system-configuration

ene.scm

;;; Tyreunom's system administration and configuration tools.
;;;
;;; Copyright © 2019, 2020 Julien Lepiller <julien@lepiller.eu>
;;;
;;; This program is free software: you can redistribute it and/or modify
;;; it under the terms of the GNU General Public License as published by
;;; the Free Software Foundation, either version 3 of the License, or
;;; (at your option) any later version.
;;;
;;; This program is distributed in the hope that it will be useful,
;;; but WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with this program.  If not, see <http://www.gnu.org/licenses/>.

(use-modules (gnu))
(use-modules (gnu bootloader))
(use-modules (gnu bootloader u-boot))
(use-modules (gnu packages bootloaders))
(use-modules (gnu packages dns))
(use-modules (gnu services dns))
(use-modules (gnu services mail))
(use-modules (gnu services networking))
(use-modules (gnu services version-control))
(use-modules (gnu services web))
(use-modules (gnu system))

(use-modules (gnu packages libunwind))
(use-modules (gnu packages mail))
(use-modules (gnu packages tor))
(use-modules (gnu packages web))
(use-modules (guix packages))
(use-modules (guix utils))
(use-modules (guix transformations))

(use-modules (config certbot) (config dns) (config iptables)
             (config mail) (config os) (config static-web)
	     (config web)
	     (services gitile) (packages gitile))

;; Copy from (gnu bootloader u-boot)
(define install-allwinner-u-boot
  #~(lambda (bootloader device mount-point)
      (let ((u-boot (string-append bootloader
                                   "/libexec/u-boot-sunxi-with-spl.bin")))
        (write-file-on-device u-boot (stat:size (stat u-boot))
                              device (* 8 1024)))))

(define u-boot-cubietruck-bootloader
  (bootloader
    (inherit u-boot-bootloader)
    (package u-boot-cubietruck)
    (installer install-allwinner-u-boot)))

