fix ethernet device pci slot conflict

This fixes the following error during stage 1:
9pnet_virtio: no channels available for device nix-store

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,4 +1,4 @@
-Makes sure these boxes are checked before submitting your pull request -- thank you!
+<!-- Makes sure these boxes are checked before submitting your pull request -- thank you! -->
 
 - [ ] I tested it locally.
 - [ ] I tried to run at least one application VM and it works.

.github/workflows/ubuntu.yml

@@ -1,6 +1,6 @@
 name: Ubuntu
 
-on: [push]
+on: [push, pull_request]
 
 jobs:
   build:
@@ -14,3 +14,20 @@ jobs:
 
     - name: Build
       run: go build
+
+  nix-build:
+    name: nix-build
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v1
+
+    - name: Install Nix
+      run: |
+        curl -L https://nixos.org/nix/install | sh
+        . ~/.nix-profile/etc/profile.d/nix.sh
+        nix-channel --update
+
+    - name: Build
+      run: |
+        . ~/.nix-profile/etc/profile.d/nix.sh
+        make nix

.gitignore

@@ -1 +1 @@
-nix/local.nix
+appvm

Makefile

@@ -0,0 +1,5 @@
+go:
+	go build
+
+nix:
+	nix-build #-E '((import <nixpkgs> {}).callPackage (import ./default.nix) { })' --option sandbox true --no-out-link

README.md

@@ -1,5 +1,4 @@
-[![Donate](https://img.shields.io/badge/Donate-PayPal-green.svg)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=R8W2UQPZ5X5JE&source=url)
-[![Donate](https://img.shields.io/badge/Donate-BitCoin-green.svg)](https://blockchair.com/bitcoin/address/bc1q23fyuq7kmngrgqgp6yq9hk8a5q460f39m8nv87)
+[![Documentation Status](https://readthedocs.org/projects/appvm/badge/?version=latest)](https://appvm.readthedocs.io/en/latest/?badge=latest)
 
 # Nix application VMs: security through virtualization
 
@@ -7,55 +6,24 @@ Simple application VMs (hypervisor-based sandbox) based on Nix package manager.
 
 Uses one **read-only** /nix directory for all appvms. So creating a new appvm (but not first) is just about one minute.
 
-![appvm screenshot](screenshots/2018-07-05.png)
+![appvm screenshot](https://gateway.ipfs.io/ipfs/QmetVp2LRwcy3baxuAjDgBPwv5ych5kRfXeULoNpQAFsaP)
 
-## Dependencies
+## Installation
 
-    $ sudo apt install golang virt-manager curl git
-    $ sudo usermod -a -G libvirt $USER
+See [related documentation](https://appvm.readthedocs.io/en/latest/installation.html).
 
-    $ echo 'export GOPATH=$HOME/go' >> ~/.bash_profile
-    $ echo 'export PATH=$PATH:$GOPATH/bin' >> ~/.bash_profile
-    $ echo 'source ~/.bash_profile' >> ~/.bashrc
-    $ source ~/.bash_profile
+## Usage
 
-You need to **relogin** if you install virt-manager (libvirt) first time.
-
-## Install Nix package manager
-
-    $ sudo mkdir -m 0755 /nix && sudo chown $USER /nix
-    $ curl https://nixos.org/nix/install | sh
-    $ . ~/.nix-profile/etc/profile.d/nix.sh
-
-## Libvirt from user (required if you need access to shared files)
-
-    $ echo user = "\"$USER\"" | sudo tee -a /etc/libvirt/qemu.conf
-    $ sudo systemctl restart libvirtd
-
-## Install appvm tool
-
-    $ go get code.dumpstack.io/tools/appvm
-
-## Update appvm tool
-
-    $ go get -u code.dumpstack.io/tools/appvm
-
-## Search for applications
+### Search for applications
 
     $ appvm search chromium
 
-## Generate new application
-
-	$ nix-channel --list
-	nix https://nixos.org/channels/nixos-unstable
-    $ appvm generate nix.firefox
-
-## Run application
+### Run application
 
     $ appvm start chromium
     $ # ... long wait for first time, because we need to collect a lot of packages
 
-## Synchronize remote repos for applications
+### Synchronize remote repos for applications
 
     $ appvm sync
 
@@ -63,17 +31,17 @@ You can customize local settings in **~/.config/appvm/nix/local.nix**.
 
 Default hotkey to release cursor: ctrl+alt.
 
-## Shared directory
+### Shared directory
 
     $ ls appvm/chromium
     foo.tar.gz
     bar.tar.gz
 
-## Close VM
+### Close VM
 
     $ appvm stop chromium
 
-## Automatic ballooning
+### Automatic ballooning
 
 Add this command:
 

appvm.go

@@ -13,6 +13,7 @@ import (
 	"io"
 	"io/ioutil"
 	"log"
+	"math/rand"
 	"net"
 	"os"
 	"os/exec"
@@ -30,6 +31,14 @@ import (
 	kingpin "gopkg.in/alecthomas/kingpin.v2"
 )
 
+type networkModel int
+
+const (
+	networkOffline networkModel = iota
+	networkQemu    networkModel = iota
+	networkLibvirt networkModel = iota
+)
+
 func list(l *libvirt.Libvirt) {
 	domains, err := l.Domains()
 	if err != nil {
@@ -105,10 +114,10 @@ func streamStdOutErr(command *cmd.Cmd) {
 	}
 }
 
-func generateVM(name string, verbose bool) (realpath, reginfo, qcow2 string, err error) {
+func generateVM(path, name string, verbose bool) (realpath, reginfo, qcow2 string, err error) {
 	command := cmd.NewCmdOptions(cmd.Options{Buffered: false, Streaming: true},
 		"nix-build", "<nixpkgs/nixos>", "-A", "config.system.build.vm",
-		"-I", "nixos-config=nix/"+name+".nix", "-I", ".")
+		"-I", "nixos-config="+path+"/nix/"+name+".nix", "-I", path)
 
 	if verbose {
 		go streamStdOutErr(command)
@@ -132,8 +141,13 @@ func generateVM(name string, verbose bool) (realpath, reginfo, qcow2 string, err
 		return
 	}
 
-	bytes, err := ioutil.ReadFile("result/bin/run-nixos-vm")
-	if err != nil {
+	matches, err := filepath.Glob("result/bin/run-*-vm")
+	if err != nil || len(matches) != 1 {
+		return
+	}
+
+	bytes, err := ioutil.ReadFile(matches[0])
+	if err != nil || len(matches) != 1 {
 		return
 	}
 
