system-configuration

ene.scm

;;; Tyreunom's system administration and configuration tools.
;;;
;;; Copyright © 2019, 2020 Julien Lepiller <julien@lepiller.eu>
;;;
;;; This program is free software: you can redistribute it and/or modify
;;; it under the terms of the GNU General Public License as published by
;;; the Free Software Foundation, either version 3 of the License, or
;;; (at your option) any later version.
;;;
;;; This program is distributed in the hope that it will be useful,
;;; but WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with this program.  If not, see <http://www.gnu.org/licenses/>.

(use-modules (gnu))
(use-modules (gnu bootloader))
(use-modules (gnu bootloader u-boot))
(use-modules (gnu packages bootloaders))
(use-modules (gnu services dns))
(use-modules (gnu services mail))
(use-modules (gnu services networking))
(use-modules (gnu services version-control))
(use-modules (gnu services web))
(use-modules (gnu system))

(use-modules (gnu packages libunwind))
(use-modules (gnu packages mail))
(use-modules (gnu packages web))
(use-modules (guix packages))
(use-modules (guix utils))

(use-modules (config certbot) (config dns) (config iptables)
             (config mail) (config os) (config static-web)
	     (config web)
	     (services gitile) (packages gitile))

;; Copy from (gnu bootloader u-boot)
(define install-allwinner-u-boot
  #~(lambda (bootloader device mount-point)
      (let ((u-boot (string-append bootloader
                                   "/libexec/u-boot-sunxi-with-spl.bin")))
        (write-file-on-device u-boot (stat:size (stat u-boot))
                              device (* 8 1024)))))

(define u-boot-cubietruck-bootloader
  (bootloader
    (inherit u-boot-bootloader)
    (package u-boot-cubietruck)
    (installer install-allwinner-u-boot)))

(operating-system
  (inherit (tyreunom-os "ene"))
  (bootloader
    (bootloader-configuration
      (target "/dev/mmcblk0")
      (bootloader u-boot-cubietruck-bootloader)))
  (initrd-modules (cons* "sunxi-mmc" "sd_mod" "ahci_sunxi" %base-initrd-modules))
  (file-systems (cons (file-system
                        (mount-point "/")
                        (device "/dev/sda1")
                        (type "ext4"))
                      %base-file-systems))
  (services
    (append
      (list
        (service dhcp-client-service-type)
        lepiller-iptables-service
        (agetty-service
          (agetty-configuration
            (extra-options '("-L"))
            (baud-rate "115200")
            (term "vt100")
            (tty "ttyS0")))
        (service tor-service-type)
        (tor-hidden-service "mail"
                            '((25 "127.0.0.1:25")
                              (143 "127.0.0.1:143")
                              (587 "127.0.0.1:587")
                              (993 "127.0.0.1:993")))
        (service knot-service-type
                 (knot-configuration
                   (includes '("/etc/knot/secrets.conf"))
                   (acls (list master-acl))
                   (remotes (list hermes))
                   (zones (list lepiller-master-zone
                                ipv4-reverse-master-zone
                                ipv6-reverse-master-zone))))
        (certbot-service `(("courriel.lepiller.eu" "imap.lepiller.eu")
                           ("ene.lepiller.eu" "rennes.lepiller.eu")
                           ("avatar.lepiller.eu")
                           ("git.lepiller.eu")
			   ("social.lepiller.eu")))
        (service nginx-service-type)
        (service php-fpm-service-type)
        (service fcgiwrap-service-type
                 (fcgiwrap-configuration
                   (group "git")))
        (cat-avatar-generator-service
          #:configuration
          (nginx-server-configuration
            (server-name '("avatar.lepiller.eu"))
            (ssl-certificate
              "/etc/letsencrypt/live/avatar.lepiller.eu/fullchain.pem")
            (ssl-certificate-key
              "/etc/letsencrypt/live/avatar.lepiller.eu/privkey.pem")
            (listen '("443 ssl http2" "[::]:443 ssl http2"))))
        (simple-service 'default-http-server nginx-service-type
          (list (nginx-server-configuration
                  (ssl-certificate
                    "/etc/letsencrypt/live/ene.lepiller.eu/fullchain.pem")
                  (ssl-certificate-key
                    "/etc/letsencrypt/live/ene.lepiller.eu/privkey.pem")
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
                  (server-name '(default))(root "/srv/http/default"))))
        (simple-service 'social-http-server nginx-service-type
          (list (nginx-server-configuration
                  (ssl-certificate "/etc/letsencrypt/live/social.lepiller.eu/fullchain.pem")
                  (ssl-certificate-key "/etc/letsencrypt/live/social.lepiller.eu/privkey.pem")
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
                  (server-name '("social.lepiller.eu"))
                  (root "/srv/http/social/public")
                  (locations
                    (list
		      (nginx-location-configuration
			(uri "/content/")
			(body '("alias /var/lib/social/user-data/public/;")))
                      (nginx-location-configuration
                        (uri "/")
                        (body '("proxy_pass http://localhost:8081;")))))
                  (raw-content default-web-policy))))
	(service gitile-service-type)
        (simple-service 'git-server nginx-service-type
          (list (nginx-server-configuration
                  (ssl-certificate
                    "/etc/letsencrypt/live/git.lepiller.eu/fullchain.pem")
                  (ssl-certificate-key
                    "/etc/letsencrypt/live/git.lepiller.eu/privkey.pem")
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
                  (server-name '("git.lepiller.eu"))
                  (root "/srv/http/git/public")
                  (locations
                    (append
                      (list
                        (git-http-nginx-location-configuration
                          (git-http-configuration
                            (uri-path "/git/")
                            (git-root "/var/lib/gitolite/repositories")))
                        (nginx-location-configuration
                          (uri "/")
                          (body
                            (list
                              "proxy_pass http://127.0.0.1:8080/;"))))
                      (map
                        (lambda (loc)
                          (nginx-location-configuration
                            (uri loc)
                            (body
                              (list
                                "root /srv/http/git/public;"))))
                        '("/css" "/images" "~* .*/manual/.*" "= /"
                          "= /index.html")))))))
        (service static-web-site-service-type
                 (static-web-site-configuration
                  (git-url "https://git.lepiller.eu/git/guile-netlink")
                  (git-ref '(branch . "master"))
                  (directory "/srv/http/git/guile-netlink-manual")
                  (build-file "doc/build.scm")))
        ;; on activation, gitolite chmods its home directory to #o700, disabling
        ;; access to git-http-backend.  Re-enable that access.
        (simple-service 'gitolite-home-permissions
                        activation-service-type
                        #~(chmod "/var/lib/gitolite" #o750))
        (service gitolite-service-type
          (gitolite-configuration
            (admin-pubkey (local-file "../keys/tyreunom.pub"))
            (rc-file
              (gitolite-rc-file
                (umask #o0027)
                (git-config-keys ".*"))))))
      (modify-services
        (lepiller-mail-services
          #:interface "eth0"
          #:domain "courriel.lepiller.eu")
        (dovecot-service-type config =>
         (dovecot-configuration
           (inherit config)
           (dovecot (package
                      (inherit dovecot)
                      (arguments
                        `(#:tests? #f
                          ,@(package-arguments dovecot))))))))
      (server-services "ene"))))