(operating-system
  (inherit (tyreunom-os "ene"))
  (bootloader
    (bootloader-configuration
      (target "/dev/mmcblk0")
      (bootloader u-boot-cubietruck-bootloader)))
  (initrd-modules (cons* "sunxi-mmc" "sd_mod" "ahci_sunxi" %base-initrd-modules))
  (file-systems (cons (file-system
                        (mount-point "/")
                        (device "/dev/sda1")
                        (type "ext4"))
                      %base-file-systems))
  (services
    (append
      (list
        (service dhcp-client-service-type)
        lepiller-iptables-service
        (agetty-service
          (agetty-configuration
            (extra-options '("-L"))
            (baud-rate "115200")
            (term "vt100")
            (tty "ttyS0")))
        (service tor-service-type
		 (tor-configuration
		   (tor (package
			  (inherit tor)
			  (arguments
			   `(#:tests? #f
			     ,@(package-arguments tor)))))))
        (tor-hidden-service "mail"
                            '((25 "127.0.0.1:25")
                              (143 "127.0.0.1:143")
                              (587 "127.0.0.1:587")
                              (993 "127.0.0.1:993")))
        (service knot-service-type
                 (knot-configuration
		   (knot
		     ((options->transformation '((without-tests . "protobuf")))
		       knot))
                   (includes '("/etc/knot/secrets.conf"))
                   (acls (list master-acl))
                   (remotes (list hermes))
                   (zones (list lepiller-master-zone
                                ipv4-reverse-master-zone
                                ipv6-reverse-master-zone))))
        (certbot-service `(("courriel.lepiller.eu" "imap.lepiller.eu")
                           ("ene.lepiller.eu" "rennes.lepiller.eu")
                           ("avatar.lepiller.eu")
                           ("git.lepiller.eu")
			   ("social.lepiller.eu")))
        (service nginx-service-type)
        (service php-fpm-service-type
		 (php-fpm-configuration
		   ;; TODO: remove after guix doesn't complain about duplicate
		   ;; groups.
		   (group "php-fpm2")))
        (service fcgiwrap-service-type
                 (fcgiwrap-configuration
                   (group "git")))
        (cat-avatar-generator-service
          #:configuration
          (nginx-server-configuration
            (server-name '("avatar.lepiller.eu"))
            (ssl-certificate
              "/etc/letsencrypt/live/avatar.lepiller.eu/fullchain.pem")
            (ssl-certificate-key
              "/etc/letsencrypt/live/avatar.lepiller.eu/privkey.pem")
            (listen '("443 ssl http2" "[::]:443 ssl http2"))))
        (simple-service 'default-http-server nginx-service-type
          (list (nginx-server-configuration
                  (ssl-certificate
                    "/etc/letsencrypt/live/ene.lepiller.eu/fullchain.pem")
                  (ssl-certificate-key
                    "/etc/letsencrypt/live/ene.lepiller.eu/privkey.pem")
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
                  (server-name '(default))(root "/srv/http/default"))))
        (simple-service 'social-http-server nginx-service-type
          (list (nginx-server-configuration
                  (ssl-certificate "/etc/letsencrypt/live/social.lepiller.eu/fullchain.pem")
                  (ssl-certificate-key "/etc/letsencrypt/live/social.lepiller.eu/privkey.pem")
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
                  (server-name '("social.lepiller.eu"))
                  (root "/srv/http/social/public")
                  (locations
                    (list
		      (nginx-location-configuration
			(uri "/content/")
			(body '("alias /var/lib/social/user-data/public/;")))
                      (nginx-location-configuration
                        (uri "/")
                        (body '("proxy_pass http://localhost:8081;")))))
                  (raw-content default-web-policy))))
	(service gitile-service-type)
        (simple-service 'git-server nginx-service-type
          (list (nginx-server-configuration
                  (ssl-certificate
                    "/etc/letsencrypt/live/git.lepiller.eu/fullchain.pem")
                  (ssl-certificate-key
                    "/etc/letsencrypt/live/git.lepiller.eu/privkey.pem")
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
                  (server-name '("git.lepiller.eu"))
                  (root "/srv/http/git/public")
                  (locations
                    (append
                      (list
                        (git-http-nginx-location-configuration
                          (git-http-configuration
                            (uri-path "/git/")
                            (git-root "/var/lib/gitolite/repositories")))
                        (nginx-location-configuration
                          (uri "/")
                          (body
                            (list
                              "proxy_pass http://127.0.0.1:8080/;"))))
                      (map
                        (lambda (loc)
                          (nginx-location-configuration
                            (uri loc)
                            (body
                              (list
                                "root /srv/http/git/public;"))))
                        '("/css" "/js" "/images" "~* .*/manual/.*" "= /"
                          "= /index.html")))))))
        (service static-web-site-service-type
                 (static-web-site-configuration
                  (git-url "https://git.lepiller.eu/git/guile-netlink")
                  (git-ref '(branch . "master"))
                  (directory "/srv/http/git/guile-netlink-manual")
                  (build-file "doc/build.scm")))
        ;; on activation, gitolite chmods its home directory to #o700, disabling
        ;; access to git-http-backend.  Re-enable that access.
        (simple-service 'gitolite-home-permissions
                        activation-service-type
                        #~(chmod "/var/lib/gitolite" #o750))
        (service gitolite-service-type
          (gitolite-configuration
            (admin-pubkey (local-file "../keys/tyreunom.pub"))
            (rc-file
              (gitolite-rc-file
                (umask #o0027)
                (git-config-keys ".*"))))))
      (modify-services
        (lepiller-mail-services
          #:interface "eth0"
          #:domain "courriel.lepiller.eu")
        (dovecot-service-type config =>
         (dovecot-configuration
           (inherit config)
           (dovecot (package
                      (inherit dovecot)
                      (arguments
                        `(#:tests? #f
                          ,@(package-arguments dovecot))))))))
      (server-services "ene"))))


