system-configuration/systems/hermes.scm

hermes.scm

1
;;; Tyreunom's system administration and configuration tools.
2
;;;
3
;;; Copyright © 2019 Julien Lepiller <julien@lepiller.eu>
4
;;;
5
;;; This program is free software: you can redistribute it and/or modify
6
;;; it under the terms of the GNU General Public License as published by
7
;;; the Free Software Foundation, either version 3 of the License, or
8
;;; (at your option) any later version.
9
;;;
10
;;; This program is distributed in the hope that it will be useful,
11
;;; but WITHOUT ANY WARRANTY; without even the implied warranty of
12
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13
;;; GNU General Public License for more details.
14
;;;
15
;;; You should have received a copy of the GNU General Public License
16
;;; along with this program.  If not, see <http://www.gnu.org/licenses/>.
17
18
(use-modules (gnu))
19
(use-modules (gnu system))
20
(use-modules (gnu bootloader) (gnu bootloader grub))
21
(use-modules (gnu services dns))
22
(use-modules (gnu services networking))
23
(use-modules (gnu services web))
24
(use-modules (config certbot) (config dns) (config mail) (config network) (config os)
25
             (config iptables) (config web))
26
27
28
;; NOTE: this config contains out-of band files.
29
;; To (re-)generate /etc/mail/dkim/private.key, run:
30
;; openssl genrsa -out /etc/mail/dkim/private.key 2048
31
;; openssl rsa -in /etc/mail/dkim/private.key -pubout -out /etc/mail/dkim/public.key
32
;; chmod 440 /etc/mail/dkim/private.key
33
;;
34
;; To (re-)generate /etc/knot/secrets.conf, run:
35
;; keymgt -t lepiller-key > /etc/knot/secrets.conf
36
37
(define lepiller-policy
38
  (append
39
    web-base-policy
40
    '("set $first_language $http_accept_language;"
41
      "if ($http_accept_language ~* '(en|eo|fr)') {"
42
      "    set $first_language $1;"
43
      "}"
44
      "set $language_suffix $first_language;"
45
      "if ($cookie_language) {"
46
      "    set $language_suffix $cookie_language;"
47
      "}"
48
      "if ($uri ~ \\.en.html$) {"
49
      "    set $language_suffix 'en';"
50
      "}"
51
      "if ($uri ~ \\.eo.html$) {"
52
      "    set $language_suffix 'eo';"
53
      "}"
54
      "if ($uri ~ \\.fr.html$) {"
55
      "    set $language_suffix 'fr';"
56
      "}"
57
      "if ($uri ~ (.*).html) {"
58
      "    set $my_uri $1.$language_suffix.html;"
59
      "}")
60
    (web-html-policy
61
      '("    add_header Set-Cookie 'language=$language_suffix;HttpOnly;Secure';"
62
        "    try_files $my_uri $uri $uri/ =404;"))
63
    '("error_page 404 /404;")))
64
65
(operating-system
66
  (inherit (tyreunom-os "hermes"))
67
  (bootloader
68
    (bootloader-configuration
69
      (target "/dev/sda")
70
      (bootloader grub-bootloader)))
71
  (file-systems (cons (file-system
72
                        (mount-point "/")
73
                        (device (uuid "27798665-5606-4fde-8da8-cc371e603892"))
74
                        (type "ext4"))
75
                      %base-file-systems))
76
  (services
77
    (append
78
      (list
79
        hermes-network-service
80
        lepiller-iptables-service
81
        (service tor-service-type)
82
        (tor-hidden-service "lepiller"
83
                            '((22 "127.0.0.1:22")
84
                              (80 "127.0.0.1:80")))
85
        (service nginx-service-type
86
          (nginx-configuration
87
            (server-names-hash-bucket-size 128)))
88
        (service knot-service-type
89
                 (knot-configuration
90
                   (includes '("/etc/knot/secrets.conf"))
91
                   (acls (list slave-acl))
92
                   (remotes (list ene))
93
                   (zones (list lepiller-slave-zone
94
                                ipv4-reverse-master-zone
95
                                ipv6-reverse-master-zone))))
96
        (certbot-service `(("lepiller.eu" "www.lepiller.eu" "smtp.lepiller.eu")
97
                           ("social.lepiller.eu")))
98
        (simple-service 'social-http-server nginx-service-type
99
          (list (nginx-server-configuration
100
                  (ssl-certificate "/etc/letsencrypt/live/social.lepiller.eu/fullchain.pem")
101
                  (ssl-certificate-key "/etc/letsencrypt/live/social.lepiller.eu/privkey.pem")
102
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
103
                  (server-name '("social.lepiller.eu"))
104
                  (root "/srv/http/social/public")
105
                  (locations
106
                    (list
107
		      (nginx-location-configuration
108
			(uri "/content/")
109
			(body '("alias /var/lib/social/user-data/public/;")))
110
                      (nginx-location-configuration
111
                        (uri "/")
112
                        (body '("proxy_pass http://localhost:8080;")))))
113
                  (raw-content default-web-policy))))
114
        (simple-service 'tor-lepiller-http-server nginx-service-type
115
          (list (nginx-server-configuration
116
                  (listen '("80" "[::]:80"))
117
                  (server-name '("c25o7knygjm3m67jy27yuynvv4pkfi25naucscmh4ubq2ggiig3v57ad.onion"))
118
                  (root "/srv/http/lepiller/public")
119
                  (index '("index.$language_suffix.html" "index.html"))
120
                  (try-files '("$uri.$language_suffix.html" "$uri" "$uri/" "=404"))
121
                  (raw-content lepiller-policy))))
122
        (simple-service 'lepiller-http-server nginx-service-type
123
          (list (nginx-server-configuration
124
                  (ssl-certificate "/etc/letsencrypt/live/lepiller.eu/fullchain.pem")
125
                  (ssl-certificate-key "/etc/letsencrypt/live/lepiller.eu/privkey.pem")
126
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
127
                  (server-name '("lepiller.eu" "www.lepiller.eu"))
128
                  (root "/srv/http/lepiller/public")
129
                  (index '("index.$language_suffix.html" "index.html"))
130
                  (try-files '("$uri.$language_suffix.html" "$uri" "$uri/" "=404"))
131
                  (raw-content lepiller-policy))))
132
        (simple-service 'default-http-server nginx-service-type
133
          (list (nginx-server-configuration
134
                  (ssl-certificate "/etc/letsencrypt/live/lepiller.eu/fullchain.pem")
135
                  (ssl-certificate-key "/etc/letsencrypt/live/lepiller.eu/privkey.pem")
136
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
137
                  (server-name '(default))
138
                  (root "/srv/http/default")
139
                  (raw-content default-web-policy)))))
140
      (lepiller-mail-services
141
        #:interface "ens18"
142
        #:domain "lepiller.eu")
143
      (server-services "hermes"))))
144