git mv src/infrastructure/guix/ src/

1 files changed, 504 insertions, 0 deletions

diff --git a/src/guix/system.scm b/src/guix/system.scm
new file mode 100644
index 0000000..1690f31
--- /dev/null
+++ b/src/guix/system.scm
@@ -0,0 +1,504 @@
+(use-modules
+  ((ice-9 textual-ports) #:prefix textual-ports:)
+  ((srfi srfi-1) #:prefix s1:)
+  ((xyz euandreh heredoc) #:prefix heredoc:)
+  ((org euandre queue) #:prefix queue:)
+  (gnu)
+  (guix build-system trivial)
+  (guix build utils)
+  (guix packages))
+(use-package-modules
+  admin
+  ssh
+  version-control)
+(use-service-modules
+  admin
+  certbot
+  cgit
+  dns
+  mail
+  mcron
+  networking
+  security
+  ssh
+  version-control
+  vpn
+  web)
+(heredoc:enable-syntax)
+
+
+(define ipv4 "216.238.68.100")
+(define ipv6 "2001:19f0:b400:1f0c:5400:04ff:fe35:8c89")
+(define tld "euandre.org")
+
+(define users
+  '(("andreh" "EuAndreh" ("wheel" "become-deployer" "become-secrets-keeper"))))
+
+
+(define working-dir
+  (if (directory-exists? "/opt/deploy/current")
+    "/opt/deploy/current"
+    (canonicalize-path ".")))
+
+(add-to-load-path
+ (string-append working-dir "/src/infrastructure/guix"))
+(use-modules
+  ((packages) #:prefix packages:))
+
+
+(define (str . rest)
+  (apply string-append rest))
+
+(define (fmt . rest)
+  (apply format #f rest))
+
+(define (path s)
+  (str working-dir "/" s))
+
+(define (slurp s)
+  (call-with-input-file
+   s
+   textual-ports:get-string-all))
+
+(define (file s)
+  (slurp (path s)))
+
+(define (script name content)
+  (package
+    (name name)
+    (version "latest")
+    (source #f)
+    (build-system trivial-build-system)
+    (arguments
+      (list
+       #:modules '((guix build utils))
+       #:builder
+       #~(begin
+           (use-modules (guix build utils))
+           (let* ((bin  (string-append %output "/bin"))
+                  (prog (string-append bin "/" #$name)))
+             (mkdir-p bin)
+             (call-with-output-file prog
+              (lambda (port)
+                (display #$content port)))
+             (chmod prog #o755)))))
+    (home-page #f)
+    (synopsis #f)
+    (description #f)
+    (license #f)))
+
+(define user-accounts
+  (map (lambda (user)
+         (let ((name    (s1:first  user))
+               (comment (s1:second user))
+               (groups  (s1:third  user)))
+           (user-account
+             (name name)
+             (comment comment)
+             (group "users")
+             (supplementary-groups groups))))
+       users))
+
+(define (ssh-file-for user)
+  (let ((name (s1:first user)))
+    (path (fmt "src/infrastructure/keys/SSH/~a.pub.txt" name))))
+
+(define authorized-keys
+  (let ((users-with-keys
+         (map (lambda (user)
+                `(,@user ,(slurp (ssh-file-for user))))
+              (filter (lambda (user)
+                        (file-exists? (ssh-file-for user)))
+                      users))))
+    (append
+     (map (lambda (user)
+            (let ((name (s1:first  user))
+                  (key  (s1:fourth user)))
+              `(,name ,(plain-file (str name "-id_rsa.pub")
+                                   key))))
+          users-with-keys)
+     `(("git" ,@(map (lambda (user)
+                       (let ((name (s1:first  user))
+                             (key  (s1:fourth user)))
+                         (plain-file (str name "-git-id_rsa.pub")
+                                     key)))
+                     users-with-keys))))))
+
+
+(define ns (fmt "ns1.~a." tld))
+(define mail (fmt "hostmaster.~a." tld))
+(define dkim-selector "dkimproxyout")
+(define dkim-public-key-path "/var/lib/dkimproxyout/public.key")
+
+(define dkim-name (str dkim-selector "._domainkey"))
+(define dkim-public-key
+  (if (file-exists? dkim-public-key-path)
+    (string-join (reverse
+                  (cdr
+                   (reverse
+                    (cdr
+                     (string-split (slurp dkim-public-key-path)
+                                   #\newline)))))
+                 "")
+    "stub-public-key-for-building"))
+
+(define ipv4-reverse-domain
+  (str
+   (string-join (reverse
+                 (string-split ipv4
+                               #\.))
+                ".")
+   ".in-addr.arpa"))
+
+(define ipv6-reverse-domain
+  (str
+   (string-join (reverse
+                 (map (lambda (s) (fmt "~a" s))
+                      (string->list
+                       (string-delete #\: ipv6))))
+                ".")