@@ -147,13 +161,9 @@ func generateVM(name string, verbose bool) (realpath, reginfo, qcow2 string, err
 
 	syscall.Unlink("result")
 
-	qcow2 = os.Getenv("HOME") + "/appvm/.fake.qcow2"
-	if _, err = os.Stat(qcow2); os.IsNotExist(err) {
-		system.System("qemu-img", "create", "-f", "qcow2", qcow2, "512M")
-		err = os.Chmod(qcow2, 0400) // qemu run with -snapshot, we only need it for create /dev/vda
-		if err != nil {
-			return
-		}
+	qcow2 = os.Getenv("HOME") + "/appvm/." + name + ".fake.qcow2"
+	if _, e := os.Stat(qcow2); os.IsNotExist(e) {
+		system.System("qemu-img", "create", "-f", "qcow2", qcow2, "40M")
 	}
 
 	return
@@ -165,23 +175,16 @@ func isRunning(l *libvirt.Libvirt, name string) bool {
 	return err == nil
 }
 
-func generateAppVM(l *libvirt.Libvirt, appvmPath, name string, verbose,
-	online bool) (err error) {
+func generateAppVM(l *libvirt.Libvirt,
+	nixName, vmName, appvmPath, sharedDir string,
+	verbose bool, network networkModel, gui bool) (qcow2 string, err error) {
 
-	err = os.Chdir(appvmPath)
+	realpath, reginfo, qcow2, err := generateVM(appvmPath, nixName, verbose)
 	if err != nil {
 		return
 	}
 
-	realpath, reginfo, qcow2, err := generateVM(name, verbose)
-	if err != nil {
-		return
-	}
-
-	sharedDir := fmt.Sprintf(os.Getenv("HOME") + "/appvm/" + name)
-	os.MkdirAll(sharedDir, 0700)
-
-	xml := generateXML(name, online, realpath, reginfo, qcow2, sharedDir)
+	xml := generateXML(vmName, network, gui, realpath, reginfo, qcow2, sharedDir)
 	_, err = l.DomainCreateXML(xml, libvirt.DomainStartValidate)
 	return
 }
@@ -210,14 +213,31 @@ func isAppvmConfigurationExists(appvmPath, name string) bool {
 	return fileExists(appvmPath + "/nix/" + name + ".nix")
 }
 
-func start(l *libvirt.Libvirt, name string, verbose, online bool,
-	args, open string) {
+func start(l *libvirt.Libvirt, name string, verbose bool, network networkModel,
+	gui, stateless bool, args, open string) {
 
 	appvmPath := configDir
-	vmHomePath := os.Getenv("HOME") + "/appvm/" + name + "/"
+
+	statelessName := fmt.Sprintf("tmp_%d_%s", rand.Int(), name)
+
+	sharedDir := os.Getenv("HOME") + "/appvm/"
+	if stateless {
+		sharedDir += statelessName
+	} else {
+		sharedDir += name
+	}
+
+	os.MkdirAll(sharedDir, 0700)
+
+	vmName := "appvm_"
+	if stateless {
+		vmName += statelessName
+	} else {
+		vmName += name
+	}
 
 	if open != "" {
-		filename := vmHomePath + filepath.Base(open)
+		filename := sharedDir + "/" + filepath.Base(open)
 		err := copyFile(open, filename)
 		if err != nil {
 			log.Println("Can't copy file")
@@ -228,7 +248,7 @@ func start(l *libvirt.Libvirt, name string, verbose, online bool,
 	}
 
 	if args != "" {
-		err := ioutil.WriteFile(vmHomePath+".args", []byte(args), 0700)
+		err := ioutil.WriteFile(sharedDir+"/"+".args", []byte(args), 0700)
 		if err != nil {
 			log.Println("Can't write args")
 			return
@@ -238,31 +258,30 @@ func start(l *libvirt.Libvirt, name string, verbose, online bool,
 	if !isAppvmConfigurationExists(appvmPath, name) {
 		log.Println("No configuration exists for app, " +
 			"trying to generate")
-		err := generate(l, name, "", "")
+		err := generate(name, "", "", false)
 		if err != nil {
 			log.Println("Can't auto generate")
 			return
 		}
 	}
 
-	// Copy templates
-	err := prepareTemplates(appvmPath)
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	if !isRunning(l, name) {
+	if !isRunning(l, vmName) {
 		if !verbose {
 			go stupidProgressBar()
 		}
-		err = generateAppVM(l, appvmPath, name, verbose, online)
+
+		qcow2, err := generateAppVM(l, name, vmName, appvmPath, sharedDir,
+			verbose, network, gui)
+		defer os.Remove(qcow2)
 		if err != nil {
 			log.Fatal(err)
 		}
 	}
 
-	cmd := exec.Command("virt-viewer", "-c", "qemu:///system", "appvm_"+name)
-	cmd.Start()
+	if gui {
+		cmd := exec.Command("virt-viewer", "-c", "qemu:///system", vmName)
+		cmd.Start()
+	}
 }
 
 func stop(l *libvirt.Libvirt, name string) {
@@ -300,17 +319,24 @@ func autoBalloon(l *libvirt.Libvirt, memoryMin, adjustPercent uint64) {
 
 			memoryUsedRaw, err := ioutil.ReadFile(os.Getenv("HOME") + "/appvm/" + name + "/.memory_used")
 			if err != nil {
-				log.Fatal(err)
+				log.Println(err)
+				continue
+			}
+			if len(memoryUsedRaw) == 0 {
+				log.Println("Empty .memory_used file for domain", name)
+				continue
 			}
 			memoryUsedMiB, err := strconv.Atoi(string(memoryUsedRaw[0 : len(memoryUsedRaw)-1]))
 			if err != nil {
-				log.Fatal(err)
+				log.Println(err)
+				continue
 			}
 			memoryUsed := memoryUsedMiB * 1024
 
 			_, memoryMax, memoryCurrent, _, _, err := l.DomainGetInfo(d)
 			if err != nil {
-				log.Fatal(err)
+				log.Println(err)
+				continue
 			}
 
 			memoryNew := uint64(float64(memoryUsed) * (1 + float64(adjustPercent)/100))
@@ -325,7 +351,8 @@ func autoBalloon(l *libvirt.Libvirt, memoryMin, adjustPercent uint64) {
 
 			err = l.DomainSetMemory(d, memoryNew)
 			if err != nil {
-				log.Fatal(err)
+				log.Println(err)
+				continue
 			}
 
 			table.Append([]string{name,
@@ -365,9 +392,56 @@ func sync() {
 	log.Println("Done")
 }
 
