#+title: Configuration of the Aisaka computer -*- mode: org -*-
#+startup: overview
#+property: header-args:scheme :noweb yes
#+property: header-args:scheme+ :noweb-prefix yes

* TODO Guix

https://guix.gnu.org/en/manual/devel/en/html_node/

** TODO System configuration

https://guix.gnu.org/en/manual/devel/en/html_node/System-Configuration.html

#+begin_src scheme :noweb-ref system-dump :tangle system-configuration.scm
  (add-to-load-path "./services")

  (define-module (aisaka-system-configuration)
    #:use-module (gnu)
    #:use-module (gnu packages cups)
    #:use-module (gnu packages finance)
    #:use-module (gnu services cups)
    #:use-module (gnu services configuration)
    #:use-module (gnu services desktop)
    #:use-module (gnu services networking)
    #:use-module (gnu services ssh)
    #:use-module (gnu services version-control)
    #:use-module (gnu services xorg))

  (define keyboard-layout
    (keyboard-layout "pl"))

  (operating-system
   (locale "pl_PL.utf8")
   (timezone "Europe/Warsaw")
   (keyboard-layout keyboard-layout)
   (host-name "aisaka")
   (users (cons* (user-account (name "marek")
                               (comment "Marek Paśnikowski")
                               (group "users")
                               (home-directory "/home/marek")
                               (supplementary-groups '("audio"
                                                       "netdev"
                                                       "tor"
                                                       "video"
                                                       "wheel")))
                 %base-user-accounts))
   (packages
    (append
     (map
      <<to-package+output>>
      '("netcat-openbsd"
        "nss-certs"
        "ntfs-3g"))
     %base-packages))
   (services (cons* <<ssh-system-service>>
                    <<trezor-system-packages>>
                    (service cups-service-type
                             (cups-configuration (extensions `(,cups-filters
                                                               ,epson-inkjet-printer-escpr))
                                                 (web-interface? #t)))		  
                    (service git-daemon-service-type)
                    (service gnome-desktop-service-type)
                    (service tor-service-type
                             (tor-configuration (config-file (local-file "torrc"))
                                                (control-socket? #t)))
                    <<trezor-udev-rules>>
                    (modify-services %desktop-services
                                     (elogind-service-type
                                      configuration =>
                                      (elogind-configuration
                                       (inherit configuration)
                                       (handle-lid-switch 'ignore))))))
   (bootloader (bootloader-configuration (bootloader grub-bootloader)
                                         (targets '("/dev/sda"))
                                         (keyboard-layout keyboard-layout)))
   (swap-devices
    (list
     <<swap>>))
   (mapped-devices
    (list
     <<luks>>))
   (file-systems
    (append %base-file-systems
            (list
             <<rootfs>>
             <<bootfs>>))))
#+end_src

** TODO Home configuration

https://guix.gnu.org/en/manual/devel/en/html_node/Home-Configuration.html

#+begin_src scheme :noweb-ref home-dump :tangle home-configuration.scm
  (add-to-load-path "./services")

  (define-module (aisaka-home-configuration)
    #:use-module (gnu home)
    #:use-module (gnu home services)
    #:use-module (gnu home services shells)
    #:use-module (gnu packages)
    #:use-module (gnu services)
    #:use-module (guix gexp))

  (define allow-downgrades
    "--allow-downgrades ")

  (define config-prefix
    "/home/marek/src/guix-config/")

  (define pull-guix
    "guix pull ")

  (define pull-guix-
    (string-append pull-guix
                   allow-downgrades
                   "--disable-authentication "))

  (define guix-home
    "guix home reconfigure ")

  (define home-configuration
    "home-configuration.scm ")

  (define reconfigure-home
    (string-append guix-home
                   config-prefix
                   home-configuration))

  (define reconfigure-home-
    (string-append reconfigure-home
                   allow-downgrades))

  (define guix-system
    "sudo guix system reconfigure ")

  (define system-configuration
    "system-configuration.scm ")

  (define reconfigure-system
    (string-append guix-system
                   config-prefix
                   system-configuration))

  (define reconfigure-system-
    (string-append reconfigure-system
                   allow-downgrades))

  (define and
    "&& ")

  (define system-update
    (string-append pull-guix
                   and
                   reconfigure-system
                   and
                   reconfigure-home))

  (define system-update-
    (string-append pull-guix-
                   and
                   reconfigure-system-
                   and
                   reconfigure-home-))

