(use-modules ((im papo packages) #:prefix pkgs:) (gnu)) (use-package-modules version-control web) (use-service-modules certbot cgit dns mail networking security ssh vpn web) (define +working-dir+ ;; src/guix/system.scm + ../../../ = ./ (dirname (dirname (dirname (current-filename))))) (define (path s) (pkgs:str +working-dir+ "/" s)) (define +admingroups+ '("wheel" "becomesecretskeeper")) (define +users+ `(("andreh" "EuAndreh" ,+admingroups+ ,(path "src/keys/SSH/andreh.pub.txt")))) (define file (compose string-trim-right pkgs:slurp path)) (define +ipv4+ (file "src/config/ipv4.txt")) (define +ipv6+ (file "src/config/ipv6.txt")) (define +tld+ (file "src/config/tld.txt")) (define +root-pubkey+ (file "src/config/root-pubkey.txt")) (define +known-hosts+ (file "src/config/known-hosts.txt")) (define +offsite-ssh+ (file "src/config/offsite-ssh.txt")) (define +nginx-redirects+ '(("/index.html" "/en/index.html") ("/l/multiline-sh" "/en/til/2026/09/05/multiline-sh-comments.html") ("/til.html" "/en/til/index.html") ("/podcast.en.html" "/en/podcast/index.html") ("/screencasts.en.html" "/en/screencast/index.html") ("/pastebins.en.html" "/en/pastebin/index.html") ("/about.html" "/en/about.html") ("/articles-by-category.html" "/en/blog/categories.html") ("/til-by-category.html" "/en/til/categories.html") ("/podcast-episodes-by-category.html" "/en/podcast/categories.html") ("/screencasts-by-category.html" "/en/screencast/categories.html") ("/pastebins-by-category.html" "/en/pastebin/categories.html") ("/2021/04/29/a-relational-model-of-data-for-large-shared-data-banks-article-review.html" "/en/blog/2021/04/29/relational-review.html") ("/podcast/2020/12/19/a-test-entry.html" "/en/podcast/2020/12/19/test-entry.html") ("/2021/02/17/ann-fallible-fault-injection-library-for-stress-testing-failure-scenarios.html" "/en/blog/2021/02/17/fallible.html") ("/2021/01/26/ann-remembering-add-memory-to-dmenu-fzf-and-similar-tools.html" "/en/blog/2021/01/26/remembering-ann.html") ("/til/2020/08/13/anchor-headers-and-code-lines-in-jekyll.html" "/en/til/2020/08/13/code-jekyll.html") ("/screencast/2021/02/07/autoqemu-automate-installation-and-ssh-setup-of-iso-os-images.html" "/en/screencast/2021/02/07/autoqemu.html") ("/til/2020/12/15/awk-snippet-shellcheck-all-scripts-in-a-repository.html" "/en/til/2020/12/15/shellcheck-repo.html") ("/til/2021/01/12/awk-snippet-send-email-to-multiple-recipients-with-curl.html" "/en/til/2021/01/12/curl-awk-emails.html") ("/til/2020/08/14/browse-a-git-repository-at-a-specific-commit.html" "/en/til/2020/08/14/browse-git.html") ("/til/2021/04/24/clojure-auto-curry.html" "/en/til/2021/04/24/clojure-autocurry.html") ("/til/2021/04/24/common-lisp-argument-precedence-order-parameterization-of-a-generic-function.html" "/en/til/2021/04/24/cl-generic-precedence.html") ("/2020/11/07/diy-an-offline-bug-tracker-with-text-files-git-and-email.html" "/en/blog/2020/11/07/diy-bugs.html") ("/til/2020/11/12/diy-bare-bones-ci-server-with-bash-and-nix.html" "/en/til/2020/11/12/diy-nix-bash-ci.html") ("/pastebin/2021/06/08/debit-reading-session-sicp-solutions-pt-1.html" "/en/pastebin/2021/06/08/reading-session-pt1.html") ("/2020/11/12/durable-persistent-trees-and-parser-combinators-building-a-database.html" "/en/blog/2020/11/12/database-parsers-trees.html") ("/til/2021/08/11/encoding-and-decoding-javascript-bigint-values-with-reviver.html" "/en/til/2021/08/11/js-bigint-reviver.html") ("/pastebin/2020/01/04/failure-on-guix-tex-live-importer.html" "/en/pastebin/2020/01/04/guix-import-failure.html") ("/pastebin/2020/12/15