(use-modules ((im papo packages) #:prefix pkgs:) ((org euandre packages) #:prefix packages:) (gnu)) (use-package-modules version-control web) (use-service-modules certbot cgit dns mail networking security ssh vpn web) (define +working-dir+ ;; src/guix/system.scm + ../../../ = ./ (dirname (dirname (dirname (current-filename))))) (define (path s) (pkgs:str +working-dir+ "/" s)) (define +admingroups+ '("wheel" "becomesecretskeeper")) (define +users+ `(("andreh" "EuAndreh" ,+admingroups+ ,(path "src/keys/SSH/andreh.pub.txt")))) (define file (compose string-trim-right pkgs:slurp path)) (define +ipv4+ (file "src/config/ipv4.txt")) (define +ipv6+ (file "src/config/ipv6.txt")) (define +tld+ (file "src/config/tld.txt")) (define +root-pubkey+ (file "src/config/root-pubkey.txt")) (define +known-hosts+ (file "src/config/known-hosts.txt")) (define +offsite-ssh+ (file "src/config/offsite-ssh.txt")) (define package-symbols '()) (define package-records (list)) (operating-system (locale "fr_FR.UTF-8") (timezone "America/Sao_Paulo") (host-name +tld+) (skeletons pkgs:skeletons) (users (append (pkgs:user-accounts +users+) %base-user-accounts)) (sudoers-file pkgs:syskeep-sudoers-file) (packages (pkgs:package-set package-symbols package-records)) (services (append (list (service ntp-service-type) (service dhcpcd-service-type) (service knot-service-type (pkgs:knot-zones-configuration +tld+ +ipv4+ +ipv6+)) (service openssh-service-type (pkgs:openssh-default-configuration (pkgs:users->keys +users+))) (service certbot-service-type (pkgs:tld-certbot-configuration +tld+)) (service nginx-service-type (nginx-configuration (server-blocks (list (nginx-server-configuration (server-name (list +tld+)) (listen '("[::]:443 ssl" "443 ssl")) (root "/srv/www") (ssl-certificate (pkgs:fmt "/etc/letsencrypt/live/~a/fullchain.pem" +tld+)) (ssl-certificate-key (pkgs:fmt "/etc/letsencrypt/live/~a/privkey.pem" +tld+)) (locations (list (nginx-location-configuration (uri "~ ^(.*)/index\\.html$") (body '("if ($request_uri ~ /index\\.html$) {\n" " rewrite ^(.*)/index\\.html$ $1/ permanent;\n" "}\n"))) (nginx-location-configuration (uri "/git/static/") (body (list (list "alias " cgit "/share/cgit/;")))) (nginx-location-configuration (uri "/git/") (body (list (list "fastcgi_param SCRIPT_FILENAME " cgit "/lib/cgit/cgit.cgi;") "fastcgi_param PATH_INFO $uri;" "fastcgi_param PATH /run/current-system/profile/bin;" "fastcgi_param QUERY_STRING $args;" "fastcgi_param HTTP_HOST $server_name;" "fastcgi_pass localhost:9000;" "rewrite /git(.*) $1 break;"))))) (raw-content (list "ssl_protocols TLSv1.3;" "ssl_ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH;" "ssl_prefer_server_ciphers on;" "gzip off; # Disable dynamic compression due to BREACH" "gzip_static on;" "charset utf-8;" "autoindex on;" (pkgs:str "add_header Strict-Transport-Security " "'max-age=31536000; includeSubdomains' always;") "types {" " text/html html;" " text/css css;" " text/javascript mjs;" " text/xml xml;" " text/plain txt;" " application/atom+xml atom;" " application/gzip gz;" " application/pdf pdf;" " application/x-bittorrent torrent;" " image/vnd.microsoft.icon ico;" " image/png png;" " image/svg+xml svg;" " audio/flac flac;" " audio/ogg ogg;" " video/webm webm;" "}"))))))) (service cgit-service-type pkgs:cgit-pre-configuration) (service pkgs:syskeep-service-type (pkgs:syskeep-configuration (tld +tld+))) ; FIXME #; (service pkgs:cicd-service-type) (service pkgs:git-service-type (pkgs:git-configuration (export-all? #t) (run-server? #t))) (simple-service 'add-wireguard-aliases hosts-service-type (list (host "10.0.0.0" "toph") (host "10.0.0.1" "velhinho") (host "10.0.0.2" "azula") (host "10.0.0.5" "novinho"))) (service wireguard-service-type (wireguard-configuration (addresses '("10.0.0.0/32")) (peers (list (wireguard-peer (name "velhinho") (public-key "Mhv8KxB/QXQpNKNtqD57PoFv43TXJ1lg52PJd6TmtwI=") (allowed-ips '("10.0.0.1/32")) (keep-alive 25)) (wireguard-peer (name "azula") (public-key "8IxSFlJoFuTzLtIkoKZH4CkUbIxd6++E0lBOin/7rT8=") (allowed-ips '("10.0.0.2/32")) (keep-alive 25)) (wireguard-peer (name "novinho") (public-key "WKOAyNVPxYB9H7ga1A0DfUrZGMUFyC3RCIvUC7u9/RA=") (allowed-ips '("10.0.0.5/32")) (keep-alive 25)))))) (service pkgs:shadowgroup-service-type) (service pkgs:dkimproxyout-service-type) (service pkgs:cyrussasl-service-type) (service pkgs:dovecot-service-type) (service pkgs:internet-postfix-service-type) (simple-service 'host-specific-etc-file etc-service-type `(("id_rsa.pub" ,(plain-file "id_rsa.pub" +root-pubkey+)) ("known_hosts" ,(plain-file "known-hosts.txt" +known-hosts+)) ("offsite-ssh.txt" ,(plain-file "offsite-ssh.txt" +offsite-ssh+)))) (service mail-aliases-service-type '(("root" "andreh") ("eu" "andreh") ("mailing-list" "andreh")))) pkgs:base-services)) (bootloader (bootloader-configuration (bootloader grub-bootloader) (targets '("/dev/vda")))) (file-systems (append (list (file-system (mount-point "/") (device (uuid "4c36d5ad-f996-413e-a55c-c05b7e1876f2" 'btrfs)) (type "btrfs")) (file-system (mount-point "/mnt/production") (needed-for-boot? #t) (device (uuid "b1a7e4a1-a8ea-48a4-ab8b-884a1b6a9c11" 'btrfs)) (type "btrfs")) (file-system (mount-point "/mnt/backup") (device (uuid "6632849d-f180-4740-86e6-a519d43ab75a" 'btrfs)) (type "btrfs"))) %base-file-systems)) (swap-devices (list (swap-space ;; # rm -f /swapfile ;; # truncate -s 0 /swapfile ;; # chattr +C /swapfile ;; # fallocate -l 8G /swapfile ;; # chmod 600 /swapfile ;; # mkswap /swapfile ;; # swapon /swapfile (target "/mnt/production/swapfile") (dependencies (filter (file-system-mount-point-predicate "/mnt/production") file-systems))) (swap-space (target (uuid "94b47d91-3542-438a-84a9-859fe347ce09"))))))