diff options
Diffstat (limited to 'deployment/services')
| -rw-r--r-- | deployment/services/certbot.scm | 82 | ||||
| -rw-r--r-- | deployment/services/cgit.scm | 94 | ||||
| -rw-r--r-- | deployment/services/databases.scm | 63 | ||||
| -rw-r--r-- | deployment/services/dns.scm | 83 | ||||
| -rw-r--r-- | deployment/services/mail.scm | 177 | ||||
| -rw-r--r-- | deployment/services/matrix.scm | 80 | ||||
| -rw-r--r-- | deployment/services/networking.scm | 28 | ||||
| -rw-r--r-- | deployment/services/nfs.scm | 95 | ||||
| -rw-r--r-- | deployment/services/version-control.scm | 33 | ||||
| -rw-r--r-- | deployment/services/vpn.scm | 115 | ||||
| -rw-r--r-- | deployment/services/web.scm | 182 |
11 files changed, 1032 insertions, 0 deletions
diff --git a/deployment/services/certbot.scm b/deployment/services/certbot.scm new file mode 100644 index 0000000..17fa421 --- /dev/null +++ b/deployment/services/certbot.scm @@ -0,0 +1,82 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services certbot) + #:export (aisaka-certbot-service) + #:use-module (gnu services) + #:use-module (gnu services certbot) + #:use-module (guix gexp) + #:use-module ((deployment services web) + #:prefix deployment:services:web:) + #:use-module ((gnu services web) + #:prefix gnu:services:web:)) + +(define nginx-extension-of-certbot + (service-extension deployment:services:web:nginx-service-type* + (@@ (gnu services certbot) + certbot-nginx-server-configurations))) + +(define (extend-certbot extension) + (let* + ((extension-target- (service-extension-target extension)) + (nginx-service-type?- (eq? extension-target- + gnu:services:web:nginx-service-type))) + (if nginx-service-type?- + nginx-extension-of-certbot + extension))) + +(define certbot-type + (let + ((certbot-extensions- (service-type-extensions certbot-service-type))) + (service-type + (inherit certbot-service-type) + (extensions (map extend-certbot + certbot-extensions-))))) + +(define nginx-deploy-hook-file + #~(let + ((pid (call-with-input-file "/var/run/nginx/pid" + read))) + (kill pid + SIGHUP))) + +(define aisaka-certificate-configuration + (certificate-configuration + (deploy-hook (program-file "nginx-deploy-hook" + nginx-deploy-hook-file)) + (domains (list "marekpasnikowski.pl" + "git.marekpasnikowski.pl" + "guix.marekpasnikowski.pl" + "matrix.marekpasnikowski.pl" + ;; "mx.marekpasnikowski.pl" + "radicale.marekpasnikowski.pl" + "www.marekpasnikowski.pl")))) + +(define aisaka-certbot-configuration + (certbot-configuration + (certificates (list aisaka-certificate-configuration)) + (email "marek@marekpasnikowski.pl") + (webroot "/srv/www/marek/marekpasnikowski.pl"))) + +(define aisaka-certbot-service + (service certbot-type + aisaka-certbot-configuration)) + +;;; EOF diff --git a/deployment/services/cgit.scm b/deployment/services/cgit.scm new file mode 100644 index 0000000..6bdf812 --- /dev/null +++ b/deployment/services/cgit.scm @@ -0,0 +1,94 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services cgit) + #:export (aisaka-cgit-service) + #:use-module (gnu services) + #:use-module (gnu services cgit) + #:use-module (gnu services web) + #:use-module ((deployment services version-control) + #:prefix deployment:services:version-control:) + #:use-module ((deployment services web) + #:prefix deployment:services:web:) + #:use-module ((gnu packages version-control) + #:prefix gnu:packages:version-control:) + #:use-module ((gnu services version-control) + #:prefix