system-configuration/systems/hermes.scm

hermes.scm

1
;;; Tyreunom's system administration and configuration tools.
2
;;;
3
;;; Copyright © 2019 Julien Lepiller <julien@lepiller.eu>
4
;;;
5
;;; This program is free software: you can redistribute it and/or modify
6
;;; it under the terms of the GNU General Public License as published by
7
;;; the Free Software Foundation, either version 3 of the License, or
8
;;; (at your option) any later version.
9
;;;
10
;;; This program is distributed in the hope that it will be useful,
11
;;; but WITHOUT ANY WARRANTY; without even the implied warranty of
12
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13
;;; GNU General Public License for more details.
14
;;;
15
;;; You should have received a copy of the GNU General Public License
16
;;; along with this program.  If not, see <http://www.gnu.org/licenses/>.
17
18
(use-modules (gnu))
19
(use-modules (gnu system))
20
(use-modules (gnu bootloader) (gnu bootloader grub))
21
(use-modules (gnu services dns))
22
(use-modules (gnu services web))
23
(use-modules (config certbot) (config dns) (config mail) (config network) (config os))
24
25
(operating-system
26
  (inherit (tyreunom-os "hermes"))
27
  (bootloader
28
    (bootloader-configuration
29
      (target "/dev/sda")
30
      (bootloader grub-bootloader)))
31
  (file-systems (cons (file-system
32
                        (mount-point "/")
33
                        (device (uuid "27798665-5606-4fde-8da8-cc371e603892"))
34
                        (type "ext4"))
35
                      %base-file-systems))
36
  (services
37
    (append
38
      (list
39
        hermes-network-service
40
        (service nginx-service-type)
41
        (service knot-service-type
42
                 (knot-configuration
43
                   (includes '("/etc/knot/secrets.conf"))
44
                   (acls (list glave-acl))
45
                   (remotes (list ene))
46
                   (zones (list lepiller-slave-zone
47
                                ipv4-reverse-master-zone
48
                                ipv6-reverse-master-zone))))
49
        (certbot-service `(("lepiller.eu" "www.lepiller.eu" "smtp.lepiller.eu")))
50
        (simple-service 'lepiller-http-server nginx-service-type
51
          (list (nginx-server-configuration
52
                  (ssl-certificate "/etc/letsencrypt/live/lepiller.eu/fullchain.pem")
53
                  (ssl-certificate-key "/etc/letsencrypt/live/lepiller.eu/privkey.pem")
54
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
55
                  (server-name '("lepiller.eu" "www.lepiller.eu"))
56
                  (root "/srv/http/lepiller/public")
57
                  (index '("index.$language_suffix.html" "index.html"))
58
                  (try-files '("$uri.$language_suffix.html" "$uri" "$uri/" "=404"))
59
                  (raw-content
60
                    '("add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;"
61
                      "add_header X-Frame-Options DENY;"
62
                      "add_header X-Content-Type-Options nosniff;"
63
                      "add_header Content-Security-Policy 'default-src \\'none\\'; img-src \\'self\\'; style-src \\'self\\' \\'unsafe-inline\\'; frame-ancestors \\'none\\'';"
64
                      "add_header Referrer-Policy no-referrer;"
65
                      "set $first_language $http_accept_language;"
66
                      "if ($http_accept_language ~* '(en|eo|fr)') {"
67
                      "    set $first_language $1;"
68
                      "}"
69
                      "set $language_suffix $first_language;"
70
                      "if ($cookie_language) {"
71
                      "    set $language_suffix $cookie_language;"
72
                      "}"
73
                      "if ($uri ~ \\.en.html$) {"
74
                      "    set $language_suffix 'en';"
75
                      "}"
76
                      "if ($uri ~ \\.eo.html$) {"
77
                      "    set $language_suffix 'eo';"
78
                      "}"
79
                      "if ($uri ~ \\.fr.html$) {"
80
                      "    set $language_suffix 'fr';"
81
                      "}"
82
                      "if ($uri ~ (.*).html) {"
83
                      "    set $my_uri $1.$language_suffix.html;"
84
                      "}"
85
                      "location ~ \\.html$ {"
86
                      "    add_header Set-Cookie 'language=$language_suffix;HttpOnly;Secure';"
87
                      "    add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';"
88
                      "    add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;"
89
                      "    add_header X-Frame-Options DENY;"
90
                      "    add_header X-Content-Type-Options nosniff;"
91
                      "    add_header Content-Security-Policy 'default-src \\'none\\'; img-src \\'self\\'; style-src \\'self\\' \\'unsafe-inline\\'; frame-ancestors \\'none\\'';"
92
                      "    add_header Referrer-Policy no-referrer;"
93
                      "    expires off;"
94
                      "    try_files $my_uri $uri $uri/ =404;"
95
                      "}"
96
                      "error_page 404 /404;")))))
97
        (simple-service 'default-http-server nginx-service-type
98
          (list (nginx-server-configuration
99
                  (ssl-certificate "/etc/letsencrypt/live/lepiller.eu/fullchain.pem")
100
                  (ssl-certificate-key "/etc/letsencrypt/live/lepiller.eu/privkey.pem")
101
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
102
                  (server-name '(default))(root "/srv/http/default")))))
103
      (lepiller-mail-services
104
        #:interface "ens18"
105
        #:domain "lepiller.eu")
106
      (server-services "hermes"))))
107