  (home-environment
   (packages
    (map
     <<to-package+output>>
     '("adwaita-icon-theme"
       "alacritty"
       "clamav"
       "cpupower"
       "dconf-editor"
       "dmenu"                  
       "emacs"
       "emacs-aggressive-indent"
       "emacs-eldoc"
       "emacs-geiser"
       "emacs-geiser-guile"
       "emacs-nov-el"
       "emacs-org-contacts"
       "emacs-org-contrib"
       "font-google-noto"
       "git"
       "git-lfs"
       "gnome-tweaks"
       "gnupg"
       "guile"
       "guile-spec"
       "hicolor-icon-theme"
       "icecat"
       "jami"
       "libadwaita"
       "libreoffice"
       "nm-tray"
       "pwgen"
       "seahorse"
       "sicp"
       "strace"
       "unzip"
       "zip")))
   (services
    (list
     <<flashrom-package>>
     (service
      (service-type
       (name 'org-fc-tn-package)
       (extensions
        (list
         (service-extension home-profile-service-type
                            (lambda (_)
                              (map specification->package
                                   (list
                                    "emacs-org-fc-tn"))))))
       (description "Custom version of ORG-FC.")
       (default-value #f)))
     <<ssh-user-configuration>>
     <<trezor-user-packages>>
     (service home-bash-service-type
              (home-bash-configuration
               (environment-variables '(("EDITOR" . "emacs -nw")
                                        ("LIBGL_ALWAYS_SOFTWARE" . "1")
                                        ("NVM_DIR" . "$HOME/src/nvm")
                                        ("GUILE_AUTO_COMPILE" . "0")))
               (aliases `(("grep" . "grep --color=auto ")
                          ("ll" . "ls -l ")
                          ("ls" . "ls -p --color=auto ")
                          ("pull-guix" . ,pull-guix)
                          ("pull-guix-" . ,pull-guix-)
                          ("reconfigure-home" . ,reconfigure-home)
                          ("reconfigure-home-" . ,reconfigure-home-)
                          ("reconfigure-system" . ,reconfigure-system)
                          ("reconfigure-system-" . ,reconfigure-system-)
                          ("system-update" . ,system-update)
                          ("system-update-" . ,system-update-)))
               (bash-profile `(,(local-file "bash_profile")))
               (bashrc `(,(local-file "bashrc")))))
     (simple-service 'configuration-files
                     home-files-service-type
                     `((".config/git/config" ,(local-file "git.config"))
                       (".config/guix/shell-authorized-directories"
                        ,(local-file "guix-shell-authorized-directories"))
                       (".emacs" ,(local-file "emacs.el")))))))
#+end_src

* TODO LIBREBOOT

The first layer of computing is the firmware.  The Lenovo Thinkpad X200 has
a free Libreboot firmware installed.  It is a good idea to keep it up to date.

** TODO Flashrom

Flashrom program is needed to write the computer firmware.  The
program needs a relaxed kernel security feature.

#+begin_src scheme :noweb-ref flashrom-package
  (service
   (service-type
    (name 'flashrom-package)
    (extensions
     `(,(service-extension home-profile-service-type
                           (lambda (_)
                             (map specification->package
                                  '("flashrom"))))))
    (description "Flashrom installation.")
    (default-value #f)))
#+end_src

* TODO File Systems

This system has a very simple file system - a boot partition, main partition
for everything else and swap.  The main partition is encrypted.

** Mapped Devices

Data encryption layer, password protected.  The LUKS encryption type is
used.

#+begin_src scheme :noweb-ref luks
  (mapped-device
   (source (uuid "887ac37f-2919-41a0-a62a-e1ff5ea2d6cc"))
   (target "aisaka-root")
   (type luks-device-mapping))
#+end_src

** File Systems

The data is split into an unencrypted boot partition and encrypted root
filesystem.

*** Root File System

The root filesystem is mounted on the encryption layer.  Its type is
BTRFS.

#+begin_src scheme :noweb-ref rootfs
  (file-system
   (mount-point "/")
   (device "/dev/mapper/aisaka-root")
   (type "btrfs")
   (dependencies mapped-devices))
#+end_src

*** Boot File System

The boot partition is on EXT4 filesystem.

#+begin_src scheme :noweb-ref bootfs
  (file-system
   (mount-point "/boot")
   (device (uuid "4f77b5fc-56ad-43ae-b6ec-e5adc8c48587"))
   (type "ext4"))
#+end_src

** Swap Devices

Swap takes half the storage space in order to facilitate edge cases of
memory without overprovisioning, as well as to prolog the lifetime of SSD.

#+begin_src scheme :noweb-ref swap
  (swap-space (target (uuid "73bed3f9-be07-40ad-a228-577cd24f2e1d")))
#+end_src

* TODO System Servers

** TODO Secure Shell

*** TODO SSH Installation

#+begin_src scheme :noweb-ref ssh-system-service
  (service openssh-service-type)
#+end_src

*** TODO SSH Configuration

#+begin_src scheme :noweb-ref ssh-user-configuration
  (simple-service 'ssh-configuration* home-files-service-type
                  `((".ssh/config" ,(local-file "ssh.config"))))
#+end_src

* TODO Device Management

https://www.linuxfromscratch.org/lfs/view/11.1/chapter09/symlinks.html

** TODO Trezor

https://trezor.io/trezor-model-t

*** TODO Trezor System Packages

#+begin_src scheme :noweb-ref trezor-system-packages
  (service
   (service-type
    (name 'trezor-system-packages)
    (extensions
     (list
      (service-extension profile-service-type
                         (lambda (_)
                           (map specification->package
                                (list
                                 "trezord"
                                 "trezord-udev-rules"))))))
    (description "TrezorD packages needed by the system.")
    (default-value #f)))
#+end_src

*** TODO Trezor User Packages

#+begin_src scheme :noweb-ref trezor-user-packages
  (service
   (service-type
    (name 'trezor-user-packages)
    (extensions
     (list
      (service-extension home-profile-service-type
                         (lambda (_)
                           (map specification->package
                                (list
                                 "trezor-agent"))))))
    (description "Trezor packages for the user.")
    (default-value #f)))
#+end_src

*** TODO Trezor Udev Services

#+begin_src scheme :noweb-ref trezor-udev-rules
  (udev-rules-service 'trezord trezord-udev-rules)
#+end_src

* TODO Helpers
** TODO String to Package

#+begin_src scheme :noweb-ref to-package+output
  (compose list
           specification->package+output)
#+end_src