hermes.scm
1 | ;;; Tyreunom's system administration and configuration tools. |
2 | ;;; |
3 | ;;; Copyright © 2019 Julien Lepiller <julien@lepiller.eu> |
4 | ;;; |
5 | ;;; This program is free software: you can redistribute it and/or modify |
6 | ;;; it under the terms of the GNU General Public License as published by |
7 | ;;; the Free Software Foundation, either version 3 of the License, or |
8 | ;;; (at your option) any later version. |
9 | ;;; |
10 | ;;; This program is distributed in the hope that it will be useful, |
11 | ;;; but WITHOUT ANY WARRANTY; without even the implied warranty of |
12 | ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
13 | ;;; GNU General Public License for more details. |
14 | ;;; |
15 | ;;; You should have received a copy of the GNU General Public License |
16 | ;;; along with this program. If not, see <http://www.gnu.org/licenses/>. |
17 | |
18 | (use-modules (gnu)) |
19 | (use-modules (gnu system)) |
20 | (use-modules (gnu bootloader) (gnu bootloader grub)) |
21 | (use-modules (gnu services dns)) |
22 | (use-modules (gnu services networking)) |
23 | (use-modules (gnu services web)) |
24 | (use-modules (config certbot) (config dns) (config mail) (config network) (config os) |
25 | (config web)) |
26 | |
27 | |
28 | ;; NOTE: this config contains out-of band files. |
29 | ;; To (re-)generate /etc/mail/dkim/private.key, run: |
30 | ;; openssl genrsa -out /etc/mail/dkim/private.key 2048 |
31 | ;; openssl rsa -in /etc/mail/dkim/private.key -pubout -out /etc/mail/dkim/public.key |
32 | ;; chmod 440 /etc/mail/dkim/private.key |
33 | ;; |
34 | ;; To (re-)generate /etc/knot/secrets.conf, run: |
35 | ;; keymgt -t lepiller-key > /etc/knot/secrets.conf |
36 | |
37 | (define lepiller-policy |
38 | (append |
39 | web-base-policy |
40 | '("set $first_language $http_accept_language;" |
41 | "if ($http_accept_language ~* '(en|eo|fr)') {" |
42 | " set $first_language $1;" |
43 | "}" |
44 | "set $language_suffix $first_language;" |
45 | "if ($cookie_language) {" |
46 | " set $language_suffix $cookie_language;" |
47 | "}" |
48 | "if ($uri ~ \\.en.html$) {" |
49 | " set $language_suffix 'en';" |
50 | "}" |
51 | "if ($uri ~ \\.eo.html$) {" |
52 | " set $language_suffix 'eo';" |
53 | "}" |
54 | "if ($uri ~ \\.fr.html$) {" |
55 | " set $language_suffix 'fr';" |
56 | "}" |
57 | "if ($uri ~ (.*).html) {" |
58 | " set $my_uri $1.$language_suffix.html;" |
59 | "}") |
60 | (web-html-policy |
61 | '(" add_header Set-Cookie 'language=$language_suffix;HttpOnly;Secure';" |
62 | " try_files $my_uri $uri $uri/ =404;")) |
63 | '("error_page 404 /404;"))) |
64 | |
65 | (operating-system |
66 | (inherit (tyreunom-os "hermes")) |
67 | (bootloader |
68 | (bootloader-configuration |
69 | (target "/dev/sda") |
70 | (bootloader grub-bootloader))) |
71 | (file-systems (cons (file-system |
72 | (mount-point "/") |
73 | (device (uuid "27798665-5606-4fde-8da8-cc371e603892")) |
74 | (type "ext4")) |
75 | %base-file-systems)) |
76 | (services |
77 | (append |
78 | (list |
79 | hermes-network-service |
80 | (service tor-service-type) |
81 | (tor-hidden-service "lepiller" |
82 | '((22 "127.0.0.1:22") |
83 | (80 "127.0.0.1:80"))) |
84 | (service nginx-service-type |
85 | (nginx-configuration |
86 | (server-names-hash-bucket-size 128))) |
87 | (service knot-service-type |
88 | (knot-configuration |
89 | (includes '("/etc/knot/secrets.conf")) |
90 | (acls (list slave-acl)) |
91 | (remotes (list ene)) |
92 | (zones (list lepiller-slave-zone |
93 | ipv4-reverse-master-zone |
94 | ipv6-reverse-master-zone)))) |
95 | (certbot-service `(("lepiller.eu" "www.lepiller.eu" "smtp.lepiller.eu"))) |
96 | (simple-service 'tor-lepiller-http-server nginx-service-type |
97 | (list (nginx-server-configuration |
98 | (listen '("80" "[::]:80")) |
99 | (server-name '("c25o7knygjm3m67jy27yuynvv4pkfi25naucscmh4ubq2ggiig3v57ad.onion")) |
100 | (root "/srv/http/lepiller/public") |
101 | (index '("index.$language_suffix.html" "index.html")) |
102 | (try-files '("$uri.$language_suffix.html" "$uri" "$uri/" "=404")) |
103 | (raw-content lepiller-policy)))) |
104 | (simple-service 'lepiller-http-server nginx-service-type |
105 | (list (nginx-server-configuration |
106 | (ssl-certificate "/etc/letsencrypt/live/lepiller.eu/fullchain.pem") |
107 | (ssl-certificate-key "/etc/letsencrypt/live/lepiller.eu/privkey.pem") |
108 | (listen '("443 ssl http2" "[::]:443 ssl http2")) |
109 | (server-name '("lepiller.eu" "www.lepiller.eu")) |
110 | (root "/srv/http/lepiller/public") |
111 | (index '("index.$language_suffix.html" "index.html")) |
112 | (try-files '("$uri.$language_suffix.html" "$uri" "$uri/" "=404")) |
113 | (raw-content lepiller-policy)))) |
114 | (simple-service 'default-http-server nginx-service-type |
115 | (list (nginx-server-configuration |
116 | (ssl-certificate "/etc/letsencrypt/live/lepiller.eu/fullchain.pem") |
117 | (ssl-certificate-key "/etc/letsencrypt/live/lepiller.eu/privkey.pem") |
118 | (listen '("443 ssl http2" "[::]:443 ssl http2")) |
119 | (server-name '(default)) |
120 | (root "/srv/http/default") |
121 | (raw-content default-web-policy))))) |
122 | (lepiller-mail-services |
123 | #:interface "ens18" |
124 | #:domain "lepiller.eu") |
125 | (server-services "hermes")))) |
126 |