gnu:services:version-control:)) + +(define cgit-repository-configuration + (repository-cgit-configuration + (hide? #t) + (path "/srv/git/marek/packages"))) + +(define nginx-location-cgit + (nginx-location-configuration + (body (list "fastcgi_param HTTP_HOST $server_name ;" + "fastcgi_param PATH_INFO $uri ;" + "fastcgi_param QUERY_STRING $args ;" + "fastcgi_param SCRIPT_FILENAME $document_root/lib/cgit/cgit.cgi ;" + "fastcgi_pass 127.0.0.1:9000 ;")) + (uri "@cgit"))) + +(define nginx-server-cgit + (nginx-server-configuration + (locations (list deployment:services:version-control:aisaka-git-http-nginx-location + nginx-location-cgit + deployment:services:web:nginx-location-well-known)) + (listen (list "192.168.10.2:443 ssl")) + (root gnu:packages:version-control:cgit) + (server-name (list "git.marekpasnikowski.pl")) + (ssl-certificate "/etc/letsencrypt/live/marekpasnikowski.pl/fullchain.pem") + (ssl-certificate-key "/etc/letsencrypt/live/marekpasnikowski.pl/privkey.pem") + (try-files (list "$uri" "@cgit")))) + +(define nginx-extension-of-cgit + (service-extension deployment:services:web:nginx-service-type* + cgit-configuration-nginx-config)) + +(define (extend-cgit extension) + (let* + ((extension-target- (service-extension-target extension)) + (nginx-service-type?- (eq? extension-target- + nginx-service-type))) + (if nginx-service-type?- + nginx-extension-of-cgit + extension))) + +(define cgit-type + (let + ((cgit-extensions- (service-type-extensions cgit-service-type))) + (service-type + (inherit cgit-service-type) + (extensions (map extend-cgit + cgit-extensions-))))) + +(define aisaka-cgit-configuration + (cgit-configuration + (nginx (list nginx-server-cgit)) + (repositories (list cgit-repository-configuration)) + (project-list (list "deployment.git" + "sovereign.git")) + (repository-directory "/var/lib/gitolite/repositories"))) + +(define-public aisaka-cgit-service + (service cgit-type + aisaka-cgit-configuration)) + +;;; EOF diff --git a/deployment/services/databases.scm b/deployment/services/databases.scm new file mode 100644 index 0000000..7451477 --- /dev/null +++ b/deployment/services/databases.scm @@ -0,0 +1,63 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services databases) + #:use-module (gnu services) + #:use-module (gnu services databases) + #:use-module (guix gexp) + #:use-module ((gnu packages databases) + #:prefix gnu:packages:databases:) + #:export (matrix-postgresql-service)) + +(define postgres-hba + (mixed-text-file "pg_hba.conf" + "host synapse synapse_user 127.0.0.1/32 trust\n" + "host synapse synapse_user ::1/128 trust\n" + "local all all peer\n" + "host all all 127.0.0.1/32 md5\n" + "host all all ::1/128 md5\n")) + +(define config-file + (postgresql-config-file + (log-destination "syslog") + (hba-file postgres-hba) + (ident-file (@@ (gnu services databases) + %default-postgres-ident)) + (socket-directory "/var/run/postgresql") + (extra-config (list)))) + +(define matrix-postgresql-service-configuration + (postgresql-configuration + (postgresql gnu:packages:databases:postgresql-17) + (port 5432) + (locale "pl_PL.utf8") + (config-file config-file) + (log-directory "/var/log/postgresql") + (data-directory "/var/lib/postgresql/data") + (extension-packages (list)) + (create-account? #t) + (home-directory "/var/lib/postgresql") + (allow-login? #t) + (uid 501) + (gid 501))) + +(define matrix-postgresql-service + (service postgresql-service-type + matrix-postgresql-service-configuration)) diff --git a/deployment/services/dns.scm b/deployment/services/dns.scm new file mode 100644 index 0000000..3b423b0 --- /dev/null +++ b/deployment/services/dns.scm @@ -0,0 +1,83 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services dns) + #:export (knot-service-aisaka + wireguard-endpoint) + #:use-module (gnu services) + #:use-module (gnu services dns)) + +(define ip-multimedia "81.190.248.246") + +(define ip-otvarta "95.171.119.109") + +(define ttl "3600") + +(define spf-value + (string-append "\"v=spf1 ip4:" + ip-otvarta + " -all\"")) + +(define wireguard-endpoint + (string-append ip-multimedia + ":51820")) + +(define-zone-entries marekpasnikowski.pl-entries + ("@" ttl "IN" "A" ip-otvarta) + ("1" ttl "IN" "A" ip-otvarta) + ("ns1" ttl "IN" "A" ip-otvarta) + ("@" ttl "IN" "NS" "ns1.marekpasnikowski.pl.") + ("@" ttl "IN" "A" ip-multimedia) + ("2" ttl "IN" "A" ip-multimedia) + ("ns2" ttl "IN" "A" ip-multimedia) + ("@" ttl "IN" "NS" "ns2.marekpasnikowski.pl.") + ("@" ttl "IN" "MX" "10 1.marekpasnikowski.pl.") + ("@" ttl "IN" "TXT" spf-value) + ("_caldavs._tcp" ttl "IN" "SRV" "10 0 443 radicale.marekpasnikowski.pl") + ("_carddavs._tcp" ttl "IN" "SRV" "10 0 443 radicale.marekpasnikowski.pl") + ("_dmarc" ttl "IN" "TXT" "\"adkim=s; aspf=s; p=reject; pct=100; sp=reject; v=DMARC1\"") + ("dkim._domainkey" ttl "IN" "TXT" "\"v=DKIM1; d=marekpasnikowski.pl; t=s; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo/b/WV5EUxqAhBgJ4v5K3sP8QI+IwziRJ/F9SDO3p3QOMjZd9AGVt2/AztZ4EmcOJnTlbQnLE/DKCOq4HAdxSZjIqj5AXyMddvWiO78+ugdame/flV0tjdDGNflx65Twap3qgJ9jzhvJfZ1BDuh2WC06fn2pyFl1TCETEGp6ZDkI41FW5GH8l9Jk7hhCmr+Mau0EpE7V42lBdireItOA1e7jQcub50584QATme4rYxA7WR4AeIsknOkUo4q8vkVrssoP11nSg/sNM9RGn1QDfVMJRX0twtgGnJ8N5QE4Ia9DvXL4Y0PNMC0/frp13pB6m1VQP/Z4jfDy+TQzEdSRaQIDAQAB\"") + ("git" ttl "IN" "CNAME" "2") + ("guix" ttl "IN" "CNAME" "2") + ("matrix" ttl "IN" "CNAME" "2") + ("radicale" ttl "IN" "CNAME" "2") + ("www" ttl "IN" "CNAME" "2")) + +(define marekpasnikowski.pl-zone + (zone-file + (entries marekpasnikowski.pl-entries) + (origin "marekpasnikowski.pl") + (ns "ns1.marekpasnikowski.pl.") + (mail "marek.marekpasnikowski.pl.") + (serial 2026042801))) + +(define aisaka-master-zone + (knot-zone-configuration + (domain "marekpasnikowski.pl") + (zone marekpasnikowski.pl-zone))) + +(define aisaka-knot-configuration + (knot-configuration + (listen-v4 "0.0.0.0") + (zones (list aisaka-master-zone)))) + +(define knot-service-aisaka + (service knot-service-type + aisaka-knot-configuration)) diff --git a/deployment/services/mail.scm b/deployment/services/mail.scm new file mode 100644 index 0000000..0101de9 --- /dev/null +++ b/deployment/services/mail.scm @@ -0,0 +1,177 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2019 Julien Lepiller <julien@lepiller.eu> +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2019, Julien Lepiller <julien@lepiller.eu> +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services mail) + #:export (dkimproxy-out-service + etc-mailname-aisaka + smtp-service-aisaka) + #:use-module (gnu services) + #:use-module (gnu services mail) + #:use-module (guix gexp) + #:use-module (sovereign services mail) + #:use-module ((gnu packages mail) + #:prefix gnu:packages:mail:)) + +(define dkimproxy-out-signature-configuration-marekpasnikowski.pl-dkim + (dkimproxy-out-signature-configuration + (algorithm "rsa-sha256") + (key "/etc/mail/dkim/marekpasnikowski.pl.key") + (method "relaxed") + (selector "dkim") + (type 'dkim))) + +(define dkimproxy-out-signature-configuration-marekpasnikowski.pl-domainkeys + (dkimproxy-out-signature-configuration + (method "mofws") + (type 'domainkeys))) + +(define dkimproxy-out-signature-configurations-marekpasnikowski.pl + (list dkimproxy-out-signature-configuration-marekpasnikowski.pl-dkim + dkimproxy-out-signature-configuration-marekpasnikowski.pl-domainkeys)) + +(define dkimproxy-out-configuration-sender-map-marekpasnikowski.pl + (list "marekpasnikowski.pl" + dkimproxy-out-signature-configurations-marekpasnikowski.pl)) + +(define dkimproxy-out-configuration-marekpasnikowski.pl + (dkimproxy-out-configuration + (listen "127.0.0.1:10027") + (relay "127.0.0.1:10028") + (sender-map (list dkimproxy-out-configuration-sender-map-marekpasnikowski.pl)))) + +(define dkimproxy-out-service + (service dkimproxy-out-service-type + dkimproxy-out-configuration-marekpasnikowski.pl)) + +(define aliases-file + (mixed-text-file "aliases" + "@ vmail\n")) + +(define blacklist-file + (mixed-text-file "blacklist" + "@yahoo.com.cn\n" + "@qq.com\n" + "@fnac.com\n" + "@just-aero.us\n" + "@elitetorrent1.com\n")) + +(define relays-file + (mixed-text-file "other-relays" + "mx1.forwardemail.net\n" + "mx2.forwardemail.net\n")) + +(define smtpd-keys "/secrets/smtpd") + +(define (smtpd-conf interface domain) + (mixed-text-file "smtpd.conf" + "# This is the smtpd server system-wide configuration file.\n" + "# See smtpd.conf(5) for more information.\n" + "\n" + "# My TLS certificate and key\n" + "pki marekpasnikowski.pl cert \"/etc/letsencrypt/live/" domain "/fullchain.pem\"\n" + "pki marekpasnikowski.pl key \"/etc/letsencrypt/live/" domain "/privkey.pem\"\n" + "\n" + "# Edit this file to add add more virtual users (passwords are read in that file\n" + "# instead of /etc/passwd\n" + "table passwd file:" smtpd-keys "\n" + "\n" + "# table other-relays file:" relays-file "\n" + "table blacklist file:" blacklist-file "\n" + "\n" + "# A simple spam filter\n" + "# filter spam-filter phase mail-from match mail-from <blacklist> reject \"555\"\n" + "\n" + "# port 25 is used only for receiving from external servers, and they may start\n" + "# a TLS session if they want.\n" + "listen on " interface " port 25 # tls pki marekpasnikowski.pl filter spam-filter\n" + "\n" + "# For sending messages from outside of this server, you need to authenticate and\n" + "# use TLS.\n" + "listen on " interface " port 465 smtps pki marekpasnikowski.pl mask-src auth <passwd>\n" + "\n" + "# Localhost is used by the .onion, so we use the same configuration for \n" + "# local connections." + "listen on lo port 25 tls pki marekpasnikowski.pl filter spam-filter\n" + "# Since incoming connection uses tor, we don't need tls, but still require\n" + "# authentication; we're not a relay\n" + "# listen on lo port 587 tls pki marekpasnikowski.pl mask-src auth <passwd>\n" + "\n" + "# DKIMproxy\n" + "listen on lo port 10028 tag DKIM_OUT\n" + "\n" + "# The socket is considered an internal connection\n" + "listen on socket mask-src\n" + "\n" + "# Maybe it'll work better if we connect to gmail only with v4?\n" + "# limit mta for domain gmail.com inet4\n" + "\n" + "# TODO: manage these files directly in the configuration?