Remove unused libvirt configuration

4 files changed, 0 insertions, 34 deletions

diff --git a/dot_config/libvirt/libvirt.conf b/dot_config/libvirt/libvirt.conf
deleted file mode 100644
index deb583b..0000000
--- a/dot_config/libvirt/libvirt.conf
+++ /dev/null
@@ -1 +0,0 @@
-uri_default = "qemu:///system"
diff --git a/etc/nftables.conf b/etc/nftables.conf
index cb6e4d7..fc2d1e7 100644
--- a/etc/nftables.conf
+++ b/etc/nftables.conf
@@ -15,13 +15,6 @@ table inet filter {
     meta l4proto { icmp, icmpv6 } accept comment "allow icmp"
     meta pkttype multicast udp dport 5353 accept comment "allow mDNS discovery"
 
-    # libvirt's NAT bridge: let guests reach the host's dnsmasq for DHCP+DNS.
-    # libvirt manages its own forward/NAT chains but does NOT touch the input
-    # chain, so without this rule guests get no IP (DHCP packets are dropped
-    # before dnsmasq sees them).
-    iifname "virbr0" udp dport { 53, 67 } accept comment "libvirt: DHCP+DNS from guests"
-    iifname "virbr0" tcp dport 53 accept comment "libvirt: DNS over TCP from guests"
-
     pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited
     counter
   }
@@ -29,14 +22,5 @@ table inet filter {
     type filter hook forward priority filter
     policy drop
 
-    # libvirt's NAT bridge: permit guest traffic to be forwarded. libvirt's
-    # own table accepts these explicitly at the same hook+priority, but with
-    # nftables a packet must be accepted by ALL chains at that priority, so
-    # our policy=drop would otherwise block all guest egress and return
-    # traffic. Mirror libvirt's accepts here for the default NAT bridge.
-    # Use iifname/oifname (string match) instead of iif/oif so the rules
-    # load before libvirtd has created virbr0 at boot.
-    iifname "virbr0" accept comment "libvirt: guest egress"
-    oifname "virbr0" ct state established,related accept comment "libvirt: guest return"
   }
 }
diff --git a/etc/polkit-1/rules.d/50-libvirt-wheel.rules b/etc/polkit-1/rules.d/50-libvirt-wheel.rules
deleted file mode 100644
index fac69bd..0000000
--- a/etc/polkit-1/rules.d/50-libvirt-wheel.rules
+++ /dev/null
@@ -1,13 +0,0 @@
-// Allow members of the `wheel` group to manage libvirt (start/stop VMs,
-// edit domains, attach devices) without a polkit password prompt.
-// This single-user system already trusts wheel for administrative work
-// via sudo-rs; libvirt's polkit gate is a separate path that does not
-// honour sudoers, so a polkit rule is the idiomatic fix.
-polkit.addRule(function (action, subject) {
-  if (
-    action.id == "org.libvirt.unix.manage" &&
-    subject.isInGroup("wheel")
-  ) {
-    return polkit.Result.YES;
-  }
-});
diff --git a/systemd-units/system.txt b/systemd-units/system.txt
index bb24e0b..1c31da3 100644
--- a/systemd-units/system.txt
+++ b/systemd-units/system.txt
@@ -32,9 +32,5 @@ tor.service
 # client connect, the .socket is what gets enabled) ---
 nix-daemon.socket
 
-# --- libvirt (socket-activated; daemons spawn on first virsh/virt-manager
-# connect, the .socket is what gets enabled) ---
-libvirtd.socket
-
 # --- file sync (system template; binary comes from the user's nix profile) ---
 syncthing@sommerfeld.service