laksjdalksjd

profiles/base/default.nix

@@ -85,9 +85,12 @@
   networking.firewall.logRefusedConnections = false; # too spammy, rotates dmesg too quickly
 
   # nixos-rebuild switch --specialisation no-firewall
-  specialisation.no-firewall.configuration = {
-    networking.firewall.enable = false;
-    services.fail2ban.enable = false; # requires firewall
+
+  specialisation = lib.mkIf (config.networking.firewall.enable && !config.virtualisation.isVmVariant) {
+    no-firewall.configuration = {
+      networking.firewall.enable = false;
+      services.fail2ban.enable = false; # requires firewall
+    };
   };
 
   security.sudo.execWheelOnly = true;

profiles/base/vm-variant.nix

@@ -4,6 +4,7 @@
     type = lib.types.bool;
     default = false;
   };
+  # to be used with 'lib.mkIf (!config.virtualisation.isVmVariant)'
   config.virtualisation.vmVariant = {
     virtualisation.isVmVariant = true;
   };