The hypervisor is just nixos running kvm and incus - it doesn’t have any opinion about pxe booting; So pxe gets dhcp from the san, which supplies the bootstrap, which is a tpm wrapped luks volume, which supplies the iscsi target, which bootstraps nixos over iscsi… Once the nixos kernel loads anything goes, so KVM isn’t aware of the iscsi nature of the diskless system at all.

I did play with nixos -> xen, but nested virtualization wasn’t a thing with xen yet, so i went back to KVM. incus over libvirt so i can have a proper hypervisor API, so i can have projects with different credentials and scopes creating and destroying VMs willy nilly.