feat: add project-composable DeepSeek Harness microVMs

Share the live project cwd, DSH home and skills read-write while running guest root behind rootless QEMU and Bubblewrap. Reuse project toolchains, expose configurable SSH-forwarded web access, and launch the latest official DSH. Include the project template, operating guide, offline boot and mount tests, and shell checks.
2026-09-06 12:45:36 -05:00
parent 221e0b33cc
commit 35ca88d517
14 changed files with 1219 additions and 0 deletions
@@ -0,0 +1,54 @@
+{ nixpkgs, microvm }:
+{
+  system,
+  project,
+  modules ? [ ],
+}:
+let
+  pkgs = nixpkgs.legacyPackages.${system};
+  inherit (pkgs) lib;
+  nixos = nixpkgs.lib.nixosSystem {
+    inherit system;
+    modules = [
+      microvm.nixosModules.microvm
+      ./module.nix
+      {
+        agentVM.packages = project.packages or [ ];
+        environment.variables = project.env or { };
+      }
+    ]
+    ++ modules;
+  };
+  net = nixos.config.agentVM.network;
+  package = pkgs.writeShellApplication {
+    name = "agent-vm";
+    runtimeInputs = with pkgs; [
+      coreutils
+      util-linux
+      openssh
+      bubblewrap
+      gnugrep
+      gnused
+    ];
+    runtimeEnv = {
+      AGENT_RUNNER = "${nixos.config.microvm.declaredRunner}/bin";
+      AGENT_NETWORK = net.mode;
+      AGENT_WEB_BIND = net.hostAddress;
+      AGENT_WEB_PORT = toString net.webPort;
+      AGENT_SSH_HOST = if net.mode == "user" then "127.0.0.1" else net.guestAddress;
+      AGENT_SSH_PORT = toString (if net.mode == "user" then net.sshPort else 22);
+    };
+    text = builtins.readFile ./launch.sh;
+  };
+in
+assert lib.assertMsg (
+  system == "x86_64-linux"
+) "agent-vm currently supports x86_64-linux hosts/guests";
+{
+  inherit nixos package;
+  app = {
+    type = "app";
+    program = lib.getExe package;
+    meta.description = "Run DSH with this project's toolchain and live workspace";
+  };
+}