+func cleanupStatelessVMs(l *libvirt.Libvirt) {
+	domains, err := l.Domains()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	dirs, err := ioutil.ReadDir(appvmHomesDir)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	for _, f := range dirs {
+		if !strings.HasPrefix(f.Name(), "tmp_") {
+			continue
+		}
+
+		alive := false
+		for _, d := range domains {
+			if d.Name == "appvm_"+f.Name() {
+				alive = true
+			}
+		}
+		if !alive {
+			os.RemoveAll(appvmHomesDir + f.Name())
+		}
+	}
+}
+
+func parseNetworkModel(flagOffline bool, flagNetworking string) networkModel {
+	if flagNetworking != "" && flagOffline {
+		log.Fatal("Can't use both --network and --offline switches")
+	}
+	if flagOffline || flagNetworking == "offline" {
+		return networkOffline
+	}
+	if flagNetworking == "libvirt" {
+		return networkLibvirt
+	}
+	if flagNetworking == "qemu" {
+		return networkQemu
+	}
+	return networkQemu // qemu is the default network model
+}
+
 var configDir = os.Getenv("HOME") + "/.config/appvm/"
+var appvmHomesDir = os.Getenv("HOME") + "/appvm/"
 
 func main() {
+	rand.Seed(time.Now().UnixNano())
+
 	os.Mkdir(os.Getenv("HOME")+"/appvm", 0700)
 
 	os.MkdirAll(configDir+"/nix", 0700)
@@ -377,22 +451,17 @@ func main() {
 		log.Fatal(err)
 	}
 
-	err = ioutil.WriteFile(configDir+"/nix/base.nix", base_nix, 0644)
+	err = ioutil.WriteFile(configDir+"/nix/base.nix", baseNix(), 0644)
 	if err != nil {
 		log.Fatal(err)
 	}
 
-	c, err := net.DialTimeout("unix", "/var/run/libvirt/libvirt-sock", time.Second)
+	// Copy templates
+	err = prepareTemplates(configDir)
 	if err != nil {
 		log.Fatal(err)
 	}
 
-	l := libvirt.New(c)
-	if err := l.Connect(); err != nil {
-		log.Fatal(err)
-	}
-	defer l.Disconnect()
-
 	kingpin.Command("list", "List applications")
 	autoballonCommand := kingpin.Command("autoballoon", "Automatically adjust/reduce app vm memory")
 	minMemory := autoballonCommand.Flag("min-memory", "Set minimal memory (megabytes)").Default("1024").Uint64()
@@ -404,6 +473,9 @@ func main() {
 	startArgs := startCommand.Flag("args", "Command line arguments").String()
 	startOpen := startCommand.Flag("open", "Pass file to application").String()
 	startOffline := startCommand.Flag("offline", "Disconnect").Bool()
+	startCli := startCommand.Flag("cli", "Disable graphics mode, enable serial").Bool()
+	startStateless := startCommand.Flag("stateless", "Do not use default state directory").Bool()
+	startNetwork := startCommand.Flag("network", "Used networking model").Enum("offline", "qemu", "libvirt")
 
 	stopName := kingpin.Command("stop", "Stop application").Arg("name", "Application name").Required().String()
 	dropName := kingpin.Command("drop", "Remove application data").Arg("name", "Application name").Required().String()
@@ -412,21 +484,45 @@ func main() {
 	generateName := generateCommand.Arg("name", "Nix package name").Required().String()
 	generateBin := generateCommand.Arg("bin", "Binary").Default("").String()
 	generateVMName := generateCommand.Flag("vm", "Use VM Name").Default("").String()
+	generateBuildVM := generateCommand.Flag("build", "Build VM").Bool()
 
 	searchCommand := kingpin.Command("search", "Search for application")
 	searchName := searchCommand.Arg("name", "Application name").Required().String()
 
 	kingpin.Command("sync", "Synchronize remote repos for applications")
 
+	var l *libvirt.Libvirt
+	if kingpin.Parse() != "generate" {
+		c, err := net.DialTimeout(
+			"unix",
+			"/var/run/libvirt/libvirt-sock",
+			time.Second,
+		)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		l = libvirt.New(c)
+		if err := l.Connect(); err != nil {
+			log.Fatal(err)
+		}
+		defer l.Disconnect()
+
+		cleanupStatelessVMs(l)
+	}
+
 	switch kingpin.Parse() {
 	case "list":
 		list(l)
 	case "search":
 		search(*searchName)
 	case "generate":
-		generate(l, *generateName, *generateBin, *generateVMName)
+		generate(*generateName, *generateBin, *generateVMName,
+			*generateBuildVM)
 	case "start":
-		start(l, *startName, !*startQuiet, !*startOffline,
+		networkModel := parseNetworkModel(*startOffline, *startNetwork)
+		start(l, *startName,
+			!*startQuiet, networkModel, !*startCli, *startStateless,
 			*startArgs, *startOpen)
 	case "stop":
 		stop(l, *stopName)

base.nix.go

@@ -1,6 +1,12 @@
 package main
 
-var base_nix = []byte(`
+import (
+	"fmt"
+	"log"
+	"os/user"
+)
+
+var base_nix = `
 {pkgs, ...}:
 {
   imports = [
@@ -10,18 +16,20 @@ var base_nix = []byte(`
   services.xserver = {
     enable = true;
     desktopManager.xterm.enable = false;
-    displayManager.slim = {
-      enable = true;
-      defaultUser = "user";
-      autoLogin = true;
+    displayManager = {
+      lightdm.enable = true;
+      autoLogin = {
+        enable = true;
+        user = "user";
+      };
     };
     windowManager.xmonad.enable = true;
-    windowManager.default = "xmonad";
   };
 
   services.spice-vdagentd.enable = true;
 
   users.extraUsers.user = {
+    uid = %s;
     isNormalUser = true;
     extraGroups = [ "audio" ];
     createHome = true;
@@ -37,14 +45,13 @@ main = xmonad defaultConfig
 
 startup :: X ()
 startup = do
-  spawn "${pkgs.spice-vdagent}/bin/spice-vdagent"
+  spawn "while [ 1 ]; do ${pkgs.spice-vdagent}/bin/spice-vdagent -x; done &"
   '';
 
