system-configuration

xana.scm

;;; Tyreunom's system administration and configuration tools.
;;;
;;; Copyright © 2020 Julien Lepiller <julien@lepiller.eu>
;;;
;;; This program is free software: you can redistribute it and/or modify
;;; it under the terms of the GNU General Public License as published by
;;; the Free Software Foundation, either version 3 of the License, or
;;; (at your option) any later version.
;;;
;;; This program is distributed in the hope that it will be useful,
;;; but WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with this program.  If not, see <http://www.gnu.org/licenses/>.

(use-modules (gnu))
(use-modules (gnu system))
(use-modules (gnu bootloader) (gnu bootloader grub))
(use-modules (gnu services mcron))
(use-modules (gnu services networking))
(use-modules (gnu services web))
(use-modules (config certbot) (config cuirass) (config network) (config os) (config web))
(use-modules (guix gexp))
(use-package-modules base compression gettext guile guile-xyz linux version-control
                     web wget)

(define lepiller-policy
  (append
    web-base-policy
    (web-html-policy
      '("    try_files $uri /$lang/$uri /$lang/$uri/index.html =404;"))
    '("error_page 404 /$lang/404.html;")))

(define (makefile-job directory target packages env)
  #~(lambda ()
      (define path
        (string-join
          (map (lambda (p) (string-append p "/bin")) (list #$@packages))
          ":"))
      (define (get-path dir)
        (string-join
          (map (lambda (p) (string-append p "/" path) (list #$@packages)))
          ":"))
      (setenv "PATH" path)
      (setenv "GIT_SSL_CAINFO" "/etc/ssl/certs/ca-certificates.crt")
      (setenv "SSL_CERT_DIR" "/etc/ssl/certs")
      (setenv "SSL_CERT_FILE" "/etc/ssl/certs/ca-certificates.crt")
      (setenv "LANG" "en_US.UTF-8")
      (for-each
        (lambda (env)
         (setenv (car env) (get-path (cdr env))))
        (quote #$env))
      (execl #$(file-append gnu-make "/bin/make") "make" "-C" #$directory #$target)))

(define i18n-download-job
  #~(job '(next-minute-from (next-hour '(05)) '(51))
         #$(makefile-job "/srv/http/i18n" "fdroid-update"
                         (list gnu-make coreutils findutils git)
                         '())))

(define i18n-compile-job
  #~(job '(next-minute-from (next-hour '(06)) '(21))
         #$(makefile-job "/srv/http/i18n" "all"
                         (list gnu-make coreutils findutils git grep util-linux)
                         '())))

(define nani-download-job
  #~(job '(next-minute-from (next-hour-from (next-day (range 1 31 5)) '(02)) '(12))
         #$(makefile-job "/srv/http/nani" "download"
                         (list gnu-make coreutils findutils grep gzip libiconv
                               sed tar unzip util-linux wget xz)
                         '())))

(define nani-update-job
  #~(job '(next-minute-from (next-hour-from (next-day (range 1 31 5)) '(03)) '(12))
         #$(makefile-job "/srv/http/nani" "all"
                         (list gnu-make coreutils findutils gnu-gettext grep guile-3.0
                               haunt sed)
                         '(("GUILE_LOAD_PATH" . "share/guile/site/3.0")
                           ("GUILE_LOAD_COMPILED_PATH" . "share/guile/site/3.0")))))

