path: root/aisaka.org

#+title: Configuration of the Aisaka computer -*- mode: org -*-
#+startup: overview
#+property: header-args:scheme :noweb yes
#+property: header-args:scheme+ :noweb-prefix yes

* TODO Guix

https://guix.gnu.org/en/manual/devel/en/html_node/

** TODO System configuration

https://guix.gnu.org/en/manual/devel/en/html_node/System-Configuration.html

#+begin_src scheme :noweb-ref system-dump :tangle system-configuration.scm
  (add-to-load-path "./services")

  (define-module (aisaka-system-configuration)
    #:use-module (gnu)
    #:use-module (gnu packages cups)
    #:use-module (gnu packages finance)
    #:use-module (gnu services cups)
    #:use-module (gnu services configuration)
    #:use-module (gnu services desktop)
    #:use-module (gnu services networking)
    #:use-module (gnu services ssh)
    #:use-module (gnu services version-control)
    #:use-module (gnu services xorg))

  (define keyboard-layout
    (keyboard-layout "pl"))

  (operating-system
   (locale "pl_PL.utf8")
   (timezone "Europe/Warsaw")
   (keyboard-layout keyboard-layout)
   (host-name "aisaka")
   (users (cons* (user-account (name "marek")
                               (comment "Marek Paśnikowski")
                               (group "users")
                               (home-directory "/home/marek")
                               (supplementary-groups '("audio"
                                                       "netdev"
                                                       "tor"
                                                       "video"
                                                       "wheel")))
                 %base-user-accounts))
   (packages
    (append
     (map
      <<to-package+output>>
      '("netcat-openbsd"
        "nss-certs"
        "ntfs-3g"))
     %base-packages))
   (services (cons*
              <<ssh-system-service>>
              <<trezor-system-packages>>
              (service cups-service-type
                       (cups-configuration (extensions `(,cups-filters
                                                         ,epson-inkjet-printer-escpr))
                                           (web-interface? #t)))
              (service git-daemon-service-type)
              (service gnome-desktop-service-type)
              (service tor-service-type (tor-configuration
                                         (control-socket? #t)))
              <<trezor-udev-rules>>
              (modify-services %desktop-services
                               (elogind-service-type
                                configuration =>
                                (elogind-configuration
                                 (inherit configuration)
                                 (handle-lid-switch 'ignore))))))
   (bootloader (bootloader-configuration (bootloader grub-bootloader)
                                         (targets '("/dev/sda"))
                                         (keyboard-layout keyboard-layout)))
   (swap-devices
    (list
     <<swap>>))
   (mapped-devices
    (list
     <<luks>>))
   (file-systems
    (append %base-file-systems
            (list
             <<rootfs>>
             <<bootfs>>))))
#+end_src

** TODO Home configuration

https://guix.gnu.org/en/manual/devel/en/html_node/Home-Configuration.html

#+begin_src scheme :noweb-ref home-dump :tangle home-configuration.scm
  (add-to-load-path "./services")

  (define-module (aisaka-home-configuration)
    #:use-module (gnu home)
    #:use-module (gnu home services)
    #:use-module (gnu home services shells)
    #:use-module (gnu packages)
    #:use-module (gnu services)
    #:use-module (guix gexp))

  (define allow-downgrades
    "--allow-downgrades ")

  (define config-prefix
    "/home/marek/src/guix-config/")

  (define pull-guix
    "guix pull ")

  (define pull-guix-
    (string-append pull-guix
                   allow-downgrades
                   "--disable-authentication "))

  (define guix-home
    "guix home reconfigure ")

  (define home-configuration
    "home-configuration.scm ")

  (define reconfigure-home
    (string-append guix-home
                   config-prefix
                   home-configuration))

  (define reconfigure-home-
    (string-append reconfigure-home
                   allow-downgrades))

  (define guix-system
    "sudo guix system reconfigure ")

  (define system-configuration
    "system-configuration.scm ")

  (define reconfigure-system
    (string-append guix-system
                   config-prefix
                   system-configuration))

  (define reconfigure-system-
    (string-append reconfigure-system
                   allow-downgrades))

  (define and
    "&& ")

  (define system-update
    (string-append pull-guix
                   and
                   reconfigure-system
                   and
                   reconfigure-home))

  (define system-update-
    (string-append pull-guix-
                   and
                   reconfigure-system-
                   and
                   reconfigure-home-))

