1 files changed, 69 insertions, 24 deletions

diff --git a/readme.md b/readme.md
index e4ba8dd..853c3cc 100644
--- a/readme.md
+++ b/readme.md
@@ -23,36 +23,81 @@ Functions documentation provided as comments below.
   outputs = { self, nixpkgs, flake-utils, flaky-utils }:
   flake-utils.lib.eachDefaultSystem (system: let
     pkgs = import nixpkgs { inherit system; };
-  in {
+  in pkgs.lib.fold pkgs.lib.recursiveUpdate { } [
+
+    {
+      # Convenience development shell providing some tools.
+      #
+      # The binaries made available and the environment variable set are
+      # printed when entering the shell.
+      #
+      # The user's default shell is used instead of Bash (sacrifying a bit of
+      # reproducibility for convenience).
+      #
+      devShell = flaky-utils.lib.mkDevShell {
+        inherit pkgs;
+
+        tools = with pkgs; [
+          postgresql_14
+          pgcli
+        ];
+
+        envVars = rec {
+          PGDATA = "$PWD/development_database/pgdata";
+          PGHOST = "$PWD/development_database";
+          PGPORT = "5432";
+          PGDATABASE = "app";
+          DATABASE_URL = "postgresql:///${PGDATABASE}?host=${PGHOST}";
+        };
+
+        shell = null;
+      };
+    }
 
-    # Convenience development shell providing some tools.
+    # Convenience isolated environment using a QEMU virtual machine.
     #
-    # The binaries made available and the environment variable set are printed
-    # when entering the shell.
+    # This defines a triplet of nixosConfiguration, package and app with the
+    # given name, so that the virtual machine can be launched using
+    # a command like `nix run .#sandbox`.
     #
-    # The user's default shell is used instead of Bash (sacrifying a bit of
-    # reproducibility for convenience).
+    # By default, the VM is launched in the current console without a graphical
+    # interface, dropping to a shell for the default dummy user within.
     #
-    devShell = flaky-utils.lib.mkDevShell {
-      inherit pkgs;
-
-      tools = with pkgs; [
-        postgresql_14
-        pgcli
-      ];
-
-      envVars = rec {
-        PGDATA = "$PWD/development_database/pgdata";
-        PGHOST = "$PWD/development_database";
-        PGPORT = "5432";
-        PGDATABASE = "app";
-        DATABASE_URL = "postgresql:///${PGDATABASE}?host=${PGHOST}";
-      };
+    # The current working directory from which the Flake is run is mounted and
+    # made available within the virtual machine in /mnt. The root filesystem
+    # is ephemeral (written to a temporary file in /tmp).
+    #
+    # The virtual machine's network is isolated by default: it cannot access
+    # the Internet nor the host's local network. Ports may nevertheless be
+    # forwarded explicitly from host to guest and vice-versa.
+    #
+    (flaky-utils.lib.mkSandboxSystem {
+      inherit nixpkgs system;
+
+      name = "sandbox";
+      user = "dummy";
 
-      shell = null;
-    };
+      config = {
+        virtualisation.forwardPorts = [
+          { from = "host"; host.port = 5432; guest.port = 5432; }  # postgres
+        ];
+
+        services.postgresql = {
+          enable = true;
+          enableTCPIP = true;
+
+          authentication = ''
+            host all all 0.0.0.0/0 trust
+          '';
+
+          initialScript = pkgs.writeText "init.sql" ''
+            create role dummy login superuser;
+          '';
+        };
+      };
+    })
 
-  });
+  ]);
 }
 ```