+   ".ip6.arpa"))
+
+(define-zone-entries tld-zone
+  ("@"         ""   "IN"   "NS"    (fmt "ns1.~a." tld))
+  ("@"         ""   "IN"   "NS"    (fmt "ns2.~a." tld))
+  ("ns1"       ""   "IN"   "A"     ipv4)
+  ("ns1"       ""   "IN"   "AAAA"  ipv6)
+  ("ns2"       ""   "IN"   "A"     ipv4)
+  ("ns2"       ""   "IN"   "AAAA"  ipv6)
+
+  ("@"         ""   "IN"   "A"     ipv4)
+  ("@"         ""   "IN"   "AAAA"  ipv6)
+
+  ("@"         ""   "IN"   "CAA"   "0 issue \"letsencrypt.org\"")
+  ("@"         ""   "IN"   "CAA"   "0 issuewild \";\"")
+  ("@"         ""   "IN"   "CAA"   "0 iodef \"mailto:eu@euandre.org\"")
+
+  ("mta-sts"   ""   "IN"   "A"     ipv4)
+  ("mta-sts"   ""   "IN"   "AAAA"  ipv6)
+  ("_mta-sts"  ""   "IN"   "TXT"   "\"v=STSv1; id=20230314\"")
+  ("@"         ""   "IN"   "MX"    (fmt "10 ~a." tld))
+  ("_dmarc"    ""   "IN"   "TXT"   "\"v=DMARC1; p=quarantine\"")
+  ("@"         ""   "IN"   "TXT"   (fmt "\"v=spf1 a:~a -all\"" tld))
+  (dkim-name   ""   "IN"   "TXT"   (fmt "\"v=DKIM1; k=rsa; t=s; p=~a\"" dkim-public-key)))
+
+(define-zone-entries ipv4-reverse-domain-zone
+  ("@"         ""   "IN"   "PTR"   (str tld "."))
+  ("@"         ""   "IN"   "NS"    (fmt "ns1.~a." tld))
+  ("@"         ""   "IN"   "NS"    (fmt "ns2.~a." tld)))
+
+(define-zone-entries ipv6-reverse-domain-zone
+  ("@"         ""   "IN"   "PTR"   (str tld "."))
+  ("@"         ""   "IN"   "NS"    (fmt "ns1.~a." tld))
+  ("@"         ""   "IN"   "NS"    (fmt "ns2.~a." tld)))
+
+(define zones
+  (list
+   (knot-zone-configuration
+     (domain tld)
+     (semantic-checks? #t)
+     (zone
+       (zone-file
+         (origin tld)
+         (ns ns)
+         (mail mail)
+         (entries tld-zone))))
+   (knot-zone-configuration
+     (domain ipv4-reverse-domain)
+     (semantic-checks? #t)
+     (zone
+       (zone-file
+         (origin ipv4-reverse-domain)
+         (ns ns)
+         (mail mail)
+         (entries ipv4-reverse-domain-zone))))
+   (knot-zone-configuration
+     (domain ipv6-reverse-domain)
+     (semantic-checks? #t)
+     (zone
+       (zone-file
+         (origin ipv6-reverse-domain)
+         (ns ns)
+         (mail mail)
+         (entries ipv6-reverse-domain-zone))))))
+
+
+(operating-system
+  (locale "fr_FR.UTF-8")
+  (timezone "America/Sao_Paulo")
+  (host-name tld)
+  (skeletons
+    `((".profile"
+       ,(plain-file "user-profile"
+                    (file "src/infrastructure/config/profile.sh")))))
+  (users
+    (append
+     (list
+      (user-account
+        (name  "git")
+        (group "git")
+        (system? #t)
+        (comment "External SSH Git user")
+        (home-directory "/srv/git")
+        (create-home-directory? #f)
+        (shell
+          (file-append git "/bin/git-shell")))
+      (user-account
+        (name  "deployer")
+        (group "deployer")
+        (system? #t)
+        (comment "The account used to run deployment commands")
+        (home-directory "/var/empty")
+        (create-home-directory? #f)
+        (shell
+          (file-append shadow "/sbin/nologin")))
+      (user-account
+        (name  "secrets-keeper")
+        (group "secrets-keeper")
+        (system? #t)
+        (comment "The account used to manage production secrets")
+        (home-directory "/var/empty")
+        (create-home-directory? #f)
+        (shell
+          (file-append shadow "/sbin/nologin"))))
+     user-accounts
+     %base-user-accounts))
+  (groups
+    (append
+     (list
+      (user-group
+        (name "git")
+        (system? #t))
+      (user-group
+        (name "deployer")
+        (system? #t))
+      (user-group
+        (name "become-deployer")
+        (system? #t))
+      (user-group
+        (name "secrets-keeper")
+        (system? #t))
+      (user-group
+        (name "become-secrets-keeper")
+        (system? #t)))
+     %base-groups))
+  (sudoers-file
+    (plain-file "sudoers" #"-
+      root                   ALL=(ALL)                      ALL
+      %wheel                 ALL=                           ALL
+      %become-deployer       ALL=(deployer)       NOPASSWD: ALL
+      %become-secrets-keeper ALL=(secrets-keeper) NOPASSWD: /run/current-system/profile/bin/rsync, /run/current-system/profile/bin/setfacl, /run/current-system/profile/bin/rm
+      git                    ALL=                 NOPASSWD: /run/current-system/profile/bin/reconfigure, /run/current-system/profile/bin/cicd
