fix(microvm): run k3s guests from their nixosConfigurations entry (#483)

Assisted-by: DeepSeek Harness 0.2.1-rc.2 (claude-opus-5-5)

hosts/12kingdoms-shoryu/microvm.nix

@@ -1,10 +1,5 @@
 {
   microvm,
-  myvars,
-  mylib,
-  agenix,
-  mysecrets,
-  myNurPkgs,
   inputs,
   ...
 }:
@@ -12,36 +7,18 @@
   # Run the k3s-test VMs as MicroVMs instead of KubeVirt domains.
   imports = [ microvm.nixosModules.host ];
 
+  # Each guest runs its `nixosConfigurations` entry, the system that `just test`
+  # and `just microvm-deploy` see, instead of a second evaluation on the host.
   microvm.vms.k3s-test-1-master-1 = {
     autostart = true;
     restartIfChanged = true;
-    specialArgs = {
-      inherit
-        inputs
-        myvars
-        mylib
-        agenix
-        mysecrets
-        myNurPkgs
-        ;
-    };
-    config.imports = [ ../k8s/k3s-test-1-master-1 ];
+    evaluatedConfig = inputs.self.nixosConfigurations.k3s-test-1-master-1;
   };
 
   microvm.vms.k3s-test-1-worker-1 = {
     autostart = true;
     restartIfChanged = true;
-    specialArgs = {
-      inherit
-        inputs
-        myvars
-        mylib
-        agenix
-        mysecrets
-        myNurPkgs
-        ;
-    };
-    config.imports = [ ../k8s/k3s-test-1-worker-1 ];
+    evaluatedConfig = inputs.self.nixosConfigurations.k3s-test-1-worker-1;
   };
 
   # Attach the guest's tap to the VM bridge, the same way the physical NIC is

hosts/12kingdoms-shushou/microvm.nix

@@ -1,10 +1,5 @@
 {
   microvm,
-  myvars,
-  mylib,
-  agenix,
-  mysecrets,
-  myNurPkgs,
   inputs,
   ...
 }:
@@ -12,36 +7,18 @@
   # Run the k3s-test VMs as MicroVMs instead of KubeVirt domains.
   imports = [ microvm.nixosModules.host ];
 
+  # Each guest runs its `nixosConfigurations` entry, the system that `just test`
+  # and `just microvm-deploy` see, instead of a second evaluation on the host.
   microvm.vms.k3s-test-1-master-3 = {
     autostart = true;
     restartIfChanged = true;
-    specialArgs = {
-      inherit
-        inputs
-        myvars
-        mylib
-        agenix
-        mysecrets
-        myNurPkgs
-        ;
-    };
-    config.imports = [ ../k8s/k3s-test-1-master-3 ];
+    evaluatedConfig = inputs.self.nixosConfigurations.k3s-test-1-master-3;
   };
 
   microvm.vms.k3s-test-1-worker-3 = {
     autostart = true;
     restartIfChanged = true;
-    specialArgs = {
-      inherit
-        inputs
-        myvars
-        mylib
-        agenix
-        mysecrets
-        myNurPkgs
-        ;
-    };
-    config.imports = [ ../k8s/k3s-test-1-worker-3 ];
+    evaluatedConfig = inputs.self.nixosConfigurations.k3s-test-1-worker-3;
   };
 
   # Attach the guest's tap to the VM bridge, the same way the physical NIC is

hosts/12kingdoms-youko/microvm.nix

@@ -1,10 +1,5 @@
 {
   microvm,
-  myvars,
-  mylib,
-  agenix,
-  mysecrets,
-  myNurPkgs,
   inputs,
   ...
 }:
@@ -12,20 +7,12 @@
   # Run the k3s-test VMs as MicroVMs instead of KubeVirt domains.
   imports = [ microvm.nixosModules.host ];
 
+  # Each guest runs its `nixosConfigurations` entry, the system that `just test`
+  # and `just microvm-deploy` see, instead of a second evaluation on the host.
   microvm.vms.k3s-test-1-master-2 = {
     autostart = true;
     restartIfChanged = true;
-    specialArgs = {
-      inherit
-        inputs
-        myvars
-        mylib
-        agenix
-        mysecrets
-        myNurPkgs
-        ;
-    };
-    config.imports = [ ../k8s/k3s-test-1-master-2 ];
+    evaluatedConfig = inputs.self.nixosConfigurations.k3s-test-1-master-2;
   };
 