1	;;; Tyreunom's system administration and configuration tools.
2	;;;
3	;;; Copyright © 2019, 2020 Julien Lepiller <julien@lepiller.eu>
4	;;;
5	;;; This program is free software: you can redistribute it and/or modify
6	;;; it under the terms of the GNU General Public License as published by
7	;;; the Free Software Foundation, either version 3 of the License, or
8	;;; (at your option) any later version.
9	;;;
10	;;; This program is distributed in the hope that it will be useful,
11	;;; but WITHOUT ANY WARRANTY; without even the implied warranty of
12	;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13	;;; GNU General Public License for more details.
14	;;;
15	;;; You should have received a copy of the GNU General Public License
16	;;; along with this program. If not, see <http://www.gnu.org/licenses/>.
17
18	(use-modules (gnu))
19	(use-modules (gnu bootloader))
20	(use-modules (gnu bootloader u-boot))
21	(use-modules (gnu packages bootloaders))
22	(use-modules (gnu services dns))
23	(use-modules (gnu services mail))
24	(use-modules (gnu services networking))
25	(use-modules (gnu services version-control))
26	(use-modules (gnu services web))
27	(use-modules (gnu system))
28
29	(use-modules (gnu packages libunwind))
30	(use-modules (gnu packages mail))
31	(use-modules (gnu packages web))
32	(use-modules (guix packages))
33	(use-modules (guix utils))
34
35	(use-modules (config certbot) (config dns) (config iptables)
36	(config mail) (config os) (config static-web)
37	(config web)
38	(services gitile) (packages gitile))
39
40	;; Copy from (gnu bootloader u-boot)
41	(define install-allwinner-u-boot
42	#~(lambda (bootloader device mount-point)
43	(let ((u-boot (string-append bootloader
44	"/libexec/u-boot-sunxi-with-spl.bin")))
45	(write-file-on-device u-boot (stat:size (stat u-boot))
46	device (* 8 1024)))))
47
48	(define u-boot-cubietruck-bootloader
49	(bootloader
50	(inherit u-boot-bootloader)
51	(package u-boot-cubietruck)
52	(installer install-allwinner-u-boot)))
53
54	(operating-system
55	(inherit (tyreunom-os "ene"))
56	(bootloader
57	(bootloader-configuration
58	(target "/dev/mmcblk0")
59	(bootloader u-boot-cubietruck-bootloader)))
60	(initrd-modules (cons* "sunxi-mmc" "sd_mod" "ahci_sunxi" %base-initrd-modules))
61	(file-systems (cons (file-system
62	(mount-point "/")
63	(device "/dev/sda1")
64	(type "ext4"))
65	%base-file-systems))
66	(services
67	(append
68	(list
69	(service dhcp-client-service-type)
70	lepiller-iptables-service
71	(agetty-service
72	(agetty-configuration
73	(extra-options '("-L"))
74	(baud-rate "115200")
75	(term "vt100")
76	(tty "ttyS0")))
77	(service tor-service-type)
78	(tor-hidden-service "mail"
79	'((25 "127.0.0.1:25")
80	(143 "127.0.0.1:143")
81	(587 "127.0.0.1:587")
82	(993 "127.0.0.1:993")))
83	(service knot-service-type
84	(knot-configuration
85	(includes '("/etc/knot/secrets.conf"))
86	(acls (list master-acl))
87	(remotes (list hermes))
88	(zones (list lepiller-master-zone
89	ipv4-reverse-master-zone
90	ipv6-reverse-master-zone))))
91	(certbot-service `(("courriel.lepiller.eu" "imap.lepiller.eu")
92	("ene.lepiller.eu" "rennes.lepiller.eu")
93	("avatar.lepiller.eu")
94	("git.lepiller.eu")
95	("social.lepiller.eu")))
96	(service nginx-service-type)
97	(service php-fpm-service-type)
98	(service fcgiwrap-service-type
99	(fcgiwrap-configuration
100	(group "git")))