(operating-system
  (inherit (tyreunom-os "xana"))
  (bootloader
    (bootloader-configuration
      (targets '("/dev/sda"))
      (bootloader grub-bootloader)))
  (file-systems (cons (file-system
                        (mount-point "/")
                        (device (uuid "27207be8-f30a-4ac6-a5ec-41859e90ee94"))
                        (type "ext4"))
                      %base-file-systems))
  (swap-devices '("/dev/sda1"))
  (services
    (append
      (list
        (service dhcp-client-service-type)
        (service nginx-service-type
                 (nginx-configuration
                   (modules
                     (list
                       (file-append nginx-accept-language-module
                                    "/etc/nginx/modules/ngx_http_accept_language_module.so")))
                   (extra-content
                     (accept-languages
                       '(("en")
                         ("fr")
                         ("uk")
                         ("zh_CN" "zh-CN" "zh" "zh-Hans" "zh-Hans-CN"))))))
        (simple-service 'website-cron mcron-service-type
          (list i18n-download-job i18n-compile-job
                nani-download-job nani-update-job))
        (certbot-service `(("xana.lepiller.eu")
                           ("nani.lepiller.eu")
                           ("i18n.lepiller.eu")
                           ("offlate.lepiller.eu")))
        (simple-service 'nani-http-server nginx-service-type
          (list (nginx-server-configuration
                  (ssl-certificate
                    "/etc/letsencrypt/live/nani.lepiller.eu/fullchain.pem")
                  (ssl-certificate-key
                    "/etc/letsencrypt/live/nani.lepiller.eu/privkey.pem")
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
                  (server-name '("nani.lepiller.eu"))
                  (root "/srv/http/nani/public"))))
        (simple-service 'nani-http-server nginx-service-type
          (list (nginx-server-configuration
                  (ssl-certificate
                    "/etc/letsencrypt/live/offlate.lepiller.eu/fullchain.pem")
                  (ssl-certificate-key
                    "/etc/letsencrypt/live/offlate.lepiller.eu/privkey.pem")
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
                  (server-name '("offlate.lepiller.eu"))
                  (root "/srv/http/offlate/public")
                  (index '("index.html"))
                  (try-files '("$uri" "$uri/" "=404"))
                  (raw-content lepiller-policy))))
        (simple-service 'i18n-http-server nginx-service-type
          (list (nginx-server-configuration
                  (ssl-certificate
                    "/etc/letsencrypt/live/i18n.lepiller.eu/fullchain.pem")
                  (ssl-certificate-key
                    "/etc/letsencrypt/live/i18n.lepiller.eu/privkey.pem")
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
                  (server-name '("i18n.lepiller.eu"))
                  (root "/srv/http/i18n/public"))))
        (simple-service 'default-http-server nginx-service-type
          (list (nginx-server-configuration
                  (ssl-certificate
                    "/etc/letsencrypt/live/xana.lepiller.eu/fullchain.pem")
                  (ssl-certificate-key
                    "/etc/letsencrypt/live/xana.lepiller.eu/privkey.pem")
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
                  (server-name '(default "xana.lepiller.eu"))
                  (root "/srv/http/default")))))
      (modify-services (server-services "xana")
	(guix-service-type config =>
	  (guix-configuration
	    (inherit config)
	    (authorized-keys
	      (cons
		(local-file "../keys/tachikoma.pub")
		%default-authorized-guix-keys))))))))


