Git Sagar
702f723e6d
A sealed image bakes no per-VM data. generalize.nix gains a gated configMedium flag (false path byte-identical, so the shared macOS generalize path is untouched): the baked answer file stays generic and the target's first boot reads hostname/static-IP/timezone/tint off a small removable CD via a finder (vmix-load-config.cmd) + applier (vmix-apply-config.ps1), with the static-IP script dot-sourcing the same config. templates.seal is a thin preset (delayOobeRun + configMedium + D:\Users profiles + a data disk); images gain a .seal leaf next to .generalize; makeConfigMedium renders the per-VM ISO. So one sealed store path is shared by every VM, each mints its own SID on first boot and builds the whole profile on D:, and only a cheap ISO is per-VM. Also folds in the delayOobeRun reconcile: extraDisk (and the audit-mode data-disk init) are gated off under deferral, so a sealed image ships with no throwaway `data` output -- the target's specialize formats the host zvol instead. vms: disks.config.file attaches the config medium as a second CD-ROM. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0117qMyjpuXsjpVAcpJbFD8g
102 lines
3.6 KiB
Nix
102 lines
3.6 KiB
Nix
# Windows customization templates.
|
|
# Templates can provide:
|
|
# windowsRegistry — offline registry merge (fast, no boot)
|
|
# auditScript — runs in Audit Mode via QEMU boot
|
|
# cdroms — ISOs to attach when booting for auditScript
|
|
# uploads — files to inject into the image before auditScript
|
|
{ pkgs, lib, system, drivers, makeFilesISO, ... }:
|
|
let
|
|
args = { inherit pkgs lib system drivers makeFilesISO; };
|
|
in rec {
|
|
# Essentials (drivers, runtimes, removals, performance)
|
|
essentials = {
|
|
virtioTools = import ./essentials/virtio-tools.nix args;
|
|
removeEdge = import ./essentials/remove-edge.nix args;
|
|
removeIE = import ./essentials/remove-ie.nix args;
|
|
removeWMP = import ./essentials/remove-wmp.nix args;
|
|
removePaint = import ./essentials/remove-paint.nix args;
|
|
amdGpuDrivers = import ./essentials/amd-gpu-drivers.nix args;
|
|
vcppRuntimes = import ./essentials/vcpp-runtimes.nix args;
|
|
bestPerformance = import ./essentials/best-performance.nix args;
|
|
clearFileAssociations = import ./essentials/clear-file-associations.nix args;
|
|
virtioDrivers = import ./essentials/virtio-drivers.nix args;
|
|
};
|
|
|
|
# Applications
|
|
apps = {
|
|
thorium = import ./apps/thorium.nix args;
|
|
edgeWebview = import ./apps/edge-webview.nix args;
|
|
sevenZip = import ./apps/7zip.nix args;
|
|
vlc = import ./apps/vlc.nix args;
|
|
imageGlass = import ./apps/imageglass.nix args;
|
|
sandboxie = import ./apps/sandboxie.nix args;
|
|
office = import ./apps/office.nix args;
|
|
};
|
|
|
|
# Default file associations policy
|
|
defaultApps = import ./default-apps.nix args;
|
|
|
|
# Generalize (sysprep + OOBE). Pass seal=true for hardware deployment.
|
|
generalize = import ./generalize.nix args;
|
|
|
|
# Seal: a generic OOBE-deferred base whose per-VM data is not baked but
|
|
# delivered at deploy time on a config medium (helpers/makeConfigMedium.nix).
|
|
# One sealed store path is shared by every VM; each VM's first boot mints its
|
|
# own SID and builds the whole profile on the relocated data volume (D:).
|
|
# Forces only the structural bits -- account, RDP and locale stay caller args.
|
|
seal = templateArgs: generalize ({
|
|
delayOobeRun = true;
|
|
configMedium = true;
|
|
profilesDirectory = "D:\\Users";
|
|
dataDisk = { driveLetter = "D"; label = "data"; };
|
|
} // templateArgs);
|
|
|
|
# Offline registry templates
|
|
reg = import ./registry args;
|
|
|
|
# Bundles — reusable template lists for common use cases
|
|
bundles = {
|
|
# Essentials only: debloat + registry tweaks, no apps
|
|
laptopSlim = [
|
|
essentials.removeIE
|
|
essentials.removeWMP
|
|
essentials.removeEdge
|
|
essentials.vcppRuntimes
|
|
essentials.bestPerformance
|
|
reg.disableTelemetry
|
|
reg.disableErrorReporting
|
|
reg.disableUpdates
|
|
reg.disableSmartScreen
|
|
reg.disablePrivacyTracking
|
|
reg.disableAI
|
|
reg.disableConsumerFeatures
|
|
reg.performanceTweaks
|
|
apps.thorium
|
|
apps.sevenZip
|
|
];
|
|
|
|
# Full: essentials + apps
|
|
laptop = [
|
|
essentials.removeIE
|
|
essentials.removeWMP
|
|
essentials.removeEdge
|
|
essentials.vcppRuntimes
|
|
essentials.bestPerformance
|
|
reg.disableTelemetry
|
|
reg.disableErrorReporting
|
|
reg.disableUpdates
|
|
reg.disableSmartScreen
|
|
reg.disablePrivacyTracking
|
|
reg.disableAI
|
|
reg.disableConsumerFeatures
|
|
reg.performanceTweaks
|
|
apps.edgeWebview
|
|
apps.thorium
|
|
apps.sevenZip
|
|
apps.vlc
|
|
apps.imageGlass
|
|
essentials.virtioDrivers # needed for network during Office download
|
|
apps.office
|
|
];
|
|
};
|
|
}
|