varPath = "${varPath}"; })
+          (vmMicroVMOverwrites host { 
+            withNetworking = networking; 
+            varPath = "${varPath}"; 
+            writableStore = writableStore; })
           (if sopsDummy then (vmSopsOverwrites host) else {})
           (if disableDisko then vmDiskoOverwrites else {})
         ] ++ pkgs.lib.optionals (! self.nixosConfigurations.${host}.config ? microvm) [
-          microvm.nixosModules.microvm
-        ];
-      }).config.microvm.declaredRunner;
+          #microvm.nixosModules.microvm
+        ] ++ pkgs.lib.optionals (self.nixosConfigurations.${host}.config ? services.malobeo.microvm.deployHosts) [
+          #microvm.nixosModules.host
+          {
+          services.malobeo.microvm.deployHosts = pkgs.lib.mkForce [];
+          systemd.tmpfiles.rules = builtins.concatLists (map (name: [
+            "q /var/lib/microvms/${name}/var 0755 root root - -"
+            "q /var/lib/microvms/${name}/etc 0755 root root - -"
+            "q /var/${name}/wow/it/works 0755 root root - -"
+            "q /var/lib/${name} 0755 root root - -"
+            "d /${name} 0755 root root - -"
+          ]) self.nixosConfigurations.${host}.config.services.malobeo.microvm.deployHosts);
+
+
+          microvm.vms = 
+          let
+            # Map the values to each hostname to then generate an Attrset using listToAttrs
+            mapperFunc = name: { inherit name; value = {
+              #pkgs = import self.nixosConfigurations.${name}.config.nixpkgs;
+
+              #pkgs = (buildVM name networking sopsDummy false "" false).config.nixpkgs;
+              #config = (buildVM name networking sopsDummy false "" false);
+              #pkgs = pkgs;
+              #config = self.nixosConfigurations.${name};
+              specialArgs.inputs = inputs;
+              specialArgs.self = self;
+              config = {
+                imports = (makeMicroVM "${name}" "10.0.0.11" "D0:E5:CA:F0:D7:E7" [
+              
+                  #(vmMicroVMOverwrites name { 
+                  #  withNetworking = true; 
+                  #  varPath = ""; 
+                  #  writableStore = false; })
+                  (if sopsDummy then (vmSopsOverwrites name) else {})
+
+                  
+                ]);
+
+              };
+            }; };
+          in
+          builtins.listToAttrs (map mapperFunc self.nixosConfigurations.${host}.config.services.malobeo.microvm.deployHosts);
+        }];
+      });
   in
   {
     devShells.default =
@@ -157,6 +309,7 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
             echo "--networking setup interfaces. requires root and hostbridge enabled on the host"
             echo "--dummy-secrets run vm with dummy sops secrets"
             echo "--no-disko disable disko and initrd secrets. needed for real hosts like fanny"
+            echo "--writable-store enables writable store. necessary for host with nested imperative microvms like fanny"
             echo "--var path to directory that should be shared as /var. may require root otherwise some systemd units fail within vm. if dir is empty vm will populate"
             exit 1
         }
@@ -172,6 +325,7 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
         NETWORK=false
         DUMMY_SECRETS=false
         NO_DISKO=false
+        RW_STORE=false
         VAR_PATH=""
         
         # check argws
@@ -181,6 +335,7 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
                 --networking) NETWORK=true ;;
                 --dummy-secrets) DUMMY_SECRETS=true ;;
                 --no-disko) NO_DISKO=true ;;
+                --writable-store) RW_STORE=true ;;
                 --var) 
                   if [[ -n "$2" && ! "$2" =~ ^- ]]; then
                       VAR_PATH="$2"
@@ -198,11 +353,12 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
         echo "enable networking: $NETWORK"
         echo "deploy dummy secrets: $DUMMY_SECRETS"
         echo "disable disko and initrd secrets: $NO_DISKO"
+        echo "use writable store: $RW_STORE"
         if [ -n "$VAR_PATH" ]; then
           echo "sharing var directory: $VAR_PATH"
         fi
         
-        ${pkgs.nix}/bin/nix run --show-trace --impure --expr "((builtins.getFlake \"$(pwd)\").vmBuilder.x86_64-linux \"$HOSTNAME\" $NETWORK $DUMMY_SECRETS $NO_DISKO \"$VAR_PATH\")"
+        ${pkgs.nix}/bin/nix run --show-trace --impure --expr "((builtins.getFlake \"$(pwd)\").vmBuilder.x86_64-linux \"$HOSTNAME\" $NETWORK $DUMMY_SECRETS $NO_DISKO \"$VAR_PATH\" $RW_STORE).config.microvm.declaredRunner"
       '';
     };