  (home-environment
   (packages
    (map
     <<to-package+output>>
     '("adwaita-icon-theme"
       "alacritty"
       "clamav"
       "cpupower"
       "dconf-editor"
       "dmenu"                  
       "emacs"
       "emacs-aggressive-indent"
       "emacs-eldoc"
       "emacs-geiser"
       "emacs-geiser-guile"
       "emacs-nov-el"
       "emacs-org-contacts"
       "emacs-org-contrib"
       "font-google-noto"
       "git"
       "git-lfs"
       "gnome-tweaks"
       "gnupg"
       "guile"
       "guile-spec"
       "hicolor-icon-theme"
       "icecat"
       "jami"
       "libadwaita"
       "libreoffice"
       "nm-tray"
       "pwgen"
       "seahorse"
       "sicp"
       "strace"
       "unzip"
       "zip")))
   (services
    (list
     <<flashrom-package>>
     (service
      (service-type
       (name 'org-fc-tn-package)
       (extensions
        (list
         (service-extension home-profile-service-type
                            (lambda (_)
                              (map specification->package
                                   (list
                                    "emacs-org-fc-tn"))))))
       (description "Custom version of ORG-FC.")
       (default-value #f)))
     <<ssh-user-configuration>>
     <<trezor-user-packages>>
     (service home-bash-service-type
              (home-bash-configuration
               (environment-variables '(("EDITOR" . "emacs -nw")
                                        ;; ("LIBGL_ALWAYS_SOFTWARE" . "1")
                                        ("GUILE_AUTO_COMPILE" . "0")))
               (aliases `(("grep" . "grep --color=auto ")
                          ("ll" . "ls -l ")
                          ("ls" . "ls -p --color=auto ")
                          ("pull-guix" . ,pull-guix)
                          ("pull-guix-" . ,pull-guix-)
                          ("reconfigure-home" . ,reconfigure-home)
                          ("reconfigure-home-" . ,reconfigure-home-)
                          ("reconfigure-system" . ,reconfigure-system)
                          ("reconfigure-system-" . ,reconfigure-system-)
                          ("system-update" . ,system-update)
                          ("system-update-" . ,system-update-)))
               (bashrc (list
                        (plain-file "bashrc" "<<ld-library-path>>")))))
     (simple-service 'configuration-files
                     home-files-service-type
                     `((".config/git/config" ,(plain-file "git-config" "\
  <<git-config>>\n"))
                       (".emacs" ,(plain-file "emacs" "\
  <<emacs-configuration>>\n")))))))
#+end_src

*** TODO bashrc

#+begin_src bash :noweb-ref ld-library-path
  export LD_LIBRARY_PATH=$LIBRARY_PATH
#+end_src

*** TODO emacs

#+begin_src elisp :noweb-ref emacs-configuration
  ;;; Disable auto-backup
  (setq-default make-backup-files nil)

  ;;; https://github.com/fimblo/dot.emacs
  ;;; Theme Activation
  (load-theme 'manoj-dark)

  ;;; https://elpa.gnu.org/packages/aggressive-indent.html
  ;;; Automatic Activation of Aggressive Indent
  (global-aggressive-indent-mode)

  ;; Highlight the pair of delimiters under the cursor
  (setq-default show-paren-mode 1
                show-paren-delay 0)

  ;;; https://guix.gnu.org/manual/en/html_node/The-Perfect-Setup.html
  ;;; Copyright Information
  (setq-default user-full-name \"Marek Paśnikowski\"
                user-mail-address \"marekpasnikowski@protonmail.com\")

  ;;; Startup Screen Inhibition
  (setq-default inhibit-startup-screen t)

  ;; Enable the column-80 line
  (setq-default display-fill-column-indicator 1
                display-fill-column-indicator-column 80)
  (global-display-fill-column-indicator-mode)

  ;; Prepare Literate Programming
  (setq-default
   org-startup-indented t
   org-confirm-babel-evaluate nil
   org-src-fontify-natively t
   org-src-tab-acts-natively t)
  (org-babel-do-load-languages 'org-babel-load-languages '((emacs-lisp . t)
                                                           (scheme . t )
                                                           (shell . t )))

  (add-to-list 'auto-mode-alist '(\"\\.epub\\'\" . nov-mode))

  ;; Monospace Font in Ebook Reader
  (setq-default nov-variable-pitch nil)

  ;; Disable Toolbar
  (tool-bar-mode -1)

  ;; GNUS Configuration
  (setq-default gnus-auto-select-first nil
                gnus-select-method '(nnnil \"\")
                gnus-secondary-select-methods '((nnimap \"outlook\"
                                                        (nnimap-address \"outlook.office365.com\")
                                                        (nnimap-server-port 993)
                                                        (nnimap-stream ssl)
                                                        (nnimap-authinfo-file \"~/.authinfo\"))
                                                (nnimap \"home\"
                                                        (nnimap-address \"serwer1930490.home.pl\")
                                                        (nnimap-server-port 993)
                                                        (nnimap-stream ssl)
                                                        (nnimap-authinfo-file \"~/.authinfo\")))
                nnmail-split-method 'nnmail-split-fancy
                nnmail-split-fancy '(| \"normal\"))
  (add-hook 'gnus-group-mode-hook 'gnus-topic-mode)

  ;; Org Configuration
  (setq-default org-contacts-files '(\"~/Dokumenty/UWM/filia w Ełku/Samorząd 2022/starostowie.org\"))

  ;; ORG-FC Configuration
  (require 'org-fc-hydra)
  (setq-default
   org-fc-algorithm 'tn
   org-fc-directories '(\"~/Dokumenty/fiszki\"))
#+end_src

*** TODO git-config

#+begin_src bash :noweb-ref git-config
  [user]
  name = \"Marek Paśnikowski\"
  email = \"marekpasnikowski@protonmail.com\"
#+end_src

* TODO LIBREBOOT

The first layer of computing is the firmware.  The Lenovo Thinkpad X200 has
a free Libreboot firmware installed.  It is a good idea to keep it up to date.