   systemd.services.home-user-build-xmonad = {
     description = "Link xmonad configuration";
     serviceConfig = {
-      ConditionFileNotEmpty = "!/home/user/.xmonad/xmonad.hs";
-      ExecStart = "/bin/sh -c 'mkdir -p /home/user/.xmonad && ln -s /etc/xmonad.hs /home/user/.xmonad/xmonad.hs'";
+      ExecStart = "/bin/sh -c 'mkdir -p /home/user/.xmonad && ln -sf /etc/xmonad.hs /home/user/.xmonad/xmonad.hs && /run/current-system/sw/bin/xmonad --recompile'";
       RemainAfterExit = "yes";
       User = "user";
       Restart = "on-failure";
@@ -56,7 +63,7 @@ startup = do
   systemd.services.mount-home-user = {
     description = "Mount /home/user (crutch)";
     serviceConfig = {
-      ExecStart = "/bin/sh -c '/run/current-system/sw/bin/mount -t 9p -o trans=virtio,version=9p2000.L,uid=1000 home /home/user'";
+      ExecStart = "/bin/sh -c '/run/current-system/sw/bin/mount -t 9p -o trans=virtio,version=9p2000.L home /home/user'";
       RemainAfterExit = "yes";
       Type = "oneshot";
       User = "root";
@@ -104,4 +111,12 @@ startup = do
     wantedBy = ["timers.target"];
   };
 }
-`)
+`
+
+func baseNix() []byte {
+	u, err := user.Current()
+	if err != nil {
+		log.Fatal(err)
+	}
+	return []byte(fmt.Sprintf(base_nix, u.Uid))
+}

default.nix

@@ -0,0 +1,34 @@
+{ pkgs ? import <nixpkgs> {}, ... }:
+let
+  virt-manager-without-menu = pkgs.virt-viewer.overrideAttrs(x: {
+    patches = [
+      ./patches/0001-Remove-menu-bar.patch
+      ./patches/0002-Do-not-grab-keyboard-mouse.patch
+      ./patches/0003-Use-name-of-appvm-applications-as-a-title.patch
+      ./patches/0004-Use-title-application-name-as-subtitle.patch
+    ];
+  });
+in with pkgs;
+
+buildGoModule rec {
+  pname = "appvm";
+  version = "master";
+
+  buildInputs = [ makeWrapper ];
+
+  src = ./.;
+
+  vendorSha256 = "sha256-8eU+Mf5dxL/bAMMShXvj8I1Kdd4ysBTWvgYIXwLStPI=";
+
+  postFixup = ''
+    wrapProgram $out/bin/appvm \
+      --prefix PATH : "${lib.makeBinPath [ nix virt-manager-without-menu ]}"
+  '';
+
+  meta = {
+    description = "Nix-based app VMs";
+    homepage = "https://code.dumpstack.io/tools/${pname}";
+    maintainers = [ lib.maintainers.dump_stack lib.maintainers.cab404 ];
+    license = lib.licenses.gpl3;
+  };
+}

docs/architecture.rst

@@ -0,0 +1,4 @@
+Architecture
+============
+
+*TODO*

docs/index.rst

@@ -0,0 +1,30 @@
+appvm
+=====
+
+*appvm* is the thin easy-to-use hypervisor-based sandboxing software.
+
+*appvm* was created for the purpose of decreasing complexity of using
+graphical software inside virtual machines, at the same time
+maintaining reasonable security and keep *appvm* itself simple and
+portable.
+
+While I'm trying to keep that documentation up-to-date, there may be
+some missing information. Use ``appvm --help-long`` for checking all
+features.
+
+If you found anything missed here, please make a pull request or send
+patches to patch@dumpstack.io.
+
+If you need personal support, your company is interested in the
+project or you just want to share some thoughts -- feel free to create
+a new issue or write to root@dumpstack.io.
+
+Contents
+========
+
+:ref:`Keyword Index <genindex>`
+
+.. toctree::
+
+   architecture.rst
+   threat-model.rst

docs/installation.rst

@@ -0,0 +1,40 @@
+Installation
+============
+
+NixOS
+-----
+
+First, clone this repo. Then do this:
+
+/etc/nixos/configuration.nix::
+
+  imports = [
+    /path/to/repo/nixos
+  ];
+
+  virtualisation.appvm = {
+    enable = true;
+    user = "${username}";
+  };
+
+This is a temporary solution until appvm is upstreamed to nixpkgs or Nix flakes are released.
+
+Ubuntu 20.04
+------
+
+Requirements::
+
+  sudo apt install virt-manager curl git
+  echo user = "\"$USER\"" | sudo tee -a /etc/libvirt/qemu.conf
+  echo '/var/tmp/** rwlk,' | sudo tee -a /etc/apparmor.d/local/abstractions/libvirt-qemu
+  curl -L https://nixos.org/nix/install | sh
+  systemctl reboot
+
+Use latest stable nixpkgs channel::
+
+  nix-channel --add https://nixos.org/channels/nixos-20.03 nixpkgs
+  nix-channel --update
+
+Install appvm::
+
+  nix-env -if https://code.dumpstack.io/tools/appvm/archive/master.tar.gz

docs/threat-model.rst

@@ -0,0 +1,4 @@
+Threat model
+=======================
+
+*TODO*

dot-desktop-fuse/main.go

@@ -0,0 +1,88 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"io/ioutil"
+	"log"
+	"os"
+	"os/signal"
+	"path/filepath"
+	"regexp"
+	"syscall"
+
+	"github.com/hanwen/go-fuse/v2/fs"
+	"github.com/hanwen/go-fuse/v2/fuse"
+)
+
+type ddf struct {
+	Path string
+	fs.Inode
+}
+
+func (r *ddf) OnAdd(ctx context.Context) {
+	files, err := ioutil.ReadDir(r.Path)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	for _, file := range files {
+		b, err := ioutil.ReadFile(filepath.Join(r.Path, file.Name()))
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		if bytes.Contains(b, []byte("Actions=")) {
+			b = bytes.ReplaceAll(b, []byte("Actions="), []byte("Actions=appvm;"))
+		} else {
+			b = bytes.ReplaceAll(b, []byte("Exec="), []byte("Actions=appvm;\nExec="))
+		}
+
+		raw := string(regexp.MustCompile("Exec=[a-zA-Z0-9]*").Find(b))
+
+		var app string
+		if len(raw) > 5 {
+			app = string(raw)[5:]
+		} else {
+			log.Println("Can't find Exec entry for", file.Name())
+			continue
+		}
+
+		b = append(b, []byte("\n[Desktop Action appvm]\n")...)
+		b = append(b, []byte("Name=Open in appvm\n")...)
+		b = append(b, []byte("Exec=appvm start "+app+"\n")...)
+
+		ch := r.NewPersistentInode(
+			ctx, &fs.MemRegularFile{
+				Data: b,
+				Attr: fuse.Attr{Mode: 0444},
+			}, fs.StableAttr{})
+		r.AddChild(file.Name(), ch, false)
+	}
+}
+
+var _ = (fs.NodeOnAdder)((*ddf)(nil))
+
+func setupSigintHandler(server *fuse.Server) {
+	c := make(chan os.Signal)
+	signal.Notify(c, os.Interrupt, syscall.SIGTERM)
+	go func() {
+		<-c
+		server.Unmount()
+		os.Exit(1)
+	}()
+}
+
+func main() {
+	const from = "/var/run/current-system/sw/share/applications/"
+
+	to := filepath.Join(os.Getenv("HOME"), "/.local/share/applications")
+	os.MkdirAll(to, 0755)
+
+	server, err := fs.Mount(to, &ddf{Path: from}, nil)
+	if err != nil {
+		log.Fatal(err)
+	}
+	setupSigintHandler(server)
+	server.Wait()
+}