+      git                    ALL=(deployer)       NOPASSWD: /run/current-system/profile/bin/rsync, /run/current-system/profile/bin/mkdir
+      "#))
+  (packages
+    (append
+     (map (compose list specification->package+output symbol->string)
+          '(parted
+            acl
+            bind:utils
+            tcpdump
+            knot:tools
+            file
+            git
+            guile-heredoc
+            entr
+            lsof
+            jq
+            moreutils
+            mailutils-sendmail
+            curl
+            make
+            gnupg
+            borg
+            rsync
+            sqlite
+            strace
+            rlwrap
+            trash-cli
+            tree))
+     (list
+      packages:server
+      (script "gc"          (file "src/infrastructure/scripts/gc.sh"))
+      (script "cicd"        (file "src/infrastructure/scripts/cicd.sh"))
+      (script "check"       (file "src/infrastructure/scripts/check.sh"))
+      (script "backup"      (file "src/infrastructure/scripts/backup.sh"))
+      (script "deploy"      (file "src/infrastructure/scripts/deploy.sh"))
+      (script "report"      (file "src/infrastructure/scripts/report.sh"))
+      (script "cronjob"     (file "src/infrastructure/scripts/cronjob.sh"))
+      (script "reconfigure" (file "src/infrastructure/scripts/reconfigure.sh")))
+     %base-packages))
+  (services
+    (append
+     (list
+      (service ntp-service-type)
+      (service dhcp-client-service-type)
+      (service knot-service-type
+        (knot-configuration
+          (zones zones)))
+      (service openssh-service-type
+        (openssh-configuration
+          (openssh openssh-sans-x)
+          (password-authentication? #f)
+          (authorized-keys authorized-keys)
+          (extra-content #"-
+            ClientAliveInterval 30
+            ClientAliveCountMax 20
+            MaxSessions 20
+            SetEnv GIT_CONFIG_GLOBAL=/etc/gitconfig
+            "#)))
+      (simple-service 'extra-rottlog-rotations rottlog-service-type
+        (list
+         (log-rotation
+           (frequency 'weekly)
+           (files '("/var/log/cronjobs.log"))
+           (options '("rotate 52")))))
+      (service fail2ban-service-type)
+      (service mcron-service-type
+        (mcron-configuration
+          (jobs
+            (list
+             #~(job "0 0 * * *" "cronjob check")
+             #~(job "0 1 * * *" "cronjob env BORG_REPO=/mnt/backup/borg backup -q cron")
+             #~(job "0 2 * * *" "cronjob                                backup -q cron")
+             #~(job "0 3 * * 0" "cronjob gc")
+             #~(job "0 4 * * *" "cronjob reconfigure -U")))))
+      (service certbot-service-type
+        (certbot-configuration
+          (email (str "root@" tld))
+          (certificates
+            (list
+             (certificate-configuration
+               (domains (list tld))
+               (deploy-hook
+                 (program-file
+                  "nginx-deploy-hook"
+                  #~(let ((pid (call-with-input-file "/var/run/nginx/pid" read)))
+                      (kill pid SIGHUP)))))))))
+      (service nginx-service-type
+        (nginx-configuration
+          (server-blocks
+            (list
+             (nginx-server-configuration
+               (server-name (list tld))
+               (listen '("[::]:443 ssl http2" "443 ssl http2"))
+               (root "/srv/www")
+               (ssl-certificate     (fmt "/etc/letsencrypt/live/~a/fullchain.pem" tld))
+               (ssl-certificate-key (fmt "/etc/letsencrypt/live/~a/privkey.pem"   tld))
+               (locations
+                 (list
+                  (nginx-location-configuration
+                    (uri "/r/velhinho/")
+                    (body
+                      '(#"-
+                          rewrite /r/velhinho(.*) $1 break;
+                          proxy_pass http://velhinho:4219;
+                          "#)))
+                  (nginx-location-configuration
+                    (uri "/git/static/")
+                    (body
+                      (list
+                       (list "alias " cgit "/share/cgit/;"))))
+                  (nginx-location-configuration
+                    (uri "/git/")
+                    (body
+                      (list
