feat: add project-composable DeepSeek Harness microVMs

Share the live project cwd, DSH home and skills read-write while running guest root behind rootless QEMU and Bubblewrap. Reuse project toolchains, expose configurable SSH-forwarded web access, and launch the latest official DSH. Include the project template, operating guide, offline boot and mount tests, and shell checks.
2026-09-06 12:45:36 -05:00
parent 221e0b33cc
commit 35ca88d517
14 changed files with 1219 additions and 0 deletions
@@ -0,0 +1,44 @@
+{
+  description = "Project toolchain + DeepSeek Harness microVM";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    # Local bootstrap. For teammates/CI use your Git remote's moving branch:
+    # git+https://YOUR-REMOTE/nixconfig.git?dir=agent-vm&ref=main
+    agent-vm.url = "path:/etc/nix/agent-vm";
+    agent-vm.inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  outputs =
+    { nixpkgs, agent-vm, ... }:
+    let
+      system = "x86_64-linux";
+      pkgs = nixpkgs.legacyPackages.${system};
+      project = import ./project.nix { inherit pkgs; };
+      agent = agent-vm.lib.mkAgentVM {
+        inherit system project;
+        modules = [
+          {
+            microvm.mem = 4096; # MiB
+            microvm.vcpu = 4;
+            agentVM.network = {
+              hostAddress = "127.0.0.1"; # Or a host LAN/VPN IPv4 address, or 0.0.0.0.
+              sshPort = 2222; # Always host localhost in user-network mode.
+              webPort = 3080;
+              # For 0.0.0.0, list the actual browser authorities, not a wildcard:
+              # trustedHosts = [ "192.168.1.20:3080" ];
+            };
+          }
+        ];
+      };
+    in
+    {
+      devShells.${system}.default = pkgs.mkShell {
+        inherit (project) packages env;
+      };
+      packages.${system}.agent = agent.package;
+      apps.${system}.agent = agent.app;
+      nixosConfigurations.agent = agent.nixos;
+      formatter.${system} = pkgs.nixfmt;
+    };
+}