generate.go

@@ -8,8 +8,6 @@ import (
 	"os"
 	"os/exec"
 	"strings"
-
-	"github.com/digitalocean/go-libvirt"
 )
 
 var template = `
@@ -34,12 +32,8 @@ in {
 }
 `
 
-func isPackageExists(name string) bool {
-	cmd := exec.Command("nix-env", "-iA", name)
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	err := cmd.Run()
-	return err == nil
+func isPackageExists(channel, name string) bool {
+	return nil == exec.Command("nix-build", "<"+channel+">", "-A", name).Run()
 }
 
 func nixPath(name string) (path string, err error) {
@@ -62,8 +56,10 @@ func guessChannel() (channel string, err error) {
 	for _, line := range channels {
 		fields := strings.Fields(line)
 		if len(fields) == 2 {
-			channel = fields[0]
-			return
+			if strings.Contains(fields[1], "nixos.org/channels") {
+				channel = fields[0]
+				return
+			}
 		}
 	}
 
@@ -80,34 +76,38 @@ func filterDotfiles(files []os.FileInfo) (notHiddenFiles []os.FileInfo) {
 	return
 }
 
-func generate(l *libvirt.Libvirt, pkg, bin, vmname string) (err error) {
-	var name string
+func generate(pkg, bin, vmname string, build bool) (err error) {
+	// TODO refactor
+	var name, channel string
 
 	if strings.Contains(pkg, ".") {
-		name = pkg
+		channel = strings.Split(pkg, ".")[0]
+		name = strings.Join(strings.Split(pkg, ".")[1:], ".")
 	} else {
 		log.Println("Package name does not contains channel")
 		log.Println("Trying to guess")
-		var channel string
+
 		channel, err = guessChannel()
 		if err != nil {
 			log.Println("Cannot guess channel")
 			log.Println("Check nix-channel --list")
-			return
+			log.Println("Will try <nixpkgs>")
+			channel = "nixpkgs"
+			err = nil
 		}
 
-		name = channel + "." + pkg
-		log.Println("Use", name)
+		name = pkg
+		log.Println("Use", channel+"."+pkg)
 	}
 
-	if !isPackageExists(name) {
+	if !isPackageExists(channel, name) {
 		s := "Package " + name + " does not exists"
 		err = errors.New(s)
 		log.Println(s)
 		return
 	}
 
-	path, err := nixPath(name)
+	path, err := nixPath(channel + "." + name)
 	if err != nil {
 		log.Println("Cannot find nix path")
 		return
@@ -171,25 +171,14 @@ func generate(l *libvirt.Libvirt, pkg, bin, vmname string) (err error) {
 		bin = files[0].Name()
 	}
 
-	var realName string
-	for i, s := range strings.Split(name, ".") {
-		if i == 0 {
-			continue
-		}
-		if i != 1 {
-			realName += "."
-		}
-		realName += s
-	}
-
 	var appFilename string
 	if vmname != "" {
 		appFilename = configDir + "/nix/" + vmname + ".nix"
 	} else {
-		appFilename = configDir + "/nix/" + realName + ".nix"
+		appFilename = configDir + "/nix/" + name + ".nix"
 	}
 
-	appNixConfig := fmt.Sprintf(template, realName, bin)
+	appNixConfig := fmt.Sprintf(template, name, bin)
 
 	err = ioutil.WriteFile(appFilename, []byte(appNixConfig), 0600)
 	if err != nil {
@@ -199,5 +188,18 @@ func generate(l *libvirt.Libvirt, pkg, bin, vmname string) (err error) {
 
 	fmt.Print(appNixConfig + "\n")
 	log.Println("Configuration file is saved to", appFilename)
+
+	if build {
+		if vmname != "" {
+			_, _, _, err = generateVM(configDir, vmname, true)
+		} else {
+			_, _, _, err = generateVM(configDir, name, true)
+		}
+
+		if err != nil {
+			return
+		}
+	}
+
 	return
 }

go.mod

@@ -1,13 +1,14 @@
 module code.dumpstack.io/tools/appvm
 
-go 1.12
+go 1.16
 
 require (
 	github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 // indirect
-	github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d // indirect
-	github.com/digitalocean/go-libvirt v0.0.0-20190715144809-7b622097a793
-	github.com/go-cmd/cmd v1.1.0
+	github.com/alecthomas/units v0.0.0-20210927113745-59d0afb8317a // indirect
+	github.com/digitalocean/go-libvirt v0.0.0-20210723161134-761cfeeb5968
+	github.com/go-cmd/cmd v1.3.1
+	github.com/hanwen/go-fuse/v2 v2.1.0
 	github.com/jollheef/go-system v0.0.0-20160710075518-6ed6b1d2b8db
-	github.com/olekukonko/tablewriter v0.0.4
+	github.com/olekukonko/tablewriter v0.0.5
 	gopkg.in/alecthomas/kingpin.v2 v2.2.6
 )

