AHCI storage for laptop images, plaintext password fix

Laptop images now use AHCI storage + e1000 network instead of VirtIO.
This fixes "inaccessible boot device" on real hardware — the AHCI→NVMe
driver transition is handled by Windows, unlike VirtIO→NVMe which isn't.

- makeImage: useAHCI flag switches disk to ide-hd and network to e1000
- customizeImage: auto-detects useAHCI from original image, propagates it
- win10/win11 laptop images: useAHCI = true
- vmix run: --ahci flag for running laptop images in QEMU
- generalize: PlainText password tags in OOBE unattend XML

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

flake.nix

@@ -77,11 +77,13 @@
         RUN_INPUT="$1"; shift
         RUN_MEM=4096
         RUN_SMP=4
+        RUN_AHCI=false
         while [[ ''${#} -gt 0 ]]; do
           case "$1" in
-            --mem) RUN_MEM="$2"; shift 2 ;;
-            --smp) RUN_SMP="$2"; shift 2 ;;
-            *)     echo "Unknown option: $1"; exit 1 ;;
+            --mem)  RUN_MEM="$2"; shift 2 ;;
+            --smp)  RUN_SMP="$2"; shift 2 ;;
+            --ahci) RUN_AHCI=true; shift ;;
+            *)      echo "Unknown option: $1"; exit 1 ;;
           esac
         done
 
@@ -115,8 +117,12 @@
           -drive if=pflash,format=raw,file=/tmp/vmix-run-vars-$$.fd \
           -rtc base=localtime,clock=host \
           -device qemu-xhci -device usb-tablet \
-          -drive file="$RUN_IMAGE",format=qcow2,if=virtio,snapshot=on \
-          -nic user,model=virtio-net-pci \
+          $(if [[ "$RUN_AHCI" == "true" ]]; then
+            echo "-drive file=$RUN_IMAGE,format=qcow2,if=none,id=disk0,snapshot=on -device ide-hd,drive=disk0"
+          else
+            echo "-drive file=$RUN_IMAGE,format=qcow2,if=virtio,snapshot=on"
+          fi) \
+          -nic user,model=$(if [[ "$RUN_AHCI" == "true" ]]; then echo e1000; else echo virtio-net-pci; fi) \
           -device virtio-serial-pci \
           -chardev spicevmc,id=vdagent,debug=0,name=vdagent \
           -device virtserialport,chardev=vdagent,name=com.redhat.spice.0

lib/images/windows/helpers/customizeImage.nix

@@ -30,6 +30,7 @@
     customImageName = (if name != "" then name else "custom") + "-${originalImageName}-vmix.qcow2";
     resultImg = "./disk.qcow2";
 
+    isAHCI = originalImage.useAHCI or false;
     hasRegistry = windowsRegistry != "";
     hasAuditScript = auditScript != "";
 
@@ -98,9 +99,11 @@
         -drive if=pflash,format=raw,file=vars.fd \
         -rtc base=localtime,clock=host \
         -device qemu-xhci -device usb-tablet \
-        -drive file=${resultImg},format=qcow2,if=virtio \
+        ${if isAHCI
+          then "-drive file=${resultImg},format=qcow2,if=none,id=disk0 -device ide-hd,drive=disk0"
+          else "-drive file=${resultImg},format=qcow2,if=virtio"} \
         ${cdromArgs} \
-        -nic user,model=virtio-net-pci"
+        -nic user,model=${if isAHCI then "e1000" else "virtio-net-pci"}"
 
       timeout 1800 qemu-system-x86_64 $VMIX_DISPLAY $QEMU_ARGS || \
         if [[ "$VMIX_DISPLAY" == "-display sdl" ]]; then
@@ -127,4 +130,4 @@
     requiredSystemFeatures = [ "kvm" ];
   } // lib.optionalAttrs impure { __noChroot = true; }) builderCommand;
   in
-    builtImage // { _vmixOsType = "windows"; }
+    builtImage // { _vmixOsType = "windows"; useAHCI = isAHCI; }

lib/images/windows/helpers/makeImage.nix

@@ -15,6 +15,7 @@
   smp ? 4,
   memSize ? 4096,
   vncDisplay ? null,  # e.g. ":10" to enable VNC on port 5910 for monitoring
+  useAHCI ? false,    # use AHCI storage instead of VirtIO (for physical hardware deployment)
   windowsVersionForVirtioDrivers ? "w10",  # "w10", "w11", "2k22", "2k19", etc.
 }:
 let
@@ -65,10 +66,12 @@ let
       -drive if=pflash,format=raw,file=vars.fd \
       -rtc base=localtime,clock=host \
       -device qemu-xhci -device usb-tablet \
-      -drive file=disk.qcow2,format=qcow2,if=virtio \
+      ${if useAHCI
+        then "-drive file=disk.qcow2,format=qcow2,if=none,id=disk0 -device ide-hd,drive=disk0"
+        else "-drive file=disk.qcow2,format=qcow2,if=virtio"} \
       -drive file=${iso},media=cdrom,readonly=on \
       -drive file=${drivers.virtio-iso},media=cdrom,readonly=on \
-      -nic user,model=virtio-net-pci"
+      -nic user,model=${if useAHCI then "e1000" else "virtio-net-pci"}"
 
     timeout 3600 qemu-system-x86_64 $VMIX_DISPLAY $QEMU_ARGS || \
       if [[ "$VMIX_DISPLAY" == "-display sdl" ]]; then
@@ -82,4 +85,4 @@ let
     echo "=== vmix: ${name} install complete ==="
     mv disk.qcow2 $out
   '';
-in drv // { _vmixOsType = "windows"; }
+in drv // { _vmixOsType = "windows"; inherit useAHCI; }

lib/images/windows/templates/generalize.nix

@@ -127,6 +127,7 @@ in
               <LocalAccount wcm:action="add">
                 <Password>
                   <Value>${password}</Value>
+                  <PlainText>true</PlainText>
                 </Password>
                 <Group>Administrators</Group>
                 <Name>${username}</Name>
@@ -136,6 +137,7 @@ in
           <AutoLogon>
             <Password>
               <Value>${password}</Value>
+              <PlainText>true</PlainText>
             </Password>
             <Enabled>true</Enabled>
             <Username>${username}</Username>

lib/images/windows/win10/images.nix

@@ -36,5 +36,6 @@ with windows;
     name = "win10-ltsc-2021-laptop";
     upstreamISO = upstreamISOs.win10-ltsc-2021;
     productKey = "M7XTQ-FN8P6-TTKYV-9D4CC-J462D";
+    useAHCI = true;
   }) templates.bundles.laptop;
 }

lib/images/windows/win11/images.nix

@@ -41,6 +41,7 @@ with windows;
     upstreamISO = upstreamISOs.win11-ltsc-2024;
     productKey = "M7XTQ-FN8P6-TTKYV-9D4CC-J462D";
     bypassRequirements = true;
+    useAHCI = true;
     windowsVersionForVirtioDrivers = "w11";
   }) (templates.bundles.laptop ++ [ templates.reg.disableUCPD ]);
 }