/failure-with-relocatable-guix-pack-tarball.html" "/en/pastebin/2020/12/15/guix-pack-fail.html") ("/2020/10/19/feature-flags-differences-between-backend-frontend-and-mobile.html" "/en/blog/2020/10/19/feature-flags.html") ("/til/2020/11/08/find-broken-symlinks-with-find.html" "/en/til/2020/11/08/find-broken-symlink.html") ("/pastebin/2023/07/22/funcallable-amop.html" "/en/pastebin/2023/07/22/funcallable-amop.html") ("/pastebin/2018/07/13/gnu-guix-systemd-daemon-for-nixos.html" "/en/pastebin/2018/07/13/guix-nixos-systemd.html") ("/til/2021/07/23/gpg-verification-of-git-repositories-without-tls.html" "/en/til/2021/07/23/git-tls-gpg.html") ("/til/2020/11/12/git-bisect-automation.html" "/en/til/2020/11/12/git-bisect-automation.html") ("/til/2020/08/28/grep-online-repositories.html" "/en/til/2020/08/28/grep-online.html") ("/pastebin/2020/11/27/guix-build-local-module.html" "/en/pastebin/2020/11/27/guix-build-local.html") ("/pastebin/2018/07/13/guix-builder-user-creation-commands.html" "/en/pastebin/2018/07/13/guixbuilder.html") ("/2020/08/10/guix-inside-sourcehut-builds-sr-ht-ci.html" "/en/blog/2020/08/10/guix-srht.html") ("/pastebin/2020/02/14/guix-shebang.html" "/en/pastebin/2020/02/14/guix-shebang.html") ("/pastebin/2018/07/13/guix-users-in-nixos-system-configuration.html" "/en/pastebin/2018/07/13/guixbuilder-nixos.html") ("/2020/10/20/how-not-to-interview-engineers.html" "/en/blog/2020/10/20/wrong-interviewing.html") ("/pastebin/2019/06/08/inconsistent-hash-of-buildgomodule.html" "/en/pastebin/2019/06/08/inconsistent-hash.html") ("/pastebin/2021/04/03/javascript-naive-slugify.html" "/en/pastebin/2021/04/03/naive-slugify-js.html") ("/pastebin/2018/07/25/nix-exps.html" "/en/pastebin/2018/07/25/nix-exps.html") ("/pastebin/2018/07/11/nix-pinning.html" "/en/pastebin/2018/07/11/nix-pinning.html") ("/pastebin/2018/07/13/nix-string-padding.html" "/en/pastebin/2018/07/13/nix-strpad.html") ("/til/2021/01/17/posix-sh-and-shebangs.html" "/en/til/2021/01/17/posix-shebang.html") ("/til/2020/09/05/pull-requests-with-git-the-old-school-way.html" "/en/til/2020/09/05/oldschool-pr.html") ("/pastebin/2016/04/05/rpn-macro-setup.html" "/en/pastebin/2016/04/05/rpn.html") ("/pastebin/2019/12/29/raku-tuple-type-annotation.html" "/en/pastebin/2019/12/29/raku-tuple-type.html") ("/2018/07/17/running-guix-on-nixos.html" "/en/blog/2018/07/17/guix-nixos.html") ("/pastebin/2021/09/02/sicp-exercise-3-19.html" "/en/pastebin/2021/09/02/sicp-3-19.html") ("/pastebin/2021/09/03/sicp-persistent-amortized-o1-queue.html" "/en/pastebin/2021/09/03/sicp-persistent-queue.html") ("/til/2020/12/29/svg-favicon.html" "/en/til/2020/12/29/svg.html") ("/til/2020/10/11/search-changes-to-a-filename-pattern-in-git-history.html" "/en/til/2020/10/11/search-git-history.html") ("/til/2020/08/16/search-in-git.html" "/en/til/2020/08/16/git-search.html") ("/til/2020/09/04/send-emails-using-the-command-line-for-fun-and-profit.html" "/en/til/2020/09/04/cli-email-fun-profit.html") ("/til/2020/08/12/simple-filename-timestamp.html" "/en/til/2020/08/12/filename-timestamp.html") ("/pastebin/2021/08/11/spaces-around-h1-tags.html" "/en/pastebin/2021/08/11/h1-spacing.html") ("/til/2020/11/30/storing-ci-data-on-git-notes.html" "/en/til/2020/11/30/git-notes-ci.html") ("/2020/11/08/the-next-paradigm-shift-in-programming-video-review.html" "/en/blog/2020/11/08/paradigm-shift-review.html") ("/2020/08/31/the-database-i-wish-i-had.html" "/en/blog/2020/08/31/database-i-wish-i-had.html") ("/til/2021/04/24/three-way-conditional-for-number-signs-on-lisp.html" "/en/til/2021/