(use-modules (gnu)
             (ice-9 textual-ports)
             (guix gexp))
(use-package-modules ssh
                     backup
                     version-control)
(use-service-modules networking
                     ssh
                     mcron
                     admin
                     mail
                     web
                     certbot
                     cgit)

(define user
  "andreh")

(define (slurp f)
  (string-trim-both
   (call-with-input-file f get-string-all)))

(define ssh-public-key
  (slurp "id_rsa.pub"))

(define sudoers "\
root ALL=(ALL) ALL
%wheel ALL=NOPASSWD: ALL\n")

(define tld
  (slurp "tld.txt"))

(define mail-domain-prefix "mail")
(define mail-domain
  (string-append mail-domain-prefix "." tld))

(define git-domain-prefix "git")
(define git-domain
  (string-append git-domain-prefix "." tld))

(define certbot-alias
  "certbot")

(define letsencrypt-prefix
  "/etc/letsencrypt/live/")

(define (tls-pub-for domain)
  (string-append letsencrypt-prefix domain "/fullchain.pem"))

(define (tls-priv-for domain)
  (string-append letsencrypt-prefix domain "/privkey.pem"))

(define opensmtpd-config
  (mixed-text-file "euandreh-smtpd.conf" "
listen on eth0
# File comes from mail-aliases-service-type
table aliases file:/etc/aliases
accept from any domain " mail-domain " alias <aliases> deliver to maildir
accept for local alias <aliases> deliver to maildir
accept for any relay

pki " mail-domain " cert \"" (tls-pub-for  mail-domain) "\"
pki " mail-domain " key  \"" (tls-priv-for mail-domain) "\""))

(define tls-prefixes
  (list "www"
        mail-domain-prefix
        "ci"
        git-domain-prefix
        "chat"
        "meet"))

(define tls-domains
  (cons tld
        (map (lambda (prefix)
               (string-append prefix "." tld))
             tls-prefixes)))

(operating-system
  (locale "fr_FR.UTF-8")
  (timezone "America/Sao_Paulo")
  (keyboard-layout (keyboard-layout "us"))
  (host-name "guix-pet-server")
  (users (cons* (user-account
                 (name user)
                 (group "users")
                 (home-directory (string-append "/home/" user))
                 (supplementary-groups '("wheel")))
                %base-user-accounts))
  (sudoers-file (plain-file "sudoers" sudoers))
  (packages
   (append (map (compose list specification->package+output symbol->string)
                '(git
                  nss-certs
                  rsync))
           %base-packages))
  (services
   (append
    (list (service openssh-service-type
                   (openssh-configuration
                    (openssh openssh-sans-x)
                    (password-authentication? #false)
                    (authorized-keys
                     `((,user ,(plain-file "id_rsa.pub" ssh-public-key))))))
          (service mcron-service-type
                   (mcron-configuration
                    (jobs (list))))
          (service unattended-upgrade-service-type)
          (service dhcp-client-service-type)
          (service opensmtpd-service-type
                   (opensmtpd-configuration
                    (config-file opensmtpd-config)))
          (service mail-aliases-service-type
                   `(("postmaster" "root")
                     ("webmaster" "root")
                     ("abuse" "root")
                     (,certbot-alias "root")))
          ;; (service nginx-service-type
          ;;          (nginx-configuration
          ;;           (server-blocks
          ;;            (list
          ;;             (nginx-server-configuration
          ;;              (server-name (list tld))
          ;;              (ssl-certificate     (tls-pub-for  tld))
          ;;              (ssl-certificate-key (tls-priv-for tld)))))))
          ;; (service certbot-service-type
          ;;          (certbot-configuration
          ;;           (email (string-append certbot-alias "@" tld))
          ;;           (certificates
          ;;            (list
          ;;             (certificate-configuration
          ;;              (domains tls-domains))))))
          (simple-service 'automatic-certbot-renewal
                          activation-service-type
                          (with-imported-modules '((gnu services herd))
                            #~(begin
                                (use-modules (gnu services herd))
                                ;; (execl "/var/lib/certbot/renew-certificates")
                                (restart-service 'nginx))))
          (service cgit-service-type
                   (cgit-configuration
                    (remove-suffix? #t)
                    (root-title "EuAndreh's repositories")
                    (root-desc "Patches welcome!")
                    (snapshots '("tar.gz" "zip"))
                    (clone-prefix (list (string-append "https://" git-domain)))
                    (source-filter (file-append cgit "/lib/cgit/filters/syntax-highlighting.py"))
                    (about-filter  (file-append cgit "/lib/cgit/filters/about-formatting.sh"))
                    ;; about-filter
                    ;;(clone-url "dunno")
                    (enable-commit-graph? #t)
                    (enable-follow-links? #t)
                    (enable-index-links? #t)
                    (enable-log-filecount? #t)
                    (enable-log-linecount? #t)
                    (max-repodesc-length 120)
                    (max-stats "year")
                    (nocache? #t)
                    (readme "README.md")
                    ;()
                    ;; (repositories
                    ;;  (list
                    ;;   (repository-cgit-configuration
                    ;;    ))
                    ;;   )
                     ;; (map (lambda (f)
                     ;;        (repository-cgit-configuration (readme f)))
                     ;;      '("README.md" "README" "README.rst" "README.org"))
                     ))
          (simple-service 'init-srv-directories
                          activation-service-type
                          #~(begin
                              (for-each (lambda (p)
                                          (mkdir-p p)
                                          (chmod p #o777))
                                        '("/srv/http"
                                          "/srv/git"
                                          "/srv/ci")))))
    %base-services))
  (bootloader
   (bootloader-configuration
    (bootloader grub-bootloader)
    (target "/dev/vda")
    (keyboard-layout keyboard-layout)))
  (swap-devices
   (list (uuid "79a91c82-f3e1-4ed7-8c4e-23569f1ae0ca")))
  (file-systems
   (cons* (file-system
            (mount-point "/")
            (device
             (uuid "fddb6a4c-8b8c-4f57-b274-5d6d33200f28"
                   'ext4))
            (type "ext4"))
          %base-file-systems)))