1	;;; Tyreunom's system administration and configuration tools.
2	;;;
3	;;; Copyright © 2020 Julien Lepiller <julien@lepiller.eu>
4	;;;
5	;;; This program is free software: you can redistribute it and/or modify
6	;;; it under the terms of the GNU General Public License as published by
7	;;; the Free Software Foundation, either version 3 of the License, or
8	;;; (at your option) any later version.
9	;;;
10	;;; This program is distributed in the hope that it will be useful,
11	;;; but WITHOUT ANY WARRANTY; without even the implied warranty of
12	;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13	;;; GNU General Public License for more details.
14	;;;
15	;;; You should have received a copy of the GNU General Public License
16	;;; along with this program. If not, see <http://www.gnu.org/licenses/>.
17
18	(use-modules (gnu))
19	(use-modules (gnu system))
20	(use-modules (gnu bootloader) (gnu bootloader grub))
21	(use-modules (gnu services mcron))
22	(use-modules (gnu services networking))
23	(use-modules (gnu services web))
24	(use-modules (config certbot) (config cuirass) (config network) (config os) (config web))
25	(use-modules (guix gexp))
26	(use-package-modules base compression gettext guile guile-xyz linux version-control
27	web wget)
28
29	(define lepiller-policy
30	(append
31	web-base-policy
32	(web-html-policy
33	'(" try_files $uri /$lang/$uri /$lang/$uri/index.html =404;"))
34	'("error_page 404 /$lang/404.html;")))
35
36	(define (makefile-job directory target packages env)
37	#~(lambda ()
38	(define path
39	(string-join
40	(map (lambda (p) (string-append p "/bin")) (list #$@packages))
41	":"))
42	(define (get-path dir)
43	(string-join
44	(map (lambda (p) (string-append p "/" path) (list #$@packages)))
45	":"))
46	(setenv "PATH" path)
47	(setenv "GIT_SSL_CAINFO" "/etc/ssl/certs/ca-certificates.crt")
48	(setenv "SSL_CERT_DIR" "/etc/ssl/certs")
49	(setenv "SSL_CERT_FILE" "/etc/ssl/certs/ca-certificates.crt")
50	(setenv "LANG" "en_US.UTF-8")
51	(for-each
52	(lambda (env)
53	(setenv (car env) (get-path (cdr env))))
54	(quote #$env))
55	(execl #$(file-append gnu-make "/bin/make") "make" "-C" #$directory #$target)))
56
57	(define i18n-download-job
58	#~(job '(next-minute-from (next-hour '(05)) '(51))
59	#$(makefile-job "/srv/http/i18n" "fdroid-update"
60	(list gnu-make coreutils findutils git)
61	'())))
62
63	(define i18n-compile-job
64	#~(job '(next-minute-from (next-hour '(06)) '(21))
65	#$(makefile-job "/srv/http/i18n" "all"
66	(list gnu-make coreutils findutils git grep util-linux)
67	'())))
68
69	(define nani-download-job
70	#~(job '(next-minute-from (next-hour-from (next-day (range 1 31 5)) '(02)) '(12))
71	#$(makefile-job "/srv/http/nani" "download"
72	(list gnu-make coreutils findutils grep gzip libiconv
73	sed tar unzip util-linux wget xz)
74	'())))
75
76	(define nani-update-job
77	#~(job '(next-minute-from (next-hour-from (next-day (range 1 31 5)) '(03)) '(12))
78	#$(makefile-job "/srv/http/nani" "all"
79	(list gnu-make coreutils findutils gnu-gettext grep guile-3.0
80	haunt sed)
81	'(("GUILE_LOAD_PATH" . "share/guile/site/3.0")
82	("GUILE_LOAD_COMPILED_PATH" . "share/guile/site/3.0")))))
83
84	(operating-system
85	(inherit (tyreunom-os "xana"))
86	(bootloader
87	(bootloader-configuration
88	(targets '("/dev/sda"))
89	(bootloader grub-bootloader)))
90	(file-systems (cons (file-system
91	(mount-point "/")
92	(device (uuid "27207be8-f30a-4ac6-a5ec-41859e90ee94"))
93	(type "ext4"))
94	%base-file-systems))
95	(swap-devices '("/dev/sda1"))
96	(services
97	(append
98	(list
99	(service dhcp-client-service-type)
100	(service nginx-service-type
101	(nginx-configuration
102	(modules
103	(list
104	(file-append nginx-accept-language-module
105	"/etc/nginx/modules/ngx_http_accept_language_module.so")))
106	(extra-content
107	(accept-languages
108	'(("en")
109	("fr")
110	("uk")
111	("zh_CN" "zh-CN" "zh" "zh-Hans" "zh-Hans-CN"))))))
112	(simple-service 'website-cron mcron-service-type
113	(list i18n-download-job i18n-compile-job
114	nani-download-job nani-update-job))
115	(certbot-service `(("xana.lepiller.eu")
116	("nani.lepiller.eu")
117	("i18n.lepiller.eu")
118	("offlate.lepiller.eu")))
119	(simple-service 'nani-http-server nginx-service-type
120	(list (nginx-server-configuration
121	(ssl-certificate
122	"/etc/letsencrypt/live/nani.lepiller.eu/fullchain.pem")
123	(ssl-certificate-key
124	"/etc/letsencrypt/live/nani.lepiller.eu/privkey.pem")
125	(listen '("443 ssl http2" "[::]:443 ssl http2"))
126	(server-name '("nani.lepiller.eu"))
127	(root "/srv/http/nani/public"))))
128	(simple-service 'nani-http-server nginx-service-type
129	(list (nginx-server-configuration
130	(ssl-certificate
131	"/etc/letsencrypt/live/offlate.lepiller.eu/fullchain.pem")
132	(ssl-certificate-key
133	"/etc/letsencrypt/live/offlate.lepiller.eu/privkey.pem")
134	(listen '("443 ssl http2" "[::]:443 ssl http2"))
135	(server-name '("offlate.lepiller.eu"))
136	(root "/srv/http/offlate/public")
137	(index '("index.html"))
138	(try-files '("$uri" "$uri/" "=404"))
139	(raw-content lepiller-policy))))
140	(simple-service 'i18n-http-server nginx-service-type
141	(list (nginx-server-configuration
142	(ssl-certificate
143	"/etc/letsencrypt/live/i18n.lepiller.eu/fullchain.pem")
144	(ssl-certificate-key
145	"/etc/letsencrypt/live/i18n.lepiller.eu/privkey.pem")
146	(listen '("443 ssl http2" "[::]:443 ssl http2"))
147	(server-name '("i18n.lepiller.eu"))
148	(root "/srv/http/i18n/public"))))
149	(simple-service 'default-http-server nginx-service-type
150	(list (nginx-server-configuration
151	(ssl-certificate
152	"/etc/letsencrypt/live/xana.lepiller.eu/fullchain.pem")
153	(ssl-certificate-key
154	"/etc/letsencrypt/live/xana.lepiller.eu/privkey.pem")
155	(listen '("443 ssl http2" "[::]:443 ssl http2"))
156	(server-name '(default "xana.lepiller.eu"))
157	(root "/srv/http/default")))))
158	(modify-services (server-services "xana")
159	(guix-service-type config =>
160	(guix-configuration
161	(inherit config)
162	(authorized-keys
163	(cons
164	(local-file "../keys/tachikoma.pub")
165	%default-authorized-guix-keys))))))))
166