refactor: scope host tools, locate and mDNS by purpose (#356)

lib/genMicrovmGuestModule.nix

@@ -126,4 +126,12 @@ in
   };
 
   system.stateVersion = "26.05";
+
+  # MicroVM guests share the host's store and have no physical hardware to
+  # inspect, nothing to trace, no persisted /var/cache for a `locate` index,
+  # and nothing to advertise over mDNS.
+  modules.hardwareTools.enable = false;
+  modules.debugTools.enable = false;
+  modules.locate.enable = false;
+  modules.mdns.enable = false;
 }

modules/nixos/base/locate.nix

@@ -1,13 +1,30 @@
-{ pkgs, ... }:
 {
-  # Whole-filesystem filename search (`locate`), backed by plocate. It complements
+  lib,
-  # `nix-index`/`nix-locate`, which only index the nix store.
+  config,
-  #
+  pkgs,
-  # The database lives at /var/cache/locatedb. Hosts with an ephemeral root must
+  ...
-  # persist /var/cache as a directory (see hosts/idols-ai/preservation.nix): plocate
+}:
-  # replaces the DB via a temp file + rename, which fails on a bind-mounted file.
+let
-  services.locate = {
+  cfg = config.modules.locate;
-    enable = true;
+in
-    package = pkgs.plocate;
+{
+  options.modules.locate.enable = lib.mkEnableOption ''
+    Whole-filesystem filename search (`locate`), backed by plocate. It
+    complements `nix-index`/`nix-locate`, which only index the nix store.
+
+    The database lives at /var/cache/locatedb. Hosts with an ephemeral root
+    must persist /var/cache as a directory (see hosts/idols-ai/preservation.nix):
+    plocate replaces the DB via a temp file + rename, which fails on a
+    bind-mounted file.
+
+    Off by default: the daily `updatedb` scan is only worth it on hosts that
+    persist /var/cache and actually use `locate` (currently idols-ai).
+  '';
+
+  config = lib.mkIf cfg.enable {
+    services.locate = {
+      enable = true;
+      package = pkgs.plocate;
+    };
   };
 }

modules/nixos/base/networking/avahi.nix

@@ -1,21 +0,0 @@
-{
-  # Network discovery on a local network, mDNS
-  # With this enabled, you can access your machine at <hostname>.local
-  # it's more convenient than using the IP address.
-  # https://avahi.org/
-  services.avahi = {
-    enable = true;
-    nssmdns4 = true;
-    publish = {
-      enable = true;
-      domain = true;
-      userServices = true;
-    };
-  };
-
-  # avahi and systemd-resolved both run an mDNS responder, which makes mDNS
-  # unreliable ("Detected another IPv4/IPv6 mDNS stack running on this host").
-  # Keep avahi (needed for DNS-SD, e.g. CUPS printer discovery) and turn off
-  # resolved's own mDNS.
-  services.resolved.settings.Resolve.MulticastDNS = false;
-}

modules/nixos/base/networking/mdns.nix

@@ -0,0 +1,43 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.modules.mdns;
+in
+{
+  options.modules.mdns.enable =
+    lib.mkEnableOption ''
+      mDNS/DNS-SD responder, backed by avahi: `<hostname>.local` access and CUPS
+      printer discovery.
+
+      On by default for physical hosts; MicroVM guests turn it off since they
+      have nothing to advertise.
+    ''
+    // {
+      default = true;
+    };
+
+  config = lib.mkIf cfg.enable {
+    # Network discovery on a local network, mDNS
+    # With this enabled, you can access your machine at <hostname>.local
+    # it's more convenient than using the IP address.
+    # https://avahi.org/
+    services.avahi = {
+      enable = true;
+      nssmdns4 = true;
+      publish = {
+        enable = true;
+        domain = true;
+        userServices = true;
+      };
+    };
+
+    # avahi and systemd-resolved both run an mDNS responder, which makes mDNS
+    # unreliable ("Detected another IPv4/IPv6 mDNS stack running on this host").
+    # Keep avahi (needed for DNS-SD, e.g. CUPS printer discovery) and turn off
+    # resolved's own mDNS.
+    services.resolved.settings.Resolve.MulticastDNS = false;
+  };
+}

