From e614cf9e5bd5e4e52a3c9686caa3d128fa8cabeb Mon Sep 17 00:00:00 2001
From: andre4ik3 <andre4ik3@fastmail.com>
Date: Sun, 7 Dec 2025 00:40:12 +0000
Subject: [PATCH] nixos/libvirtd: add dbus support

---
 nixos/modules/virtualisation/libvirtd.nix | 40 +++++++++++++++++------
 nixos/tests/libvirtd.nix                  | 11 +++++++
 pkgs/by-name/li/libvirt-dbus/package.nix  | 10 ++++--
 3 files changed, 49 insertions(+), 12 deletions(-)

diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix
index a4ae4e2c7ffc..dc1ec27c967f 100644
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@@ -394,6 +394,11 @@ in
         The backend used to setup virtual network firewall rules.
       '';
     };
+
+    dbus = {
+      enable = mkEnableOption "exposing libvirtd APIs over D-Bus";
+      package = mkPackageOption pkgs "libvirt-dbus" { };
+    };
   };
 
   ###### implementation
@@ -426,15 +431,28 @@ in
 
     boot.kernelModules = [ "tun" ];
 
-    users.groups.libvirtd.gid = config.ids.gids.libvirtd;
-
-    # libvirtd runs qemu as this user and group by default
-    users.extraGroups.qemu-libvirtd.gid = config.ids.gids.qemu-libvirtd;
-    users.extraUsers.qemu-libvirtd = {
-      uid = config.ids.uids.qemu-libvirtd;
-      isNormalUser = false;
-      group = "qemu-libvirtd";
-    };
+    users = lib.mkMerge [
+      {
+        # libvirtd runs qemu as this user and group by default
+        users.qemu-libvirtd = {
+          uid = config.ids.uids.qemu-libvirtd;
+          isNormalUser = false;
+          group = "qemu-libvirtd";
+        };
+        groups = {
+          libvirtd.gid = config.ids.gids.libvirtd;
+          qemu-libvirtd.gid = config.ids.gids.qemu-libvirtd;
+        };
+      }
+      (lib.mkIf cfg.dbus.enable {
+        users.libvirtdbus = {
+          isSystemUser = true;
+          group = "libvirtdbus";
+          description = "Libvirt D-Bus bridge";
+        };
+        groups.libvirtdbus = { };
+      })
+    ];
 
     security.wrappers.qemu-bridge-helper = {
       setuid = true;
@@ -449,7 +467,7 @@ in
 
     services.firewalld.packages = [ cfg.package ];
 
-    systemd.packages = [ cfg.package ];
+    systemd.packages = [ cfg.package ] ++ lib.optional cfg.dbus.enable cfg.dbus.package;
 
     systemd.services.libvirtd-config = {
       description = "Libvirt Virtual Machine Management Daemon - configuration";
@@ -629,5 +647,7 @@ in
       (mkIf cfg.nss.enable (mkOrder 430 [ "libvirt" ]))
       (mkIf cfg.nss.enableGuest (mkOrder 432 [ "libvirt_guest" ]))
     ];
+
+    services.dbus.packages = lib.optional cfg.dbus.enable cfg.dbus.package;
   };
 }
diff --git a/nixos/tests/libvirtd.nix b/nixos/tests/libvirtd.nix
index d7df4c560177..8ec9efe4700b 100644
--- a/nixos/tests/libvirtd.nix
+++ b/nixos/tests/libvirtd.nix
@@ -16,6 +16,7 @@
             touch /tmp/qemu_hook_is_working
           ''}";
           libvirtd.nss.enable = true;
+          libvirtd.dbus.enable = true;
         };
         boot.supportedFilesystems = [ "zfs" ];
         networking.hostId = "deadbeef"; # needed for zfs
@@ -72,5 +73,15 @@
       with subtest("test if hooks are linked and run"):
         virthost.succeed("ls /var/lib/libvirt/hooks/qemu.d/is_working")
         virthost.succeed("ls /tmp/qemu_hook_is_working")
+
+      with subtest("check libvirt over dbus"):
+        # The service is activated on-demand and shouldn't be active yet
+        virthost.fail("systemctl is-active libvirt-dbus.service")
+
+        # Get the hostname property of the Test connection (this will activate the service)
+        virthost.succeed("busctl get-property org.libvirt /org/libvirt/Test org.libvirt.Connect Hostname")
+
+        # Now the service should be active
+        virthost.succeed("systemctl is-active libvirt-dbus.service")
     '';
 }
diff --git a/pkgs/by-name/li/libvirt-dbus/package.nix b/pkgs/by-name/li/libvirt-dbus/package.nix
index a898b51bf923..fae5d412b5ef 100644
--- a/pkgs/by-name/li/libvirt-dbus/package.nix
+++ b/pkgs/by-name/li/libvirt-dbus/package.nix
@@ -11,6 +11,7 @@
   systemd,
   gitUpdater,
   lib,
+  nixosTests,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -60,8 +61,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = false; # needs running D-Bus and libvirt
 
-  passthru.updateScript = gitUpdater {
-    rev-prefix = "v";
+  passthru = {
+    updateScript = gitUpdater {
+      rev-prefix = "v";
+    };
+    tests = {
+      inherit (nixosTests) libvirtd;
+    };
   };
 
   meta = {