;;; Tyreunom's system administration and configuration tools.

;;;

;;; Copyright © 2019 Julien Lepiller <julien@lepiller.eu>

;;;

;;; This program is free software: you can redistribute it and/or modify

;;; it under the terms of the GNU General Public License as published by

;;; the Free Software Foundation, either version 3 of the License, or

;;; (at your option) any later version.

;;;

;;; This program is distributed in the hope that it will be useful,

;;; but WITHOUT ANY WARRANTY; without even the implied warranty of

;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

;;; GNU General Public License for more details.

;;;

;;; You should have received a copy of the GNU General Public License

;;; along with this program.  If not, see <http://www.gnu.org/licenses/>.

(use-modules (gnu))

(use-modules (gnu bootloader))

(use-modules (gnu bootloader u-boot))

(use-modules (gnu packages bootloaders))

(use-modules (gnu services dns))

(use-modules (gnu services mail))

(use-modules (gnu services networking))

(use-modules (gnu services version-control))

(use-modules (gnu services web))

(use-modules (gnu system))

(use-modules (gnu packages libunwind))

(use-modules (gnu packages mail))

(use-modules (gnu packages web))

(use-modules (guix packages))

(use-modules (guix utils))

(use-modules (config certbot) (config dns) (config iptables)

             (config mail) (config os))

;; Copy from (gnu bootloader u-boot)

(define install-allwinner-u-boot

  #~(lambda (bootloader device mount-point)

      (let ((u-boot (string-append bootloader

                                   "/libexec/u-boot-sunxi-with-spl.bin")))

        (write-file-on-device u-boot (stat:size (stat u-boot))

                              device (* 8 1024)))))

(define u-boot-cubietruck-bootloader

  (bootloader

    (inherit u-boot-bootloader)

    (package u-boot-cubietruck)

    (installer install-allwinner-u-boot)))

(operating-system

  (inherit (tyreunom-os "ene"))

  (bootloader

    (bootloader-configuration

      (target "/dev/mmcblk0")

      (bootloader u-boot-cubietruck-bootloader)))

  (initrd-modules (cons* "sunxi-mmc" "sd_mod" "ahci_sunxi" %base-initrd-modules))

  (file-systems (cons (file-system

                        (mount-point "/")

                        (device "/dev/sda1")

                        (type "ext4"))

                      %base-file-systems))

  (services

    (append

      (list

        (service dhcp-client-service-type)

        lepiller-iptables-service

        (agetty-service

          (agetty-configuration

            (extra-options '("-L"))

            (baud-rate "115200")

            (term "vt100")

            (tty "ttyS0")))

        (service tor-service-type)

        (tor-hidden-service "mail"

                            '((25 "127.0.0.1:25")

                              (143 "127.0.0.1:143")

                              (587 "127.0.0.1:587")

                              (993 "127.0.0.1:993")))

        (service knot-service-type

                 (knot-configuration

                   (includes '("/etc/knot/secrets.conf"))

                   (acls (list master-acl))

                   (remotes (list hermes))

                   (zones (list lepiller-master-zone

                                ipv4-reverse-master-zone

                                ipv6-reverse-master-zone))))

        (certbot-service `(("courriel.lepiller.eu" "imap.lepiller.eu")

                           ("ene.lepiller.eu" "rennes.lepiller.eu")

                           ("avatar.lepiller.eu")

			   ("git.lepiller.eu")))

        (service nginx-service-type)

        (service php-fpm-service-type)

        (cat-avatar-generator-service

          #:configuration

          (nginx-server-configuration

            (server-name '("avatar.lepiller.eu"))

            (ssl-certificate

	      "/etc/letsencrypt/live/avatar.lepiller.eu/fullchain.pem")

            (ssl-certificate-key

	      "/etc/letsencrypt/live/avatar.lepiller.eu/privkey.pem")

            (listen '("443 ssl http2" "[::]:443 ssl http2"))))

        (simple-service 'default-http-server nginx-service-type

          (list (nginx-server-configuration

                  (ssl-certificate

		    "/etc/letsencrypt/live/ene.lepiller.eu/fullchain.pem")

                  (ssl-certificate-key

		    "/etc/letsencrypt/live/ene.lepiller.eu/privkey.pem")

                  (listen '("443 ssl http2" "[::]:443 ssl http2"))

                  (server-name '(default))(root "/srv/http/default"))))

        (simple-service 'git-server nginx-service-type

          (list (nginx-server-configuration

                  (ssl-certificate

		    "/etc/letsencrypt/live/git.lepiller.eu/fullchain.pem")

                  (ssl-certificate-key

		    "/etc/letsencrypt/live/git.lepiller.eu/privkey.pem")

                  (listen '("443 ssl http2" "[::]:443 ssl http2"))

                  (server-name '(default))(root "/srv/http/git/public"))))

	(service gitolite-service-type

	  (gitolite-configuration

	    (admin-pubkey (local-file "../keys/tyreunom.pub")))))

      (modify-services

        (lepiller-mail-services

          #:interface "eth0"

          #:domain "courriel.lepiller.eu")

        (dovecot-service-type config =>

         (dovecot-configuration

           (inherit config)

           (dovecot (package

                      (inherit dovecot)

                      (arguments

                        `(#:tests? #f

                          ,@(package-arguments dovecot))))))))

      (server-services "ene"))))