feat: migrate all nixos services from idols to 12kingdoms

hosts/12kingdoms-suzu/microvm/mitsuha/default.nix

@@ -0,0 +1,67 @@
+{mylib, ...}: {
+  imports =
+    (mylib.scanPaths ./.)
+    ++ [
+      ../../../../modules/nixos/base/ssh.nix
+      ../../../../modules/nixos/base/user-group.nix
+      ../../../../modules/base.nix
+    ];
+
+  microvm = {
+    mem = 1024; # RAM allocation in MB
+    vcpu = 1; # Number of Virtual CPU cores
+
+    interfaces = [
+      {
+        type = "tap";
+        id = "vm-mitsuha"; # should be prefixed with "vm-"
+        mac = "02:00:00:00:00:02"; # Unique MAC address
+      }
+    ];
+
+    # Block device images for persistent storage
+    # microvm use tmpfs for root(/), so everything else
+    # is ephemeral and will be lost on reboot.
+    #
+    # you can check this by running `df -Th` & `lsblk` in the VM.
+    volumes = [
+      {
+        mountPoint = "/var";
+        image = "var.img";
+        size = 512;
+      }
+      {
+        mountPoint = "/etc";
+        image = "etc.img";
+        size = 50;
+      }
+    ];
+
+    # shares can not be set to `neededForBoot = true;`
+    # so if you try to use a share in boot script(such as system.activationScripts), it will fail!
+    shares = [
+      {
+        # It is highly recommended to share the host's nix-store
+        # with the VMs to prevent building huge images.
+        # a host's /nix/store will be picked up so that no
+        # squashfs/erofs will be built for it.
+        #
+        # by this way, /nix/store is readonly in the VM,
+        # and thus the VM can't run any command that modifies
+        # the store. such as nix build, nix shell, etc...
+        # if you want to run nix commands in the VM, see
+        # https://github.com/astro/microvm.nix/blob/main/doc/src/shares.md#writable-nixstore-overlay
+        tag = "ro-store"; # Unique virtiofs daemon tag
+        proto = "virtiofs"; # virtiofs is faster than 9p
+        source = "/nix/store";
+        mountPoint = "/nix/.ro-store";
+      }
+    ];
+
+    hypervisor = "qemu";
+    # Control socket for the Hypervisor so that a MicroVM can be shutdown cleanly
+    socket = "control.socket";
+  };
+
+  system.stateVersion = "23.11";
+}

hosts/12kingdoms-suzu/microvm/mitsuha/networking.nix

@@ -0,0 +1,19 @@
+{myvars, ...}: let
+  hostName = "mitsuha";
+  inherit (myvars.networking) mainGateway nameservers;
+  inherit (myvars.networking.hostsAddr.${hostName}) ipv4;
+
+  ipv4WithMask = "${ipv4}/24";
+in {
+  systemd.network.enable = true;
+
+  systemd.network.networks."20-lan" = {
+    matchConfig.Type = "ether";
+    networkConfig = {
+      Address = [ipv4WithMask];
+      Gateway = mainGateway;
+      DNS = nameservers;
+      DHCP = "no";
+    };
+  };
+}

hosts/12kingdoms-suzu/microvm/mitsuha/tailscale.nix

@@ -0,0 +1,42 @@
+{pkgs, ...}:
+# =============================================================
+#
+# Tailscale - your own private network(VPN) that uses WireGuard
+#
+# It's open source and free for personal use,
+# and it's really easy to setup and use.
+# Tailscale has great client coverage for Linux, windows, Mac, android, and iOS.
+# Tailscale is more mature and stable compared to other alternatives such as netbird/netmaker.
+# Maybe I'll give netbird/netmaker a try when they are more mature, but for now, I'm sticking with Tailscale.
+#
+# How to use:
+#  1. Create a Tailscale account at https://login.tailscale.com
+#  2. Login via `tailscale login`
+#  3. join into your Tailscale network via `tailscale up --advertise-routes 192.168.5.0/24`
+#  4. If you prefer automatic connection to Tailscale, use the `authKeyFile` option` in the config below.
+#
+# Status Data:
+#   `journalctl -u tailscaled` shows tailscaled's logs
+#   logs indicate that tailscale store its data in /var/lib/tailscale
+#   which is already persistent across reboots(via impermanence.nix)
+#
+# References:
+# https://github.com/NixOS/nixpkgs/blob/nixos-23.11/nixos/modules/services/networking/tailscale.nix
+#
+# =============================================================
+{
+  # make the tailscale command usable to users
+  environment.systemPackages = [pkgs.tailscale];
+
+  # enable the tailscale service
+  services.tailscale = {
+    enable = true;
+    port = 41641;
+    interfaceName = "tailscale0";
+    # allow the Tailscale UDP port through the firewall
+    openFirewall = true;
+    useRoutingFeatures = "server";
+    extraUpFlags = "--advertise-routes 192.168.5.0/24";
+    # authKeyFile = "/var/lib/tailscale/authkey";
+  };
+}