feat: add project-composable DeepSeek Harness microVMs

Share the live project cwd, DSH home and skills read-write while running guest root behind rootless QEMU and Bubblewrap. Reuse project toolchains, expose configurable SSH-forwarded web access, and launch the latest official DSH. Include the project template, operating guide, offline boot and mount tests, and shell checks.
2026-09-06 12:45:36 -05:00
parent 221e0b33cc
commit 35ca88d517
14 changed files with 1219 additions and 0 deletions
@@ -0,0 +1,92 @@
+{
+  inputs,
+  pkgs,
+  example,
+}:
+let
+  c = example.nixos.config;
+  testVM = inputs.self.lib.mkAgentVM {
+    system = pkgs.stdenv.hostPlatform.system;
+    project = {
+      packages = [ pkgs.hello ];
+      env.AGENT_PROJECT_TEST = "shared";
+    };
+    modules = [
+      {
+        # Offline infrastructure test. A real DSH startup is tested separately;
+        # @latest needs the network and is intentionally outside Nix reproducibility.
+        agentVM.package = pkgs.writeShellScriptBin "dsh" ''
+          echo 'http://127.0.0.1:3080/?token=offline-test'
+          exec ${pkgs.coreutils}/bin/sleep infinity
+        '';
+      }
+    ];
+  };
+  tap = inputs.self.lib.mkAgentVM {
+    system = pkgs.stdenv.hostPlatform.system;
+    project.packages = [ ];
+    modules = [
+      {
+        microvm.mem = 8192;
+        microvm.vcpu = 6;
+        agentVM.network = {
+          mode = "tap";
+          tapName = "agent-test";
+          guestAddress = "192.168.77.2";
+          gateway = "192.168.77.1";
+          dns = [ "192.168.77.1" ];
+        };
+      }
+    ];
+  };
+in
+{
+  config =
+    assert c.microvm.mem == 4096;
+    assert c.microvm.vcpu == 4;
+    assert builtins.length c.microvm.shares == 3;
+    assert builtins.all (s: !s.readOnly && s.securityModel == "none") c.microvm.shares;
+    assert c.microvm.storeOnDisk;
+    assert c.systemd.services.agent.serviceConfig.User == "root";
+    assert c.systemd.services.agent.serviceConfig.WorkingDirectory == "/workspace";
+    assert c.services.openssh.settings.PasswordAuthentication == false;
+    assert c.services.openssh.settings.AllowAgentForwarding == false;
+    assert builtins.length c.microvm.forwardPorts == 1;
+    assert (builtins.head c.microvm.forwardPorts).host.address == "127.0.0.1";
+    assert builtins.elem pkgs.hello c.environment.systemPackages;
+    assert c.environment.variables.AGENT_PROJECT_TEST == "shared";
+    assert tap.nixos.config.microvm.mem == 8192;
+    assert tap.nixos.config.microvm.vcpu == 6;
+    assert tap.nixos.config.microvm.forwardPorts == [ ];
+    assert (builtins.head tap.nixos.config.microvm.interfaces).id == "agent-test";
+    pkgs.runCommand "agent-vm-config-check" { } ''touch "$out"'';
+
+  shell =
+    pkgs.runCommand "agent-vm-shell-check"
+      {
+        nativeBuildInputs = [
+          pkgs.shellcheck
+          pkgs.bash
+        ];
+      }
+      ''
+        shellcheck -s bash ${./launch.sh} ${./boot-test.sh}
+        bash -n ${./launch.sh}
+        touch "$out"
+      '';
+
+  boot =
+    pkgs.runCommand "agent-vm-boot-check"
+      {
+        requiredSystemFeatures = [ "kvm" ];
+        nativeBuildInputs = [
+          pkgs.bash
+          pkgs.coreutils
+          pkgs.gnugrep
+        ];
+      }
+      ''
+        bash ${./boot-test.sh} ${testVM.package}/bin/agent-vm
+        touch "$out"
+      '';
+}