dotfiles/modules/nixos/homelab/guests/zookeeper/config/default.nix

{
  flake,
  pkgs,
  lib,
  ...
}:
let
  inherit (flake.config.people) user0;
  inherit (flake.config.services) instances;
  serviceCfg = instances.zookeeper;
in
{
  zookeeperVM =
    {
      user,
      ip,
      mac,
      userMac,
      package,
    }:
    {

      microvm.vms = {
        "${serviceCfg.name}-${user}" = {
          autostart = true;
          restartIfChanged = true;
          config = {
            system.stateVersion = "24.05";
            time.timeZone = "America/Winnipeg";
            users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
            services.openssh = {
              enable = true;
              settings.PasswordAuthentication = false;
            };
            networking.firewall.allowedTCPPorts = [ 22 ];
            systemd = {
              services = {
                zookeeper = {
                  serviceConfig = {
                    ExecStart = lib.getExe package;
                    Restart = "always";
                    RestartSec = 2;
                    EnvironmentFile = "/run/secrets/${user}-env";
                  };
                  wantedBy = [ "multi-user.target" ];
                };
                systemd-networkd.wantedBy = [ "multi-user.target" ];
              };
              network = {
                enable = true;
                networks."20-lan" = {
                  matchConfig.Name = "enp0s3";
                  addresses = [ { Address = "${ip}/24"; } ];
                  routes = [
                    {
                      Destination = "0.0.0.0/0";
                      Gateway = "192.168.50.1";
                    }
                  ];
                  dns = [
                    "1.1.1.1"
                    "8.8.8.8"
                  ];
                };
              };
            };
            microvm = {
              vcpu = 1;
              mem = 512;
              hypervisor = "qemu";
              interfaces = [
                {
                  type = "tap";
                  id = "vm-qb-${user}";
                  mac = mac;
                }
              ];
              shares = [
                {
                  mountPoint = "/nix/.ro-store";
                  proto = "virtiofs";
                  source = "/nix/store";
                  tag = "read_only_nix_store";
                }
                {
                  mountPoint = "/run/secrets";
                  proto = "virtiofs";
                  source = "/run/secrets/${serviceCfg.name}";
                  tag = "host_secrets";
                }
              ];
            };
          };
        };
      };
      sops.secrets = {
        "${serviceCfg.name}/${user}-env" = {
          owner = "root";
          mode = "0600";
        };
      };
    };
}