feat: enable libvirt(qemu/kvm) for ai

hosts/idols/ai/default.nix

@@ -15,6 +15,7 @@
     ../../../modules/nixos/fhs-fonts.nix
     # ../../../modules/nixos/hyprland.nix
     ../../../modules/nixos/i3.nix
+    ../../../modules/nixos/libvirt.nix
     ../../../modules/nixos/core-desktop.nix
     ../../../modules/nixos/remote-building.nix
     ../../../modules/nixos/user-group.nix

modules/nixos/libvirt.nix

@@ -0,0 +1,38 @@
+
+{ lib, pkgs, ... }:
+
+{
+  ###################################################################################
+  #
+  #  Enable Libvirt(QEMU/KVM)
+  #
+  ###################################################################################
+
+  virtualisation = {
+    libvirtd = {
+      enable = true;
+      # hanging this option to false may cause file permission issues for existing guests. 
+      # To fix these, manually change ownership of affected files in /var/lib/libvirt/qemu to qemu-libvirtd.
+      qemu.runAsRoot = true;
+    };
+
+    qemu = {
+      # default to QEMU/KVM
+      package = pkgs.qemu_kvm;
+    };
+  };
+  programs.dconf.enable = true;
+  environment.systemPackages = with pkgs; [ virt-manager ];
+
+  boot.kernelModules = [ "kvm-amd" "kvm-intel" ];
+  # Enable nested virsualization, required by security containers and nested vm.
+  boot.extraModprobeConfig = "options kvm_intel nested=1";  # for intel cpu
+  # boot.extraModprobeConfig = "options kvm_amd nested=1";  # for amd cpu
+
+
+  # NixOS VM should enable this:
+  # services.qemuGuest = {
+  #   enable = true;
+  #   package = pkgs.qemu_kvm.ga;
+  # };
+}

modules/nixos/user-group.nix

@@ -13,7 +13,16 @@
     home = "/home/ryan";
     isNormalUser = true;
     description = "ryan";
-    extraGroups = [ "ryan" "users" "networkmanager" "wheel" "docker" "wireshark" "adbusers" ];
+    extraGroups = [ 
+      "ryan" 
+      "users"
+      "networkmanager" 
+      "wheel"
+      "docker"
+      "wireshark"
+      "adbusers"
+      "libvirtd"
+    ];
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDiipi59EnVbi6bK1bGrcbfEM263wgdNfbrt6VBC1rHx ryan@ai-idols"
     ];