go.sum

@@ -1,23 +1,62 @@
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 h1:JYp7IbQjafoB+tBA3gMyHYHrpOtNuDiK/uB5uXxq5wM=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
-github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d h1:UQZhZ2O0vMHr2cI+DC1Mbh0TJxzA3RcLoMsFw+aXw7E=
-github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
+github.com/alecthomas/units v0.0.0-20210927113745-59d0afb8317a h1:E/8AP5dFtMhl5KPJz66Kt9G0n+7Sn41Fy1wv9/jHOrc=
+github.com/alecthomas/units v0.0.0-20210927113745-59d0afb8317a/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
+github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/digitalocean/go-libvirt v0.0.0-20190715144809-7b622097a793 h1:+ItaX1GKKT70bYwazNtWeYz8QBfirNC85J70psPGgN0=
-github.com/digitalocean/go-libvirt v0.0.0-20190715144809-7b622097a793/go.mod h1:PRcPVAAma6zcLpFd4GZrjR/MRpood3TamjKI2m/z/Uw=
-github.com/go-cmd/cmd v1.1.0 h1:LxXflJCRKNZgoKl/0TJdzIDSGFdik3zxaeyL1yXCTsI=
-github.com/go-cmd/cmd v1.1.0/go.mod h1:bkfdaV0aMvVwTINGdkU5jlQEd9gF0z4irQutl37pOd8=
-github.com/go-test/deep v1.0.1/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
+github.com/digitalocean/go-libvirt v0.0.0-20210723161134-761cfeeb5968 h1:ZdYBqLPrXioo+1Z97PWaTK4+jRcS45BI6JlepKtkPKI=
+github.com/digitalocean/go-libvirt v0.0.0-20210723161134-761cfeeb5968/go.mod h1:o129ljs6alsIQTc8d6eweihqpmmrbxZ2g1jhgjhPykI=
+github.com/go-cmd/cmd v1.3.1 h1:Scpez/YLL7xBmc1KRxDtHNXnamzQWqF4Sqy9SHnIMfE=
+github.com/go-cmd/cmd v1.3.1/go.mod h1:VZqpYlBauogsSkJrj8NzQM6r/tztSewD/PfHCVjTdnA=
+github.com/go-test/deep v1.0.7 h1:/VSMRlnY/JSyqxQUzQLKVMAskpY/NZKFA5j2P+0pP2M=
+github.com/go-test/deep v1.0.7/go.mod h1:QV8Hv/iy04NyLBxAdO9njL0iVPN1S4d/A3NVv1V36o8=
+github.com/hanwen/go-fuse v1.0.0 h1:GxS9Zrn6c35/BnfiVsZVWmsG803xwE7eVRDvcf/BEVc=
+github.com/hanwen/go-fuse v1.0.0/go.mod h1:unqXarDXqzAk0rt98O2tVndEPIpUgLD9+rwFisZH3Ok=
+github.com/hanwen/go-fuse/v2 v2.1.0 h1:+32ffteETaLYClUj0a3aHjZ1hOPxxaNEHiZiujuDaek=
+github.com/hanwen/go-fuse/v2 v2.1.0/go.mod h1:oRyA5eK+pvJyv5otpO/DgccS8y/RvYMaO00GgRLGryc=
 github.com/jollheef/go-system v0.0.0-20160710075518-6ed6b1d2b8db h1:HGcWru24Gt24VFEsX7mxKtO+/NnKCuQ0LYtardulWMc=
 github.com/jollheef/go-system v0.0.0-20160710075518-6ed6b1d2b8db/go.mod h1:Cj2JA+Wov6pwK3QTq2PuRXkZ5UM+DT3apJtBDUS8zKE=
-github.com/mattn/go-runewidth v0.0.7 h1:Ei8KR0497xHyKJPAv59M1dkC+rOZCMBJ+t3fZ+twI54=
-github.com/mattn/go-runewidth v0.0.7/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
-github.com/olekukonko/tablewriter v0.0.4 h1:vHD/YYe1Wolo78koG299f7V/VAS08c6IpCLn+Ejf/w8=
-github.com/olekukonko/tablewriter v0.0.4/go.mod h1:zq6QwlOf5SlnkVbMSr5EoBv3636FWnp+qbPhuoO21uA=
+github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348 h1:MtvEpTB6LX3vkb4ax0b5D2DHbNAUsen0Gx5wZoq3lV4=
+github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LEHPfb2qLo0BaaOLcbitczOKLWTsrBG9LczfCD4k=
+github.com/mattn/go-runewidth v0.0.9 h1:Lm995f3rfxdpd6TSmuVCHVb/QhupuXlYr8sCI/QdE+0=
+github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
+github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
+github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210510120138-977fb7262007 h1:gG67DSER+11cZvqIMb8S8bt0vZtiN6xWYARwirrOSfE=
+golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

local.nix.template.go

@@ -2,7 +2,6 @@ package main
 
 var local_nix_template = []byte(`
 {
-  services.xserver.layout = "us,ru";
-  services.xserver.xkbOptions = "ctrl:nocaps,grp:rctrl_toggle";
+  #services.xserver.xkbOptions = "ctrl:nocaps";
 }
 `)

nixos/default.nix

@@ -0,0 +1,44 @@
+params@{ config, lib, pkgs, ... }:
+let
+  cfg = config.virtualisation.appvm;
+  appvm = import ../. params;
+in with lib; {
+
+  options = {
+    virtualisation.appvm = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          This enables AppVMs and related virtualisation settings.
+        '';
+      };
+      user = mkOption {
+        type = types.str;
+        description = ''
+          AppVM user login. Currenly only AppVMs are supported for a single user only.
+        '';
+      };
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+    virtualisation.libvirtd = {
+      enable = true;
+      qemuVerbatimConfig = ''
+        namespaces = []
+        user = "${cfg.user}"
+        group = "users"
+        remember_owner = 0
+      '';
+    };
+
+    users.users."${cfg.user}" = {
+      packages = [ appvm ];
+      extraGroups = [ "libvirtd" ];
+    };
+
+  };
+
+}

os/.gitignore

@@ -0,0 +1,4 @@
+*.iso
+target.nix
+result
+nixos.qcow2

os/Makefile

@@ -0,0 +1,20 @@
+test: vm cleanup
+
+vm:
+	ln -sf vm.nix target.nix
+	nix-build '<nixpkgs/nixos>' -A vm -I nixos-config=configuration.nix
+	@echo "Use Ctrl-Alt-Q to close VM" | grep --color=always '.*'
+	./result/bin/run-nixos-vm -cpu host
+
+cleanup:
+	rm -f nixos.qcow2
+	unlink result
+
+iso:
+	@echo "Not yet available. Use \`make live-iso\`." | grep --color=always '.*'
+
+live-iso:
+	ln -sf live-iso.nix target.nix
+	nix-build '<nixpkgs/nixos>' -A config.system.build.isoImage -I nixos-config=configuration.nix
+	cp result/iso/* appvm.iso
+	unlink result

os/README.md

@@ -0,0 +1,11 @@
+# $Placeholder OS
+
+The primary goal of appvm is to provide application VMs as a tool, but some people ask for a complete distro so why not.
+
+## Usage
+
+    make test
+
+or
+
+    make live-iso