1	;;; Tyreunom's system administration and configuration tools.
2	;;;
3	;;; Copyright © 2019, 2020 Julien Lepiller <julien@lepiller.eu>
4	;;;
5	;;; This program is free software: you can redistribute it and/or modify
6	;;; it under the terms of the GNU General Public License as published by
7	;;; the Free Software Foundation, either version 3 of the License, or
8	;;; (at your option) any later version.
9	;;;
10	;;; This program is distributed in the hope that it will be useful,
11	;;; but WITHOUT ANY WARRANTY; without even the implied warranty of
12	;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13	;;; GNU General Public License for more details.
14	;;;
15	;;; You should have received a copy of the GNU General Public License
16	;;; along with this program. If not, see <http://www.gnu.org/licenses/>.
17
18	(use-modules (gnu))
19	(use-modules (gnu bootloader))
20	(use-modules (gnu bootloader u-boot))
21	(use-modules (gnu packages bootloaders))
22	(use-modules (gnu packages dns))
23	(use-modules (gnu services dns))
24	(use-modules (gnu services mail))
25	(use-modules (gnu services networking))
26	(use-modules (gnu services version-control))
27	(use-modules (gnu services web))
28	(use-modules (gnu system))
29
30	(use-modules (gnu packages libunwind))
31	(use-modules (gnu packages mail))
32	(use-modules (gnu packages tor))
33	(use-modules (gnu packages web))
34	(use-modules (guix packages))
35	(use-modules (guix utils))
36	(use-modules (guix transformations))
37
38	(use-modules (config certbot) (config dns) (config iptables)
39	(config mail) (config os) (config static-web)
40	(config web)
41	(services gitile) (packages gitile))
42
43	;; Copy from (gnu bootloader u-boot)
44	(define install-allwinner-u-boot
45	#~(lambda (bootloader device mount-point)
46	(let ((u-boot (string-append bootloader
47	"/libexec/u-boot-sunxi-with-spl.bin")))
48	(write-file-on-device u-boot (stat:size (stat u-boot))
49	device (* 8 1024)))))
50
51	(define u-boot-cubietruck-bootloader
52	(bootloader
53	(inherit u-boot-bootloader)
54	(package u-boot-cubietruck)
55	(installer install-allwinner-u-boot)))
56
57	(operating-system
58	(inherit (tyreunom-os "ene"))
59	(bootloader
60	(bootloader-configuration
61	(target "/dev/mmcblk0")
62	(bootloader u-boot-cubietruck-bootloader)))
63	(initrd-modules (cons* "sunxi-mmc" "sd_mod" "ahci_sunxi" %base-initrd-modules))
64	(file-systems (cons (file-system
65	(mount-point "/")
66	(device "/dev/sda1")
67	(type "ext4"))
68	%base-file-systems))
69	(services
70	(append
71	(list
72	(service dhcp-client-service-type)
73	lepiller-iptables-service
74	(agetty-service
75	(agetty-configuration
76	(extra-options '("-L"))
77	(baud-rate "115200")
78	(term "vt100")
79	(tty "ttyS0")))
80	(service tor-service-type
81	(tor-configuration
82	(tor (package
83	(inherit tor)
84	(arguments
85	`(#:tests? #f
86	,@(package-arguments tor)))))))
87	(tor-hidden-service "mail"
88	'((25 "127.0.0.1:25")
89	(143 "127.0.0.1:143")
90	(587 "127.0.0.1:587")
91	(993 "127.0.0.1:993")))
92	(service knot-service-type
93	(knot-configuration
94	(knot
95	((options->transformation '((without-tests . "protobuf")))
96	knot))
97	(includes '("/etc/knot/secrets.conf"))
98	(acls (list master-acl))
99	(remotes (list hermes))
100	(zones (list lepiller-master-zone
101	ipv4-reverse-master-zone
102	ipv6-reverse-master-zone))))
103	(certbot-service `(("courriel.lepiller.eu" "imap.lepiller.eu")
104	("ene.lepiller.eu" "rennes.lepiller.eu")
105	("avatar.lepiller.eu")
106	("git.lepiller.eu")
107	("social.lepiller.eu")))
108	(service nginx-service-type)
109	(service php-fpm-service-type
