modules: add bagel-container

hosts/epyc.nix

@@ -13,6 +13,7 @@ in
     ../modules/android-cache.nix
     ../modules/garage.nix
     ../modules/users/friends.nix
+    ../modules/bagel-container.nix
   ];
 
   networking.hostName = "epyc";

modules/bagel-container.nix

@@ -0,0 +1,26 @@
+# Stateful/mutable container used for Bagel (tm) related infra (mostly
+# rebuilding nixpkgs a lot).
+#
+# System image is stored at /var/lib/machines/bagel.
+{
+  systemd.nspawn.bagel = {
+    execConfig = {
+      Boot = true;
+      Ephemeral = false;
+      PrivateUsers = true;
+      NotifyReady = true;
+      LinkJournal = "try-guest";
+    };
+
+    networkConfig = {
+      Bridge = "wan-br";
+    };
+  };
+
+  systemd.services."systemd-nspawn@bagel" = {
+    wantedBy = [ "machines.target" ];
+    wants = [ "network.target" ];
+    after = [ "network.target" ];
+    overrideStrategy = "asDropin";
+  };
+}