modules/nixos/base/packages.nix

@@ -1,35 +1,62 @@
-{ pkgs, ... }:
 {
-  # List packages installed in system profile. To search, run:
+  lib,
-  # $ nix search wget
+  config,
-  environment.systemPackages = with pkgs; [
+  pkgs,
-    # system call monitoring
+  ...
-    strace # system call monitoring
+}:
-    lsof # list open files
+let
+  inherit (config.modules) hardwareTools debugTools;
+in
+{
+  options.modules.hardwareTools.enable =
+    lib.mkEnableOption ''
+      Basic hardware and disk introspection tools (lm_sensors, pciutils,
+      usbutils, dmidecode, parted, smartmontools, nvme-cli).
 
-    # ebpf related tools
+      On by default for physical hosts; MicroVM guests turn it off since they
-    # https://github.com/bpftrace/bpftrace
+      share the host's store and cannot use any of it.
-    bpftrace # powerful tracing tool
+    ''
+    // {
+      default = true;
+    };
 
-    # system monitoring
+  options.modules.debugTools.enable = lib.mkEnableOption ''
-    sysstat
+    Tracing and benchmarking tools (strace, bpftrace, sysstat, iotop-c,
-    iotop-c
+    sysbench and the BCC tools).
-    sysbench
-    pv # pipe view
 
-    # system tools
+    Off by default: opt in on hosts where you actually profile with them
-    psmisc # killall/pstree/prtstat/fuser/...
+    (currently idols-ai).
-    lm_sensors # for `sensors` command
+  '';
-    ethtool
-    pciutils # lspci
-    usbutils # lsusb
-    dmidecode # a tool that reads information about your system's hardware from the BIOS according to the SMBIOS/DMI standard
-    parted
-    smartmontools # smartctl -a /dev/nvme0n1
-    nvme-cli
-  ];
 
-  # BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
+  config = {
-  # https://github.com/iovisor/bcc
+    environment.systemPackages =
-  programs.bcc.enable = true;
+      with pkgs;
+      [
+        # broadly useful on every host
+        lsof # list open files
+        psmisc # killall/pstree/prtstat/fuser/...
+        ethtool
+        pv # pipe view
+      ]
+      ++ lib.optionals hardwareTools.enable [
+        lm_sensors # `sensors` command
+        pciutils # lspci
+        usbutils # lsusb
+        dmidecode # SMBIOS/DMI hardware info (from the BIOS)
+        parted
+        smartmontools # smartctl -a /dev/nvme0n1
+        nvme-cli
+      ]
+      ++ lib.optionals debugTools.enable [
+        strace # system call tracing
+        bpftrace # eBPF tracing, https://github.com/bpftrace/bpftrace
+        sysstat
+        iotop-c
+        sysbench
+      ];
+
+    # BCC - tools for BPF-based IO/network analysis/monitoring
+    # https://github.com/iovisor/bcc
+    programs.bcc.enable = debugTools.enable;
+  };
 }

modules/nixos/desktop.nix

@@ -27,6 +27,12 @@ in
     # Mesa userspace (OpenGL/Vulkan) for every GUI host.
     {
       hardware.graphics.enable = true;
+
+      # Desktops opt in to the tracing/benchmark tooling and the
+      # whole-filesystem `locate` index (both off by default; see
+      # modules/nixos/base/{packages,locate}.nix).
+      modules.debugTools.enable = true;
+      modules.locate.enable = true;
     }
 
     (mkIf cfgWayland.enable {

modules/nixos/server/qemu-guest.nix

@@ -22,6 +22,9 @@
     # disable backups in the VM
     modules.btrbk.enable = lib.mkForce false;
 
+    # VM guest: no physical hardware to inspect.
+    modules.hardwareTools.enable = lib.mkForce false;
+
     boot.growPartition = true;
     boot.kernelParams = [ "console=ttyS0" ];
     boot.loader.grub.device = "/dev/vda";