** TODO Flashrom

Flashrom program is needed to write the computer firmware.  The
program needs a relaxed kernel security feature.

#+begin_src scheme :noweb-ref flashrom-package
  (service
   (service-type
    (name 'flashrom-package)
    (extensions
     `(,(service-extension home-profile-service-type
                           (lambda (_)
                             (map specification->package
                                  '("flashrom"))))))
    (description "Flashrom installation.")
    (default-value #f)))
#+end_src

* TODO File Systems

This system has a very simple file system - a boot partition, main partition
for everything else and swap.  The main partition is encrypted.

** Mapped Devices

Data encryption layer, password protected.  The LUKS encryption type is
used.

#+begin_src scheme :noweb-ref luks
  (mapped-device
   (source (uuid "887ac37f-2919-41a0-a62a-e1ff5ea2d6cc"))
   (target "aisaka-root")
   (type luks-device-mapping))
#+end_src

** File Systems

The data is split into an unencrypted boot partition and encrypted root
filesystem.

*** Root File System

The root filesystem is mounted on the encryption layer.  Its type is
BTRFS.

#+begin_src scheme :noweb-ref rootfs
  (file-system
   (mount-point "/")
   (device "/dev/mapper/aisaka-root")
   (type "btrfs")
   (dependencies mapped-devices))
#+end_src

*** Boot File System

The boot partition is on EXT4 filesystem.

#+begin_src scheme :noweb-ref bootfs
  (file-system
   (mount-point "/boot")
   (device (uuid "4f77b5fc-56ad-43ae-b6ec-e5adc8c48587"))
   (type "ext4"))
#+end_src

** Swap Devices

Swap takes half the storage space in order to facilitate edge cases of
memory without overprovisioning, as well as to prolog the lifetime of SSD.

#+begin_src scheme :noweb-ref swap
  (swap-space (target (uuid "73bed3f9-be07-40ad-a228-577cd24f2e1d")))
#+end_src

* TODO System Servers

** TODO Secure Shell

*** TODO SSH Installation

#+begin_src scheme :noweb-ref ssh-system-service
  (service openssh-service-type)
#+end_src

*** TODO SSH Configuration

#+begin_src scheme :noweb-ref ssh-user-configuration
  (simple-service 'ssh-configuration* home-files-service-type
                  `((".ssh/config" ,(plain-file "ssh-config" "\
  <<ssh-config>>\n"))))
#+end_src

**** TODO SSH Configuration File

#+begin_src bash :noweb-ref ssh-config
  Host *.onion
  ProxyCommand nc -x localhost:9050 -X5 %h %p

  Host kynio.onion
  User kynio
  Hostname prnpi5oblk35gzcihbgu3227xvanisouxgbejri57bnzjawcksq4l7yd.onion
  Port 22
#+end_src

* TODO Device Management

https://www.linuxfromscratch.org/lfs/view/11.1/chapter09/symlinks.html

** TODO Trezor

https://trezor.io/trezor-model-t

*** TODO Trezor System Packages

#+begin_src scheme :noweb-ref trezor-system-packages
  (service
   (service-type
    (name 'trezor-system-packages)
    (extensions
     (list
      (service-extension profile-service-type
                         (lambda (_)
                           (map specification->package
                                (list
                                 "trezord"
                                 "trezord-udev-rules"))))))
    (description "TrezorD packages needed by the system.")
    (default-value #f)))
#+end_src

*** TODO Trezor User Packages

#+begin_src scheme :noweb-ref trezor-user-packages
  (service
   (service-type
    (name 'trezor-user-packages)
    (extensions
     (list
      (service-extension home-profile-service-type
                         (lambda (_)
                           (map specification->package
                                (list
                                 "trezor-agent"))))))
    (description "Trezor packages for the user.")
    (default-value #f)))
#+end_src

*** TODO Trezor Udev Services

#+begin_src scheme :noweb-ref trezor-udev-rules
  (udev-rules-service 'trezord trezord-udev-rules)
#+end_src

* TODO Helpers
** TODO String to Package

#+begin_src scheme :noweb-ref to-package+output
  (compose list
           specification->package+output)
#+end_src