04/24/scm-nif.html") ("/til/2020/11/12/useful-bash-variables.html" "/en/til/2020/11/12/useful-bashvars.html") ("/2018/12/21/using-youtube-dl-to-manage-youtube-subscriptions.html" "/en/blog/2018/12/21/ytdl-subs.html") ("/2019/06/02/using-nixos-as-an-stateless-workstation.html" "/en/blog/2019/06/02/nixos-stateless-workstation.html") ("/2018/08/01/verifying-npm-ci-reproducibility.html" "/en/blog/2018/08/01/npm-ci-reproducibility.html") ("/2020/10/05/cargo2nix-dramatically-simpler-rust-in-nix.html" "/en/blog/2020/10/05/cargo2nix.html") ("/til/2020/11/14/gpodder-as-a-media-subscription-manager.html" "/en/til/2020/11/14/gpodder-media.html") ("/pastebin/2022/07/14/git-cleanup-command.html" "/en/pastebin/2022/07/14/git-cleanup.html") ("/pastebin/2018/07/25/nix-show-derivation-sample-output.html" "/en/pastebin/2018/07/25/nix-showdrv.html") ("/2020/10/05/swift2nix-run-swift-inside-nix-builds.html" "/en/blog/2020/10/05/swift2nix.html") ("/2020/11/14/local-first-software-you-own-your-data-in-spite-of-the-cloud-article-review.html" "/en/blog/2020/11/14/local-first-review.html") ("/pastebin/2021/06/22/cloc-curl-and-wget.html" "/en/pastebin/2021/06/22/curl-wget.html") ("/til/2020/08/12/nome-de-arquivo-com-timestamp-simplificado.html" "/pt/hea/2020/08/12/arquivo-datado.html") ("/sobre.html" "/pt/sobre.html") ("/a-propos.html" "/fr/a-propos.html") ("/pri.html" "/eo/pri.html") ("/hea.html" "/pt/hea/index.html") ("/hea-por-categoria.html" "/pt/hea/categorias.html") ("/slides.html" "/en/slide/index.html") ("/slides-by-category.html" "/en/slide/categories.html") ("/slides/2020/10/19/rollout-feature-flag-experiment-operational-toggle.html" "/en/slide/2020/10/19/feature-flags.html") ("/slides/2020/11/14/on-local-first-beyond-the-crdt-silver-bullet.html" "/en/slide/2020/11/14/local-first-hype.html") ("/2019/06/02/stateless-os.html" "/en/blog/2019/06/02/nixos-stateless-workstation.html") ("/pastebin/raku-tuple-type-annotation.html" "/en/pastebin/2019/12/29/raku-tuple-type.html") ("/pastebin/inconsistent-hash-of-buildgomodule.html" "/en/pastebin/2019/06/08/inconsistent-hash.html"))) (define (redirect-location redirect) (nginx-location-configuration (uri (pkgs:str "= " (car redirect))) (body (list (pkgs:fmt "return 301 ~a;" (cadr redirect)))))) (define package-symbols '()) (define package-records (list)) (operating-system (locale "fr_FR.UTF-8") (timezone "America/Sao_Paulo") (host-name +tld+) (skeletons pkgs:skeletons) (users (append (pkgs:user-accounts +users+) %base-user-accounts)) (sudoers-file pkgs:syskeep-sudoers-file) (packages (pkgs:package-set package-symbols package-records)) (services (append (list (service ntp-service-type) (service dhcpcd-service-type) (service knot-service-type (pkgs:knot-zones-configuration +tld+ +ipv4+ +ipv6+)) (service openssh-service-type (pkgs:openssh-default-configuration (pkgs:users->keys +users+))) (service certbot-service-type (pkgs:tld-certbot-configuration +tld+)) (service nginx-service-type (nginx-configuration (server-blocks (list (nginx-server-configuration (server-name (list +tld+)) (listen '("[::]:443 ssl" "443 ssl")) (root "/srv/www") (ssl-certificate (pkgs:fmt "/etc/letsencrypt/live/~a/fullchain.pem" +tld+)) (ssl-certificate-key (pkgs:fmt "/etc/letsencrypt/live/~a/privkey.pem" +tld+)) (locations (append (map redirect-location +nginx-redirects+) (list (nginx-location-configuration (uri "~ ^(.*)/index\\.html$") (body '("if ($request_uri ~ /index\\.html$) {\n" " rewrite ^(.