anchor.diff:          message = "The libvirtd module currently requires Polkit to be enabled ('security.polkit.enable = true').";
         }
         {
  -        assertion = builtins.elem "fd" cfg.qemuOvmfPackage.outputs;
  +        assertion = builtins.elem "fd" cfg.qemu.ovmf.package.outputs;
           message = "The option 'virtualisation.libvirtd.qemuOvmfPackage' needs a package that has an 'fd' output.";
         }
       ];
   
       environment = {
         # this file is expected in /etc/qemu and not sysconfdir (/var/lib)
  -      etc."qemu/bridge.conf".text = lib.concatMapStringsSep "\n" (e:
  -        "allow ${e}") cfg.allowedBridges;
  -      systemPackages = with pkgs; [ libressl.nc iptables cfg.package cfg.qemuPackage ];
  +      etc."qemu/bridge.conf".text = lib.concatMapStringsSep "\n"
  +        (e:
  +          "allow ${e}")
  +        cfg.allowedBridges;
  +      systemPackages = with pkgs; [ libressl.nc iptables cfg.package cfg.qemu.package ];
         etc.ethertypes.source = "${pkgs.ebtables}/etc/ethertypes";
       };
   
  
positive.code:     };
  
      onShutdown = mkOption {
        type = types.enum ["shutdown" "suspend" ];
        default = "suspend";
        description = ''
          When shutting down / restarting the host what method should
  
negative.code:   '';
    ovmfFilePrefix = if pkgs.stdenv.isAarch64 then "AAVMF" else "OVMF";
    qemuConfigFile = pkgs.writeText "qemu.conf" ''
      ${optionalString cfg.qemu.ovmf.enable ''
        nvram = [ "/run/libvirt/nix-ovmf/${ovmfFilePrefix}_CODE.fd:/run/libvirt/nix-ovmf/${ovmfFilePrefix}_VARS.fd" ]
      ''}
      ${optionalString (!cfg.qemu.runAsRoot) ''
        user = "qemu-libvirtd"
        group = "qemu-libvirtd"
      ''}
      ${cfg.qemu.verbatimConfig}
    '';
    dirName = "libvirt";
    subDirs = list: [ dirName ] ++ map (e: "${dirName}/${e}") list;
  
    ovmfModule = types.submodule {
      options = {
        enable = mkOption {
          type = types.bool;
          default = true;
          description = ''
            Allows libvirtd to take advantage of OVMF when creating new
            QEMU VMs with UEFI boot.
          '';
        };
  
        package = mkOption {
          type = types.package;
          default = pkgs.OVMF;
          defaultText = literalExpression "pkgs.OVMF";
          example = literalExpression "pkgs.OVMFFull";
          description = ''
            OVMF package to use.
          '';
        };
      };
    };
  
    swtpmModule = types.submodule {
      options = {
        enable = mkOption {
          type = types.bool;
          default = false;
          description = ''
            Allows libvirtd to use swtpm to create an emulated TPM.
          '';
        };
  
        package = mkOption {
          type = types.package;
          default = pkgs.swtpm;
          defaultText = literalExpression "pkgs.swtpm";
          description = ''
            swtpm package to use.
          '';
        };
      };
    };
  
    qemuModule = types.submodule {
      options = {
        package = mkOption {
          type = types.package;
          default = pkgs.qemu;
          defaultText = literalExpression "pkgs.qemu";
          description = ''
            Qemu package to use with libvirt.
            `pkgs.qemu` can emulate alien architectures (e.g. aarch64 on x86)
            `pkgs.qemu_kvm` saves disk space allowing to emulate only host architectures.
          '';
        };
  
        runAsRoot = mkOption {
          type = types.bool;
          default = true;
          description = ''
            If true,  libvirtd runs qemu as root.
            If false, libvirtd runs qemu as unprivileged user qemu-libvirtd.
            Changing this option to false may cause file permission issues
            for existing guests. To fix these, manually change ownership
            of affected files in /var/lib/libvirt/qemu to qemu-libvirtd.
          '';
        };
  
        verbatimConfig = mkOption {
          type = types.lines;
          default = ''
            namespaces = []
          '';
          description = ''
            Contents written to the qemu configuration file, qemu.conf.
            Make sure to include a proper namespace configuration when
            supplying custom configuration.
          '';
        };
  
        ovmf = mkOption {
          type = ovmfModule;
          default = { };
          description = ''
            QEMU's OVMF options.
          '';
        };
  
        swtpm = mkOption {
          type = swtpmModule;
          default = { };
          description = ''
            QEMU's swtpm options.
          '';
        };
      };
    };
  in
  {
  
    imports = [
      (mkRemovedOptionModule [ "virtualisation" "libvirtd" "enableKVM" ]
        "Set the option `virtualisation.libvirtd.qemu.package' instead.")
      (mkRenamedOptionModule
        [ "virtualisation" "libvirtd" "qemuPackage" ]
        [ "virtualisation" "libvirtd" "qemu" "package" ])
      (mkRenamedOptionModule
        [ "virtualisation" "libvirtd" "qemuRunAsRoot" ]
        [ "virtualisation" "libvirtd" "qemu" "runAsRoot" ])
      (mkRenamedOptionModule
        [ "virtualisation" "libvirtd" "qemuVerbatimConfig" ]
        [ "virtualisation" "libvirtd" "qemu" "verbatimConfig" ])
      (mkRenamedOptionModule
        [ "virtualisation" "libvirtd" "qemuOvmf" ]
        [ "virtualisation" "libvirtd" "qemu" "ovmf" "enable" ])
      (mkRenamedOptionModule
        [ "virtualisation" "libvirtd" "qemuOvmfPackage" ]
        [ "virtualisation" "libvirtd" "qemu" "ovmf" "package" ])
      (mkRenamedOptionModule
        [ "virtualisation" "libvirtd" "qemuSwtpm" ]
        [ "virtualisation" "libvirtd" "qemu" "swtpm" "enable" ])
    ];
  
    ###### interface
  