+                       (list "fastcgi_param SCRIPT_FILENAME " cgit "/lib/cgit/cgit.cgi;")
+                       #"-
+                         fastcgi_param PATH_INFO $uri;
+                         fastcgi_param QUERY_STRING $args;
+                         fastcgi_param HTTP_HOST $server_name;
+                         fastcgi_pass localhost:9000;
+                         rewrite /git(.*) $1 break;
+                         "#)))))
+               (raw-content
+                 '(#"-
+                     ssl_protocols TLSv1.3;
+                     ssl_ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH;
+                     ssl_prefer_server_ciphers on;
+                     gzip off;  # Disable compression altogether due to BREACH
+                     charset utf-8;
+                     autoindex on;
+                     add_header Strict-Transport-Security 'max-age=31536000; includeSubdomains' always;
+                     "#)))))))
+      (service cgit-service-type queue:cgit-pre-configuration)
+      (simple-service 'extra-etc-file etc-service-type
+        `(("rc"          ,(plain-file "rc.sh"       (file "src/infrastructure/config/rc.sh")))
+          ("known_hosts" ,(plain-file "known_hosts" (file "src/infrastructure/config/known_hosts.txt")))
+          ("id_rsa.pub"  ,(plain-file "id_rsa.pub"  (file (fmt "src/infrastructure/keys/SSH/root@~a.id_rsa.pub.stripped" tld))))
+          ("ssh.conf"    ,(plain-file "ssh.conf"    (file "src/infrastructure/config/ssh.conf")))
+          ("init.scm"    ,(plain-file "init.scm"    (file "src/infrastructure/config/init.scm")))
+          ("conf.env"    ,(plain-file "conf.env"    (file "src/infrastructure/config/conf.env")))
+          ("gitconfig"   ,(plain-file "gitconfig"   (file "src/infrastructure/config/gitconfig")))))
+      (service git-daemon-service-type
+        (git-daemon-configuration
+          (export-all? #t)))
+      (simple-service 'add-wireguard-aliases hosts-service-type
+        (list
+         (host "10.0.0.0" "toph")
+         (host "10.0.0.1" "velhinho")
+         (host "10.0.0.2" "azula")))
+      (service wireguard-service-type
+        (wireguard-configuration
+          (addresses '("10.0.0.0/32"))
+          (peers
+            (list
+             (wireguard-peer
+               (name "velhinho")
+               (public-key "Mhv8KxB/QXQpNKNtqD57PoFv43TXJ1lg52PJd6TmtwI=")
+               (allowed-ips '("10.0.0.1/32"))
+               (keep-alive 25))
+             (wireguard-peer
+               (name "azula")
+               (public-key "8IxSFlJoFuTzLtIkoKZH4CkUbIxd6++E0lBOin/7rT8=")
+               (allowed-ips '("10.0.0.2/32"))
+               (keep-alive 25))))))
+      (service queue:shadow-group-service-type)
+      (service queue:dkimproxyout-service-type)
+      (service queue:cyrus-sasl-service-type)
+      (service queue:dovecot-service-type)
+      (service queue:internet-postfix-service-type
+        (queue:postfix-configuration
+          (enable-submission? #t)
+          (main.cf-extra #"-
+            message_size_limit = 102400000
+            mailbox_size_limit = 5120000000
+            "#)))
+      (service mail-aliases-service-type
+        '(("root"         "andreh")
+          ("eu"           "andreh")
+          ("mailing-list" "andreh"))))
+     (modify-services %base-services
+       (rottlog-service-type config =>
+         (rottlog-configuration
+           (inherit config)
+           (rc-file (file-append queue:rottlog-mailutils-sendmail "/etc/rc")))))))
+  (bootloader
+    (bootloader-configuration
+      (bootloader grub-bootloader)
+      (targets '("/dev/vda"))))
+  (swap-devices
+    (list
+     (swap-space
+       (target
+         (uuid "94b47d91-3542-438a-84a9-859fe347ce09")))))
+  (file-systems
+    (append
+     (list
+      (file-system
+        (mount-point "/")
+        (device
+          (uuid "4c36d5ad-f996-413e-a55c-c05b7e1876f2" 'btrfs))
+        (type "btrfs"))
+      (file-system
+        (mount-point "/mnt/production")
+        (needed-for-boot? #t)
+        (device
+          (uuid "b1a7e4a1-a8ea-48a4-ab8b-884a1b6a9c11" 'btrfs))
+        (type "btrfs"))
+      (file-system
+        (mount-point "/mnt/backup")
+        (device
+          (uuid "6632849d-f180-4740-86e6-a519d43ab75a" 'btrfs))
+        (type "btrfs")))
+     %base-file-systems)))