wip

justfile

@@ -24,3 +24,37 @@ iso:
 # garbage collect old generations
 clean:
     sudo nix-collect-garbage $(nix eval --raw -f ./nix.nix nix.gc.options)
+
+# build sandbox VM image
+sandbox-build:
+    nixos-rebuild build-image --image-variant qemu --flake .#sandbox
+
+# run sandbox with GUI (ephemeral, changes discarded)
+sandbox-run:
+    nix shell nixpkgs#qemu -c qemu-system-x86_64 -enable-kvm -m 8G -smp 4 \
+      -drive file=$(find -L result -name '*.qcow2' | head -1),format=qcow2,snapshot=on \
+      -vga virtio -display gtk,zoom-to-fit=false \
+      -device virtio-serial-pci \
+      -chardev qemu-vdagent,id=ch1,name=vdagent,clipboard=on \
+      -device virtserialport,chardev=ch1,id=ch1,name=com.redhat.spice.0 \
+      -virtfs local,path=$HOME/git,mount_tag=projects,security_model=mapped-xattr,id=fs0 \
+      -virtfs local,path=$HOME/.claude,mount_tag=hostclaude,security_model=mapped-xattr,id=fs1 \
+      -virtfs local,path=$HOME,mount_tag=hosthome,security_model=mapped-xattr,id=fs2,readonly=on \
+      -nic user,hostfwd=tcp::2222-:22
+
+# run sandbox headless (ephemeral, changes discarded)
+sandbox-run-headless:
+    nix shell nixpkgs#qemu -c qemu-system-x86_64 -enable-kvm -m 8G -smp 4 \
+      -drive file=$(find -L result -name '*.qcow2' | head -1),format=qcow2,snapshot=on \
+      -virtfs local,path=$HOME/git,mount_tag=projects,security_model=mapped-xattr,id=fs0 \
+      -virtfs local,path=$HOME/.claude,mount_tag=hostclaude,security_model=mapped-xattr,id=fs1 \
+      -virtfs local,path=$HOME,mount_tag=hosthome,security_model=mapped-xattr,id=fs2,readonly=on \
+      -nic user,hostfwd=tcp::2222-:22 -nographic
+
+# ssh into running sandbox
+sandbox-ssh:
+    ssh -A -p 2222 gorazd@localhost
+
+# hot-mount a host directory into the running sandbox
+sandbox-mount path:
+    ssh -p 2222 gorazd@localhost "mkdir -p ~/mnt/$(basename {{path}}) && sshfs matej@10.0.2.2:{{path}} ~/mnt/$(basename {{path}})"