   # Moved here from shushou after the SSD swap: the 5625U there is weaker and has
@@ -33,17 +20,7 @@
   microvm.vms.k3s-test-1-worker-2 = {
     autostart = true;
     restartIfChanged = true;
-    specialArgs = {
-      inherit
-        inputs
-        myvars
-        mylib
-        agenix
-        mysecrets
-        myNurPkgs
-        ;
-    };
-    config.imports = [ ../k8s/k3s-test-1-worker-2 ];
+    evaluatedConfig = inputs.self.nixosConfigurations.k3s-test-1-worker-2;
   };
 
   # Attach the guest's tap to the VM bridge, the same way the physical NIC is

outputs/README.md

@@ -48,9 +48,9 @@ them. Others name specific hosts — or a name prefix, like `k3s-api-endpoint`,
 `k3s-test-1-*` configuration — and only cover a new host if you add it.
 
 | Kind                | Tests                                                                                                                                                                                                                                                                                                                                          |
-| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Every configuration | `hostname`, `kernel`, `nix-system-features`, `security-apparmor`, `security-container-groups`, `security-exporters`, `security-firewall`, `security-k3s-kubeconfig`, `security-k3s-pod-firewall`, `security-kernel`, `security-ssh-x11`                                                                                                        |
-| Named hosts only    | `btrbk`, `cpu-power`, `home-manager`, `home-manager-xdg`, `computer-use-headless`, `k3s-api-endpoint`, `k3s-node-home-manager`, `idols-ai-gpu`, `idols-ai-net`, `idols-ai-voice-input`, `idols-aquamarine`, `security-postgres-auth`, `youko-metrics`, `ups-metrics`, `shoukei-logind`, `mihomo-dns`, `vm-host-power`, `colmena-parity` |
+| Named hosts only    | `btrbk`, `cpu-power`, `home-manager`, `home-manager-xdg`, `computer-use-headless`, `k3s-api-endpoint`, `k3s-node-home-manager`, `idols-ai-gpu`, `idols-ai-net`, `idols-ai-voice-input`, `idols-aquamarine`, `security-postgres-auth`, `youko-metrics`, `ups-metrics`, `shoukei-logind`, `mihomo-dns`, `colmena-parity`, `microvm-guest-parity` |
 
 `hostname` expects each configuration's `networking.hostName` to equal its name. Niri desktop
 configurations are the exception (`ai-niri` → `ai`, `shoukei-niri` → `shoukei`) and are listed in

outputs/x86_64-linux/tests/microvm-guest-parity/expected.nix

@@ -0,0 +1,19 @@
+{
+  lib,
+  outputs,
+}:
+let
+  vmHosts = [
+    "shoryu"
+    "shushou"
+    "youko"
+  ];
+in
+lib.mergeAttrsList (
+  map (
+    host:
+    lib.mapAttrs' (
+      guest: _: lib.nameValuePair "${host}/${guest}" true
+    ) outputs.nixosConfigurations.${host}.config.microvm.vms
+  ) vmHosts
+)

outputs/x86_64-linux/tests/microvm-guest-parity/expr.nix

@@ -0,0 +1,29 @@
+{
+  lib,
+  outputs,
+}:
+# A VM host must install the guest system that nixosConfigurations evaluates,
+# the one `just microvm-deploy` ships.
+let
+  inherit (outputs) nixosConfigurations;
+  # hasInfix matches with a regex, which rejects strings that carry store context.
+  plain = builtins.unsafeDiscardStringContext;
+  vmHosts = [
+    "shoryu"
+    "shushou"
+    "youko"
+  ];
+in
+lib.mergeAttrsList (
+  map (
+    host:
+    lib.mapAttrs' (
+      guest: _:
+      lib.nameValuePair "${host}/${guest}" (
+        lib.hasInfix (plain "${nixosConfigurations.${guest}.config.system.build.toplevel}") (
+          plain nixosConfigurations.${host}.config.systemd.services."install-microvm-${guest}".script
+        )
+      )
+    ) nixosConfigurations.${host}.config.microvm.vms
+  ) vmHosts
+)