nixos-config/modules/system/services/general/libvirtd/default.nix

{ config, lib, pkgs, ... }:
{
  options.system.libvirtd.enable = lib.mkEnableOption "Enable libvirtd services";

  config = lib.mkIf config.system.libvirtd.enable {
    virtualisation = {
      libvirtd = {
        enable = true;
        onBoot = "ignore";
        onShutdown = "shutdown";
        qemu = {
          ovmf = {
            enable = true;
            packages = with pkgs; [ OVMFFull.fd ];
          };
          swtpm.enable = true;
        };
      };
    };

    environment = {
      systemPackages = with pkgs; [
        virt-manager
        virtiofsd
        dnsmasq
        spice-vdagent
        looking-glass-client
      ];

      persistence."/persist".directories = [
        "/var/lib/libvirt/dnsmasq"
        "/var/lib/libvirt/nwfilter"
        "/var/lib/libvirt/qemu"
        "/var/lib/libvirt/secrets"
        "/var/lib/libvirt/storage"
        "/var/lib/libvirt/swtpm"
      ];
    };

    # Needed to make NAT work
    networking.firewall.trustedInterfaces = [
      "virbr0"
      "virbr1"
    ];

    systemd.tmpfiles.rules = [ "f /dev/shm/looking-glass 0660 ${config.sysusers.main} libvirtd -" ];
  };
}