#!/bin/bash
# Boot the retained disposable keyring guest headlessly. SSH is forwarded on
# loopback only. Runtime files (pid, monitor socket, serial log) live under
# the caller's RUN dir; the overlay and firmware file are the retained ones.
set -euo pipefail
OVERLAY="${OVERLAY:?path to guest.qcow2}"
VARS="${VARS:?path to OVMF_VARS.fd}"
RUN="${RUN:?runtime dir}"
PORT="${PORT:-2237}"
mkdir -p "$RUN"
exec qemu-system-x86_64 -name keyring-vm -machine q35,accel=kvm -cpu host \
  -smp 2 -m 4096 \
  -drive if=pflash,format=raw,readonly=on,file=/usr/share/edk2/x64/OVMF_CODE.4m.fd \
  -drive "if=pflash,format=raw,file=$VARS" \
  -drive "file=$OVERLAY,format=qcow2,if=virtio" \
  -netdev "user,id=net0,hostfwd=tcp:127.0.0.1:${PORT}-:22" -device virtio-net-pci,netdev=net0 \
  -monitor "unix:$RUN/monitor.sock,server,nowait" -pidfile "$RUN/qemu.pid" \
  -serial "file:$RUN/serial.log" -display none -boot c