110	(php-fpm-configuration
111	;; TODO: remove after guix doesn't complain about duplicate
112	;; groups.
113	(group "php-fpm2")))
114	(service fcgiwrap-service-type
115	(fcgiwrap-configuration
116	(group "git")))
117	(cat-avatar-generator-service
118	#:configuration
119	(nginx-server-configuration
120	(server-name '("avatar.lepiller.eu"))
121	(ssl-certificate
122	"/etc/letsencrypt/live/avatar.lepiller.eu/fullchain.pem")
123	(ssl-certificate-key
124	"/etc/letsencrypt/live/avatar.lepiller.eu/privkey.pem")
125	(listen '("443 ssl http2" "[::]:443 ssl http2"))))
126	(simple-service 'default-http-server nginx-service-type
127	(list (nginx-server-configuration
128	(ssl-certificate
129	"/etc/letsencrypt/live/ene.lepiller.eu/fullchain.pem")
130	(ssl-certificate-key
131	"/etc/letsencrypt/live/ene.lepiller.eu/privkey.pem")
132	(listen '("443 ssl http2" "[::]:443 ssl http2"))
133	(server-name '(default))(root "/srv/http/default"))))
134	(simple-service 'social-http-server nginx-service-type
135	(list (nginx-server-configuration
136	(ssl-certificate "/etc/letsencrypt/live/social.lepiller.eu/fullchain.pem")
137	(ssl-certificate-key "/etc/letsencrypt/live/social.lepiller.eu/privkey.pem")
138	(listen '("443 ssl http2" "[::]:443 ssl http2"))
139	(server-name '("social.lepiller.eu"))
140	(root "/srv/http/social/public")
141	(locations
142	(list
143	(nginx-location-configuration
144	(uri "/content/")
145	(body '("alias /var/lib/social/user-data/public/;")))
146	(nginx-location-configuration
147	(uri "/")
148	(body '("proxy_pass http://localhost:8081;")))))
149	(raw-content default-web-policy))))
150	(service gitile-service-type)
151	(simple-service 'git-server nginx-service-type
152	(list (nginx-server-configuration
153	(ssl-certificate
154	"/etc/letsencrypt/live/git.lepiller.eu/fullchain.pem")
155	(ssl-certificate-key
156	"/etc/letsencrypt/live/git.lepiller.eu/privkey.pem")
157	(listen '("443 ssl http2" "[::]:443 ssl http2"))
158	(server-name '("git.lepiller.eu"))
159	(root "/srv/http/git/public")
160	(locations
161	(append
162	(list
163	(git-http-nginx-location-configuration
164	(git-http-configuration
165	(uri-path "/git/")
166	(git-root "/var/lib/gitolite/repositories")))
167	(nginx-location-configuration
168	(uri "/")
169	(body
170	(list
171	"proxy_pass http://127.0.0.1:8080/;"))))
172	(map
173	(lambda (loc)
174	(nginx-location-configuration
175	(uri loc)
176	(body
177	(list
178	"root /srv/http/git/public;"))))
179	'("/css" "/js" "/images" "~* ./manual/." "= /"
180	"= /index.html")))))))
181	(service static-web-site-service-type
182	(static-web-site-configuration
183	(git-url "https://git.lepiller.eu/git/guile-netlink")
184	(git-ref '(branch . "master"))
185	(directory "/srv/http/git/guile-netlink-manual")
186	(build-file "doc/build.scm")))
187	;; on activation, gitolite chmods its home directory to #o700, disabling
188	;; access to git-http-backend. Re-enable that access.
189	(simple-service 'gitolite-home-permissions
190	activation-service-type
191	#~(chmod "/var/lib/gitolite" #o750))
192	(service gitolite-service-type
193	(gitolite-configuration
194	(admin-pubkey (local-file "../keys/tyreunom.pub"))
195	(rc-file
196	(gitolite-rc-file
197	(umask #o0027)
198	(git-config-keys ".*"))))))
199	(modify-services
200	(lepiller-mail-services
201	#:interface "eth0"
202	#:domain "courriel.lepiller.eu")
203	(dovecot-service-type config =>
204	(dovecot-configuration
205	(inherit config)
206	(dovecot (package
207	(inherit dovecot)
208	(arguments
209	`(#:tests? #f
210	,@(package-arguments dovecot))))))))
211	(server-services "ene"))))
212