101	(cat-avatar-generator-service
102	#:configuration
103	(nginx-server-configuration
104	(server-name '("avatar.lepiller.eu"))
105	(ssl-certificate
106	"/etc/letsencrypt/live/avatar.lepiller.eu/fullchain.pem")
107	(ssl-certificate-key
108	"/etc/letsencrypt/live/avatar.lepiller.eu/privkey.pem")
109	(listen '("443 ssl http2" "[::]:443 ssl http2"))))
110	(simple-service 'default-http-server nginx-service-type
111	(list (nginx-server-configuration
112	(ssl-certificate
113	"/etc/letsencrypt/live/ene.lepiller.eu/fullchain.pem")
114	(ssl-certificate-key
115	"/etc/letsencrypt/live/ene.lepiller.eu/privkey.pem")
116	(listen '("443 ssl http2" "[::]:443 ssl http2"))
117	(server-name '(default))(root "/srv/http/default"))))
118	(simple-service 'social-http-server nginx-service-type
119	(list (nginx-server-configuration
120	(ssl-certificate "/etc/letsencrypt/live/social.lepiller.eu/fullchain.pem")
121	(ssl-certificate-key "/etc/letsencrypt/live/social.lepiller.eu/privkey.pem")
122	(listen '("443 ssl http2" "[::]:443 ssl http2"))
123	(server-name '("social.lepiller.eu"))
124	(root "/srv/http/social/public")
125	(locations
126	(list
127	(nginx-location-configuration
128	(uri "/content/")
129	(body '("alias /var/lib/social/user-data/public/;")))
130	(nginx-location-configuration
131	(uri "/")
132	(body '("proxy_pass http://localhost:8081;")))))
133	(raw-content default-web-policy))))
134	(service gitile-service-type)
135	(simple-service 'git-server nginx-service-type
136	(list (nginx-server-configuration
137	(ssl-certificate
138	"/etc/letsencrypt/live/git.lepiller.eu/fullchain.pem")
139	(ssl-certificate-key
140	"/etc/letsencrypt/live/git.lepiller.eu/privkey.pem")
141	(listen '("443 ssl http2" "[::]:443 ssl http2"))
142	(server-name '("git.lepiller.eu"))
143	(root "/srv/http/git/public")
144	(locations
145	(append
146	(list
147	(git-http-nginx-location-configuration
148	(git-http-configuration
149	(uri-path "/git/")
150	(git-root "/var/lib/gitolite/repositories")))
151	(nginx-location-configuration
152	(uri "/")
153	(body
154	(list
155	"proxy_pass http://127.0.0.1:8080/;"))))
156	(map
157	(lambda (loc)
158	(nginx-location-configuration
159	(uri loc)
160	(body
161	(list
162	"root /srv/http/git/public;"))))
163	'("/css" "/images" "~* ./manual/." "= /"
164	"= /index.html")))))))
165	(service static-web-site-service-type
166	(static-web-site-configuration
167	(git-url "https://git.lepiller.eu/git/guile-netlink")
168	(git-ref '(branch . "master"))
169	(directory "/srv/http/git/guile-netlink-manual")
170	(build-file "doc/build.scm")))
171	;; on activation, gitolite chmods its home directory to #o700, disabling
172	;; access to git-http-backend. Re-enable that access.
173	(simple-service 'gitolite-home-permissions
174	activation-service-type
175	#~(chmod "/var/lib/gitolite" #o750))
176	(service gitolite-service-type
177	(gitolite-configuration
178	(admin-pubkey (local-file "../keys/tyreunom.pub"))
179	(rc-file
180	(gitolite-rc-file
181	(umask #o0027)
182	(git-config-keys ".*"))))))
183	(modify-services
184	(lepiller-mail-services
185	#:interface "eth0"
186	#:domain "courriel.lepiller.eu")
187	(dovecot-service-type config =>
188	(dovecot-configuration
189	(inherit config)
190	(dovecot (package
191	(inherit dovecot)
192	(arguments
193	`(#:tests? #f
194	,@(package-arguments dovecot))))))))
195	(server-services "ene"))))
196