*)/index\\.html$ $1/ permanent;\n" "}\n"))) (nginx-location-configuration (uri "/git/static/") (body (list (list "alias " cgit "/share/cgit/;")))) (nginx-location-configuration (uri "/git/") (body (list (list "fastcgi_param SCRIPT_FILENAME " cgit "/lib/cgit/cgit.cgi;") "fastcgi_param PATH_INFO $uri;" "fastcgi_param PATH /run/current-system/profile/bin;" "fastcgi_param QUERY_STRING $args;" "fastcgi_param HTTP_HOST $server_name;" "fastcgi_pass localhost:9000;" "rewrite /git(.*) $1 break;")))))) (raw-content (list "ssl_protocols TLSv1.3;" "ssl_ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH;" "ssl_prefer_server_ciphers on;" "gzip off; # Disable dynamic compression due to BREACH" "gzip_static on;" "charset utf-8;" "autoindex on;" (pkgs:str "add_header Strict-Transport-Security " "'max-age=31536000; includeSubdomains' always;") "types {" " text/html html;" " text/css css;" " text/javascript mjs;" " text/xml xml;" " text/plain txt;" " application/atom+xml atom;" " application/gzip gz;" " application/pdf pdf;" " application/x-bittorrent torrent;" " image/vnd.microsoft.icon ico;" " image/png png;" " image/svg+xml svg;" " audio/flac flac;" " audio/ogg ogg;" " video/webm webm;" "}"))))))) (service cgit-service-type pkgs:cgit-pre-configuration) (service pkgs:syskeep-service-type (pkgs:syskeep-configuration (tld +tld+))) ; FIXME #; (service pkgs:cicd-service-type) (service pkgs:git-service-type (pkgs:git-configuration (export-all? #t) (run-server? #t))) (simple-service 'add-wireguard-aliases hosts-service-type (list (host "10.0.0.0" "toph") (host "10.0.0.1" "velhinho") (host "10.0.0.2" "azula") (host "10.0.0.5" "novinho"))) (service wireguard-service-type (wireguard-configuration (addresses '("10.0.0.0/32")) (peers (list (wireguard-peer (name "velhinho") (public-key "Mhv8KxB/QXQpNKNtqD57PoFv43TXJ1lg52PJd6TmtwI=") (allowed-ips '("10.0.0.1/32")) (keep-alive 25)) (wireguard-peer (name "azula") (public-key "8IxSFlJoFuTzLtIkoKZH4CkUbIxd6++E0lBOin/7rT8=") (allowed-ips '("10.0.0.2/32")) (keep-alive 25)) (wireguard-peer (name "novinho") (public-key "WKOAyNVPxYB9H7ga1A0DfUrZGMUFyC3RCIvUC7u9/RA=") (allowed-ips '("10.0.0.5/32")) (keep-alive 25)))))) (service pkgs:shadowgroup-service-type) (service pkgs:dkimproxyout-service-type) (service pkgs:cyrussasl-service-type) (service pkgs:dovecot-service-type) (service pkgs:internet-postfix-service-type) (simple-service 'host-specific-etc-file etc-service-type `(("id_rsa.pub" ,(plain-file "id_rsa.pub" +root-pubkey+)) ("known_hosts" ,(plain-file "known-hosts.txt" +known-hosts+)) ("offsite-ssh.txt" ,(plain-file "offsite-ssh.txt" +offsite-ssh+)))) (service mail-aliases-service-type '(("root" "andreh") ("eu" "andreh") ("mailing-list" "andreh")))) pkgs:base-services)) (bootloader (bootloader-configuration (bootloader grub-bootloader) (targets '("/dev/vda")))) (file-systems (append (list (file-system (mount-point "/") (device (uuid "4c36d5ad-f996-413e-a55c-c05b7e1876f2" 'btrfs)) (type "btrfs")) (file-system (mount-point "/mnt/production") (needed-for-boot? #t) (device (uuid "b1a7e4a1-a8ea-48a4-ab8b-884a1b6a9c11" 'btrfs)) (type "btrfs")) (file-system (mount-point "/mnt/backup") (device (uuid "6632849d-f180-4740-86e6-a519d43ab75a" 'btrfs)) (type "btrfs"))) %base-file-systems)) (swap-devices (list (swap-space ;; # rm -f /swapfile ;; # truncate -s 0 /swapfile ;; # chattr +C /swapfile ;; # fallocate -l 8G /swapfile ;; # chmod 600 /swapfile ;; # mkswap /swapfile ;; # swapon /swapfile (target "/mnt/production/swapfile") (dependencies (filter (file-system-mount-point-predicate "/mnt/production") file-systems))) (swap-space (target (uuid "94b47d91-3542-438a-84a9-859fe347ce09"))))))