ene.scm
1 | ;;; Tyreunom's system administration and configuration tools. |
2 | ;;; |
3 | ;;; Copyright © 2019, 2020 Julien Lepiller <julien@lepiller.eu> |
4 | ;;; |
5 | ;;; This program is free software: you can redistribute it and/or modify |
6 | ;;; it under the terms of the GNU General Public License as published by |
7 | ;;; the Free Software Foundation, either version 3 of the License, or |
8 | ;;; (at your option) any later version. |
9 | ;;; |
10 | ;;; This program is distributed in the hope that it will be useful, |
11 | ;;; but WITHOUT ANY WARRANTY; without even the implied warranty of |
12 | ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
13 | ;;; GNU General Public License for more details. |
14 | ;;; |
15 | ;;; You should have received a copy of the GNU General Public License |
16 | ;;; along with this program. If not, see <http://www.gnu.org/licenses/>. |
17 | |
18 | (use-modules (gnu)) |
19 | (use-modules (gnu bootloader)) |
20 | (use-modules (gnu bootloader u-boot)) |
21 | (use-modules (gnu packages bootloaders)) |
22 | (use-modules (gnu services dns)) |
23 | (use-modules (gnu services mail)) |
24 | (use-modules (gnu services networking)) |
25 | (use-modules (gnu services version-control)) |
26 | (use-modules (gnu services web)) |
27 | (use-modules (gnu system)) |
28 | |
29 | (use-modules (gnu packages libunwind)) |
30 | (use-modules (gnu packages mail)) |
31 | (use-modules (gnu packages web)) |
32 | (use-modules (guix packages)) |
33 | (use-modules (guix utils)) |
34 | |
35 | (use-modules (config certbot) (config dns) (config iptables) |
36 | (config mail) (config os)) |
37 | |
38 | ;; Copy from (gnu bootloader u-boot) |
39 | (define install-allwinner-u-boot |
40 | #~(lambda (bootloader device mount-point) |
41 | (let ((u-boot (string-append bootloader |
42 | "/libexec/u-boot-sunxi-with-spl.bin"))) |
43 | (write-file-on-device u-boot (stat:size (stat u-boot)) |
44 | device (* 8 1024))))) |
45 | |
46 | (define u-boot-cubietruck-bootloader |
47 | (bootloader |
48 | (inherit u-boot-bootloader) |
49 | (package u-boot-cubietruck) |
50 | (installer install-allwinner-u-boot))) |
51 | |
52 | (operating-system |
53 | (inherit (tyreunom-os "ene")) |
54 | (bootloader |
55 | (bootloader-configuration |
56 | (target "/dev/mmcblk0") |
57 | (bootloader u-boot-cubietruck-bootloader))) |
58 | (initrd-modules (cons* "sunxi-mmc" "sd_mod" "ahci_sunxi" %base-initrd-modules)) |
59 | (file-systems (cons (file-system |
60 | (mount-point "/") |
61 | (device "/dev/sda1") |
62 | (type "ext4")) |
63 | %base-file-systems)) |
64 | (services |
65 | (append |
66 | (list |
67 | (service dhcp-client-service-type) |
68 | lepiller-iptables-service |
69 | (agetty-service |
70 | (agetty-configuration |
71 | (extra-options '("-L")) |
72 | (baud-rate "115200") |
73 | (term "vt100") |
74 | (tty "ttyS0"))) |
75 | (service tor-service-type) |
76 | (tor-hidden-service "mail" |
77 | '((25 "127.0.0.1:25") |
78 | (143 "127.0.0.1:143") |
79 | (587 "127.0.0.1:587") |
80 | (993 "127.0.0.1:993"))) |
81 | (service knot-service-type |
82 | (knot-configuration |
83 | (includes '("/etc/knot/secrets.conf")) |
84 | (acls (list master-acl)) |
85 | (remotes (list hermes)) |
86 | (zones (list lepiller-master-zone |
87 | ipv4-reverse-master-zone |
88 | ipv6-reverse-master-zone)))) |
89 | (certbot-service `(("courriel.lepiller.eu" "imap.lepiller.eu") |
90 | ("ene.lepiller.eu" "rennes.lepiller.eu") |
91 | ("avatar.lepiller.eu") |
92 | ("git.lepiller.eu"))) |
93 | (service nginx-service-type) |
94 | (service php-fpm-service-type) |
95 | (cat-avatar-generator-service |
96 | #:configuration |
97 | (nginx-server-configuration |
98 | (server-name '("avatar.lepiller.eu")) |
99 | (ssl-certificate |
100 | "/etc/letsencrypt/live/avatar.lepiller.eu/fullchain.pem") |
101 | (ssl-certificate-key |
102 | "/etc/letsencrypt/live/avatar.lepiller.eu/privkey.pem") |
103 | (listen '("443 ssl http2" "[::]:443 ssl http2")))) |
104 | (simple-service 'default-http-server nginx-service-type |
105 | (list (nginx-server-configuration |
106 | (ssl-certificate |
107 | "/etc/letsencrypt/live/ene.lepiller.eu/fullchain.pem") |
108 | (ssl-certificate-key |
109 | "/etc/letsencrypt/live/ene.lepiller.eu/privkey.pem") |
110 | (listen '("443 ssl http2" "[::]:443 ssl http2")) |
111 | (server-name '(default))(root "/srv/http/default")))) |
112 | (simple-service 'git-server nginx-service-type |
113 | (list (nginx-server-configuration |
114 | (ssl-certificate |
115 | "/etc/letsencrypt/live/git.lepiller.eu/fullchain.pem") |
116 | (ssl-certificate-key |
117 | "/etc/letsencrypt/live/git.lepiller.eu/privkey.pem") |
118 | (listen '("443 ssl http2" "[::]:443 ssl http2")) |
119 | (server-name '(default))(root "/srv/http/git/public")))) |
120 | (service gitolite-service-type |
121 | (gitolite-configuration |
122 | (admin-pubkey (local-file "../keys/tyreunom.pub"))))) |
123 | (modify-services |
124 | (lepiller-mail-services |
125 | #:interface "eth0" |
126 | #:domain "courriel.lepiller.eu") |
127 | (dovecot-service-type config => |
128 | (dovecot-configuration |
129 | (inherit config) |
130 | (dovecot (package |
131 | (inherit dovecot) |
132 | (arguments |
133 | `(#:tests? #f |
134 | ,@(package-arguments dovecot)))))))) |
135 | (server-services "ene")))) |
136 |