os/configuration.nix

@@ -0,0 +1,76 @@
+{ config, pkgs, lib, ... }:
+
+let
+  appvm = (import ../default.nix);
+in {
+  imports = [
+    <nixpkgs/nixos/modules/installer/cd-dvd/channel.nix>
+    ./target.nix
+    #./hardware-configuration.nix
+  ];
+
+  time.timeZone = "UTC";
+
+  boot.loader.systemd-boot.enable = true;
+
+  # You can not use networking.networkmanager with networking.wireless
+  networking.wireless.enable = false;
+
+  users.users.user = {
+    isNormalUser = true;
+    initialPassword = "user";   # should be changed right after start
+    extraGroups = [ "audio" "libvirtd" ];
+  };
+
+  virtualisation.libvirtd = {
+    enable = true;
+    qemuVerbatimConfig = ''
+      namespaces = []
+      user = "user"
+      group = "users"
+    '';
+  };
+
+  systemd.user.services."dot-desktop-fuse" = {
+    serviceConfig = {
+      ExecStart = "${appvm}/bin/dot-desktop-fuse";
+      Restart = "on-failure";
+    };
+    path = [ "/run/wrappers" ];
+    wantedBy = [ "default.target" ];
+  };
+
+  systemd.user.services."autoballoon" = {
+    serviceConfig.StartLimitBurst = 64;
+    script = "${appvm}/bin/appvm autoballoon";
+  };
+
+  systemd.user.timers."autoballoon" = {
+    description = "Autoupdate resolution crutch";
+    timerConfig = {
+      OnBootSec = "1s";
+      OnUnitInactiveSec = "1s";
+      Unit = "autoballoon.service";
+      AccuracySec = "1us";
+    };
+    wantedBy = ["timers.target"];
+  };
+
+  environment.systemPackages = with pkgs; [
+    appvm virtmanager chromium
+    # Cache packages required for application VMs
+    xmonad-with-packages spice-vdagent bc qemu_test lightdm
+  ];
+
+  services.xserver.enable = true;
+  services.xserver.displayManager.gdm = {
+    enable = true;
+    wayland = false;            # FIXME
+    autoLogin = {
+      enable = true;
+      user = "user";
+    };
+  };
+
+  services.xserver.desktopManager.gnome3.enable = true;
+}

os/live-iso.nix

@@ -0,0 +1,6 @@
+{
+  imports = [
+    #<nixpkgs/nixos/modules/profiles/hardened.nix>
+    <nixpkgs/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix>
+  ];
+}

os/vm.nix

@@ -0,0 +1,5 @@
+{
+  # vm.nix is used for testing only
+  users.users.root.initialPassword = "root";
+  virtualisation.memorySize = 8196;
+}

patches/0001-Remove-menu-bar.patch

@@ -0,0 +1,25 @@
+From c26580442a4ac18f805b1795ec250d6cf5857a49 Mon Sep 17 00:00:00 2001
+From: Mikhail Klementev <blame@dumpstack.io>
+Date: Wed, 22 Jan 2020 00:25:16 +0000
+Subject: [PATCH 1/4] Remove menu bar
+
+---
+ src/resources/ui/virt-viewer.ui | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/resources/ui/virt-viewer.ui b/src/resources/ui/virt-viewer.ui
+index 93471a4..b029ad7 100644
+--- a/src/resources/ui/virt-viewer.ui
++++ b/src/resources/ui/virt-viewer.ui
+@@ -18,7 +18,7 @@
+             <property name="can_focus">False</property>
+             <child>
+               <object class="GtkMenuBar" id="top-menu">
+-                <property name="visible">True</property>
++                <property name="visible">False</property>
+                 <property name="can_focus">False</property>
+                 <child>
+                   <object class="GtkMenuItem" id="menu-file">
+-- 
+2.23.1
+

patches/0002-Do-not-grab-keyboard-mouse.patch

@@ -0,0 +1,27 @@
+From eac430d01f486e15b55d6fa992e77ded77bb4b1a Mon Sep 17 00:00:00 2001
+From: Mikhail Klementev <blame@dumpstack.io>
+Date: Wed, 22 Jan 2020 00:41:34 +0000
+Subject: [PATCH 2/4] Do not grab keyboard/mouse
+
+---
+ src/virt-viewer-display-spice.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/virt-viewer-display-spice.c b/src/virt-viewer-display-spice.c
+index 311178b..8e68de2 100644
+--- a/src/virt-viewer-display-spice.c
++++ b/src/virt-viewer-display-spice.c
+@@ -307,8 +307,8 @@ virt_viewer_display_spice_new(VirtViewerSessionSpice *session,
+     gtk_container_add(GTK_CONTAINER(self), GTK_WIDGET(self->priv->display));
+     gtk_widget_show(GTK_WIDGET(self->priv->display));
+     g_object_set(self->priv->display,
+-                 "grab-keyboard", TRUE,
+-                 "grab-mouse", TRUE,
++                 "grab-keyboard", FALSE,
++                 "grab-mouse", FALSE,
+                  "resize-guest", FALSE,
+                  "scaling", TRUE,
+                  NULL);
+-- 
+2.23.1
+

patches/0003-Use-name-of-appvm-applications-as-a-title.patch

@@ -0,0 +1,26 @@
+From c5b51c0a540af34499f2b2a49cb64599c06ba293 Mon Sep 17 00:00:00 2001
+From: Mikhail Klementev <blame@dumpstack.io>
+Date: Wed, 22 Jan 2020 01:24:57 +0000
+Subject: [PATCH 3/4] Use name of appvm applications as a title
+
+---
+ src/virt-viewer-window.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/virt-viewer-window.c b/src/virt-viewer-window.c
+index 4c08423..cc8a440 100644
+--- a/src/virt-viewer-window.c
++++ b/src/virt-viewer-window.c
+@@ -1362,6 +1362,9 @@ virt_viewer_window_update_title(VirtViewerWindow *self)
+ 
+     if (!ungrab && !priv->subtitle)
+         title = g_strdup(g_get_application_name());
++    else if (g_str_has_prefix(priv->subtitle, "appvm_"))
++        /* Use name of the application as a title */
++        title = g_strdup_printf(_("%s"), &priv->subtitle[strlen("appvm_")]);
+     else
+         /* translators:
+          * This is "<ungrab (or empty)><space (or empty)><subtitle (or empty)> - <appname>"
+-- 
+2.23.1
+

