From 9f9a4b38b8d7ba467b4577b9691e72e9d6011db7 Mon Sep 17 00:00:00 2001
From: Sandwich <sandwich@archworks.co>
Date: Fri, 20 Feb 2026 20:18:49 +0100
Subject: [PATCH] fix(virtualization): add XML safety attributes and switch xen
 to virtio

---
 roles/virtualization/tasks/libvirt.yml   | 2 +-
 roles/virtualization/tasks/vmware.yml    | 4 +++-
 roles/virtualization/templates/vm.xml.j2 | 7 +++++--
 templates/xen.cfg.j2                     | 2 +-
 4 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/roles/virtualization/tasks/libvirt.yml b/roles/virtualization/tasks/libvirt.yml
index 9615690..8edd8d6 100644
--- a/roles/virtualization/tasks/libvirt.yml
+++ b/roles/virtualization/tasks/libvirt.yml
@@ -23,7 +23,6 @@
   loop_control:
     label: "{{ item | to_json }}"
     extended: true
-  changed_when: false
 
 - name: Create VM disks
   delegate_to: localhost
@@ -61,6 +60,7 @@
       - "/tmp/cloud-network-config-{{ hostname }}.yml"
     creates: "{{ virtualization_libvirt_cloudinit_path }}"
 
+# uri defaults to qemu:///system (local libvirtd)
 - name: Create VM using libvirt
   delegate_to: localhost
   community.libvirt.virt:
diff --git a/roles/virtualization/tasks/vmware.yml b/roles/virtualization/tasks/vmware.yml
index 37e03f0..1c0faab 100644
--- a/roles/virtualization/tasks/vmware.yml
+++ b/roles/virtualization/tasks/vmware.yml
@@ -10,8 +10,8 @@
   loop: "{{ system_cfg.disks }}"
   loop_control:
     label: "{{ item | to_json }}"
-  changed_when: false
 
+# community.vmware: full-featured guest management
 - name: Create VM in vCenter
   delegate_to: localhost
   vars:
@@ -34,6 +34,7 @@
     cluster: "{{ hypervisor_cfg.cluster }}"
     folder: "{{ system_cfg.path if system_cfg.path | string | length > 0 else omit }}"
     name: "{{ hostname }}"
+    # Generic guest ID — VMware auto-detects OS post-install
     guest_id: otherLinux64Guest
     annotation: |
       {{ note if note is defined else '' }}
@@ -90,6 +91,7 @@
     state: present
   no_log: true
 
+# vmware.vmware: modern collection for power operations
 - name: Start VM in vCenter
   when: virtualization_tpm2_enabled | bool
   delegate_to: localhost
diff --git a/roles/virtualization/templates/vm.xml.j2 b/roles/virtualization/templates/vm.xml.j2
index 9d5f1b1..30c5940 100644
--- a/roles/virtualization/templates/vm.xml.j2
+++ b/roles/virtualization/templates/vm.xml.j2
@@ -1,7 +1,7 @@
 <domain type='kvm'>
   <name>{{ hostname }}</name>
-  <memory>{{ system_cfg.memory | int * 1024 }}</memory>
-  {% if system_cfg.balloon is defined and system_cfg.balloon | int > 0 %}<currentMemory>{{ system_cfg.balloon | int * 1024 }}</currentMemory>{% endif %}
+  <memory unit='KiB'>{{ system_cfg.memory | int * 1024 }}</memory>
+  {% if system_cfg.balloon is defined and system_cfg.balloon | int > 0 %}<currentMemory unit='KiB'>{{ system_cfg.balloon | int * 1024 }}</currentMemory>{% endif %}
   <vcpu placement='static'>{{ system_cfg.cpus }}</vcpu>
   <os>
     <type arch='x86_64' machine="{{ virtualization_libvirt_machine_type }}">hvm</type>
@@ -33,17 +33,20 @@
       <driver name="qemu" type="raw"/>
       <source file="{{ boot_iso }}"/>
       <target dev="sda" bus="sata"/>
+      <readonly/>
     </disk>
     <disk type="file" device="cdrom">
       <driver name="qemu" type="raw"/>
       <source file="{{ virtualization_libvirt_cloudinit_path }}"/>
       <target dev="sdb" bus="sata"/>
+      <readonly/>
     </disk>
     {% if rhel_iso is defined and rhel_iso | length > 0 %}
     <disk type="file" device="cdrom">
       <driver name="qemu" type="raw"/>
       <source file="{{ rhel_iso }}"/>
       <target dev="sdc" bus="sata"/>
+      <readonly/>
     </disk>
     {% endif %}
     {% for iface in system_cfg.network.interfaces %}
diff --git a/templates/xen.cfg.j2 b/templates/xen.cfg.j2
index 7801d14..024ec53 100644
--- a/templates/xen.cfg.j2
+++ b/templates/xen.cfg.j2
@@ -12,7 +12,7 @@ disk = [
 ]
 vif = [
 {%- for iface in system_cfg.network.interfaces -%}
-  'bridge={{ iface.bridge }},model=e1000'{% if not loop.last %}, {% endif %}
+  'bridge={{ iface.bridge }},model=virtio'{% if not loop.last %}, {% endif %}
 {%- endfor -%}
 ]
 boot = "{{ 'dc' if xen_installer_media_enabled | bool else 'c' }}"