patches/0004-Use-title-application-name-as-subtitle.patch

@@ -0,0 +1,44 @@
+From 8e95408365b57c64a738381d132ecdc844013afb Mon Sep 17 00:00:00 2001
+From: Mikhail Klementev <blame@dumpstack.io>
+Date: Wed, 22 Jan 2020 02:27:26 +0000
+Subject: [PATCH 4/4] Use title (application name) as subtitle
+
+---
+ src/virt-viewer-app.c | 21 ++-------------------
+ 1 file changed, 2 insertions(+), 19 deletions(-)
+
+diff --git a/src/virt-viewer-app.c b/src/virt-viewer-app.c
+index 343b1af..8267f82 100644
+--- a/src/virt-viewer-app.c
++++ b/src/virt-viewer-app.c
+@@ -718,25 +718,8 @@ virt_viewer_app_set_window_subtitle(VirtViewerApp *app,
+     gchar *subtitle = NULL;
+     const gchar *title = virt_viewer_app_get_title(app);
+ 
+-    if (title != NULL) {
+-        VirtViewerDisplay *display = virt_viewer_window_get_display(window);
+-        gchar *d = strstr(title, "%d");
+-        gchar *desc = NULL;
+-
+-        if (display && VIRT_VIEWER_IS_DISPLAY_VTE(display)) {
+-            g_object_get(display, "name", &desc, NULL);
+-        } else  {
+-            desc = g_strdup_printf("%d", nth + 1);
+-        }
+-
+-        if (d != NULL) {
+-            *d = '\0';
+-            subtitle = g_strdup_printf("%s%s%s", title, desc, d + 2);
+-            *d = '%';
+-        } else
+-            subtitle = g_strdup_printf("%s (%s)", title, desc);
+-        g_free(desc);
+-    }
++    if (title != NULL)
++        subtitle = g_strdup_printf("%s", title);
+ 
+     g_object_set(window, "subtitle", subtitle, NULL);
+     g_free(subtitle);
+-- 
+2.23.1
+

xml.go

@@ -5,29 +5,65 @@ import "fmt"
 // You may think that you want to rewrite to proper golang structures.
 // Believe me, you shouldn't.
 
-func generateXML(name string, online bool, vmNixPath, reginfo, img, sharedDir string) string {
-	qemuParams := `
-          <qemu:commandline>
-            <qemu:arg value='-device'/>
-            <qemu:arg value='e1000,netdev=net0'/>
-            <qemu:arg value='-netdev'/>
-            <qemu:arg value='user,id=net0'/>
-            <qemu:arg value='-snapshot'/>
-          </qemu:commandline>
-        `
+func generateXML(vmName string, network networkModel, gui bool,
+	vmNixPath, reginfo, img, sharedDir string) string {
 
-	if !online {
-		qemuParams = `
-                  <qemu:commandline>
-                    <qemu:arg value='-snapshot'/>
-                  </qemu:commandline>
-                `
+	devices := ""
+
+	if gui {
+		devices = guiDevices
 	}
 
-	return fmt.Sprintf(xmlTmpl, "appvm_"+name, vmNixPath, vmNixPath, vmNixPath,
-		reginfo, img, sharedDir, sharedDir, sharedDir, qemuParams)
+	qemuParams := qemuParamsDefault
+
+	if network == networkQemu {
+		qemuParams = qemuParamsWithNetwork
+	} else if network == networkLibvirt {
+		devices += netDevices
+	}
+
+	return fmt.Sprintf(xmlTmpl, vmName, vmNixPath, vmNixPath, vmNixPath,
+		reginfo, img, sharedDir, sharedDir, sharedDir, devices, qemuParams)
 }
 
+var qemuParamsDefault = `
+  <qemu:commandline>
+    <qemu:arg value='-snapshot'/>
+  </qemu:commandline>
+`
+
+var qemuParamsWithNetwork = `
+  <qemu:commandline>
+    <qemu:arg value='-device'/>
+    <qemu:arg value='e1000,netdev=net0,bus=pci.0,addr=0x10'/>
+    <qemu:arg value='-netdev'/>
+    <qemu:arg value='user,id=net0'/>
+    <qemu:arg value='-snapshot'/>
+  </qemu:commandline>
+`
+
+var netDevices = `
+    <interface type='network'>
+      <source network='default'/>
+    </interface>
+`
+
+var guiDevices = `
+    <!-- Graphical console -->
+    <graphics type='spice' autoport='yes'>
+      <listen type='address'/>
+      <image compression='off'/>
+    </graphics>
+    <!-- Guest additionals support -->
+    <channel type='spicevmc'>
+      <target type='virtio' name='com.redhat.spice.0'/>
+    </channel>
+    <video>
+      <model type='qxl' ram='524288' vram='524288' vgamem='262144' heads='1' primary='yes'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
+    </video>
+`
+
 var xmlTmpl = `
 <domain type='kvm' xmlns:qemu='http://libvirt.org/schemas/domain/qemu/1.0'>
   <name>%s</name>
@@ -35,7 +71,7 @@ var xmlTmpl = `
   <currentMemory unit='GiB'>1</currentMemory>
   <vcpu>4</vcpu>
   <os>
-    <type arch='x86_64' machine='pc-i440fx-2.12'>hvm</type>
+    <type arch='x86_64'>hvm</type>
     <kernel>%s/kernel</kernel>
     <initrd>%s/initrd</initrd>
     <cmdline>loglevel=4 init=%s/init %s</cmdline>
@@ -48,29 +84,16 @@ var xmlTmpl = `
   <on_reboot>restart</on_reboot>
   <on_crash>destroy</on_crash>
   <devices>
-    <!-- Graphical console -->
-    <graphics type='spice' autoport='yes'>
-      <listen type='address'/>
-      <image compression='off'/>
-    </graphics>
-    <!-- Guest additionals support -->
-    <channel type='spicevmc'>
-      <target type='virtio' name='com.redhat.spice.0'/>
-    </channel>
     <!-- Fake (because -snapshot) writeback image -->
     <disk type='file' device='disk'>
       <driver name='qemu' type='qcow2' cache='writeback' error_policy='report'/>
       <source file='%s'/>
       <target dev='vda' bus='virtio'/>
     </disk>
-    <video>
-      <model type='qxl' ram='524288' vram='524288' vgamem='262144' heads='1' primary='yes'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
-    </video>
     <!-- filesystems -->
     <filesystem type='mount' accessmode='passthrough'>
       <source dir='/nix/store'/>
-      <target dir='store'/>
+      <target dir='nix-store'/>
       <readonly/>
     </filesystem>
     <filesystem type='mount' accessmode='mapped'>
@@ -85,6 +108,7 @@ var xmlTmpl = `
       <source dir='%s'/>
       <target dir='home'/>
     </filesystem>
+    %s
   </devices>
   %s
 </domain>