\n" + "# If you edit the file, you have to run \"smtpctl update table aliases\"\n" + "table aliases file:" aliases-file "\n" + "\n" + "# We define some actions\n" + "action receive lmtp \"/var/run/dovecot/lmtp\" rcpt-to virtual <aliases>\n" + "action godkim relay host smtp://localhost:10027\n" + "action outbound relay src \"192.168.1.2\" helo " domain "\n" + "\n" + "# We accept to relay any mail from authenticated users\n" + "match for any from any auth action godkim\n" + "match tag DKIM_OUT for any action outbound\n" + "\n" + "# Then, we reject on some other conditions:\n" + "\n" + "# If the mail tries to impersonate us\n" + "# match !from src <other-relays> mail-from \"@marekpasnikowski.pl\" for any reject\n" + "\n" + "# If it comes from someone on the blacklist\n" + "match from any mail-from <blacklist> reject\n" + "\n" + "# Finally, if we accept incoming messages\n" + "match from any for domain \"marekpasnikowski.pl\" action receive\n" + "match for local action receive\n" )) + +(define opensmtpd-configuration-aisaka + (opensmtpd-configuration + (package gnu:packages:mail:opensmtpd) + (shepherd-requirement (list 'dkimproxy-out + 'networking)) + (config-file (smtpd-conf "enp2s0" + "marekpasnikowski.pl")) + (log-file "/val/log/mail.log") + (setgid-commands? #t))) + +(define etc-mailname-aisaka + (let* + ((file (plain-file "mailname-aisaka" + "marekpasnikowski.pl\n")) + (mailname (list "mailname" + file)) + (links (list mailname))) + (simple-service 'etc-mailname + etc-service-type + links))) + +(define smtp-service-aisaka + (service opensmtpd-service-type + opensmtpd-configuration-aisaka)) + +;;; EOF diff --git a/deployment/services/matrix.scm b/deployment/services/matrix.scm new file mode 100644 index 0000000..aeac883 --- /dev/null +++ b/deployment/services/matrix.scm @@ -0,0 +1,80 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services matrix) + #:use-module (gnu services) + #:use-module (guix gexp) + #:use-module (sovereign services matrix) + #:use-module ((gnu packages matrix) + #:prefix gnu:packages:matrix:) + #:export (matrix-service-aisaka + matrix-service-rakan)) + +(define matrix-service-aisaka + (service matrix-service-type)) + +(define homeserver-configuration-file-rakan + (mixed-text-file "homeserver.yaml" + "# Configuration file for Synapse.\n" + "#\n" + "# This is a YAML file: see [1] for a quick introduction. Note in particular\n" + "# that *indentation is important*: all the elements of a list or dictionary\n" + "# should have the same indentation." + "#\n" + "# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html\n" + "# For more information on how to configura Synapse, including a complete accounting of\n" + "# each option, go to docs/usage/configuratoin/config_documentation.md or\n" + "# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html\n" + "server_name: \"marekpasnikowski.pl\"\n" + "pid_file: /home/matrix/data/homeserver.pid\n" + "listeners:\n" + " - port: 8008\n" + " tls: false\n" + " type: http\n" + " x_forwarded: true\n" + " bind_addresses: ['::1', '127.0.0.1']\n" + " resources:\n" + " - names: [client]\n" + " compress: false\n" + "database:\n" + " name: sqlite3\n" + " args:\n" + " database: /home/matrix/data/homeserver.db\n" + "log_config: \"/home/matrix/keys/marekpasnikowski.pl.log.config\"\n" + "media_store_path: /home/matrix/data/media_store\n" + "registration_shared_secret: /home/matrix/keys/registration_shared_secret\n" + "report_stats: false\n" + "macaroon_secret_key: /home/matrix/keys/macaroon_secret_key\n" + "form_secret: /home/matrix/keys/form_secret\n" + "signing_key_path: \"/home/matrix/keys/marekpasnikowski.pl.signing.key\"\n" + "trusted_key_servers:\n" + " - server_name: \"matrix.org\"\n" + "\n" + "\n" + "# vim:ft=yaml\n")) + +(define matrix-configuration-rakan + (matrix-configuration + (package gnu:packages:matrix:synapse) + (homeserver-yaml homeserver-configuration-file-rakan))) + +(define matrix-service-rakan + (service matrix-service-type + matrix-configuration-rakan)) diff --git a/deployment/services/networking.scm b/deployment/services/networking.scm new file mode 100644 index 0000000..a205fc4 --- /dev/null +++ b/deployment/services/networking.scm @@ -0,0 +1,28 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services networking) + #:export (network-online-service-aisaka) + #:use-module ((sovereign services networking) + #:prefix sovereign:services:networking:)) + +(define network-online-service-aisaka sovereign:services:networking:network-online-throwaway-service) + +;;; EOF diff --git a/deployment/services/nfs.scm b/deployment/services/nfs.scm new file mode 100644 index 0000000..2e9336b --- /dev/null +++ b/deployment/services/nfs.scm @@ -0,0 +1,95 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services nfs) + #:export (autofs-aisaka_service + autofs-akashi_service + autofs-rakan_service-record + nfs-akashi_service + nfs-rakan_service-record + service-nfs-aisaka) + #:use-module (gnu services nfs) + #:use-module (sovereign services nfs)) + +(define autofs-indirect-map/mnt_record + (autofs-indirect-map + (inherit %autofs-indirect-map/mnt_record) + (entries (list (autofs-map-entry + (inherit %autofs-map-entry/nfs_record) + (device "10.0.0.1:/home/marek/Szablony") + (mount-point "szablony")) + (autofs-map-entry + (inherit %autofs-map-entry/nfs_record) + (device "10.0.0.1:/home/marek/Dokumenty") + (mount-point "dokumenty")))))) + +(define autofs-aisaka_record + (autofs-configuration + (inherit %autofs-configuration_record) + (mounts (list autofs-indirect-map/mnt_record)))) + +(define autofs-akashi_record + (autofs-configuration + (inherit %autofs-configuration_record) + (mounts (list autofs-indirect-map/mnt_record)))) + +(define autofs-rakan_configuration-record + (autofs-configuration + (inherit %autofs-configuration_record) + (mounts (list autofs-indirect-map/mnt_record)))) + +(define nfs-server-aisaka + (let + ((Export-Dokumenty (list "/home/marek/Dokumenty" + "10.0.0.0/24(rw)")) + (Export-Szablony (list "/home/marek/Szablony" + "10.0.0.0/24(rw)"))) + (nfs-configuration + (inherit %nfs-configuration) + (exports (list Export-Dokumenty + Export-Szablony))))) + +(define nfs-client-akashi + (nfs-configuration + (inherit %nfs-configuration))) + +(define nfs-rakan_service-record + (nfs-configuration + (inherit %nfs-configuration))) + +(define autofs-aisaka_service + (autofs_proc autofs-aisaka_record)) + +(define autofs-akashi_service + (autofs_proc autofs-akashi_record)) + +(define autofs-rakan_service-record + (autofs_proc autofs-rakan_configuration-record)) + +(define service-nfs-aisaka + (service-nfs nfs-server-aisaka)) + +(define nfs-akashi_service + (service-nfs nfs-client-akashi)) + +(define nfs-rakan_service-record + (service-nfs nfs-rakan_service-record)) + +;;; EOF diff --git a/deployment/services/version-control.scm b/deployment/services/version-control.scm new file mode 100644 index 0000000..3c89c05 --- /dev/null +++ b/deployment/services/version-control.scm @@ -0,0 +1,33 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services version-control) + #:export (aisaka-git-http-nginx-location) + #:use-module (gnu services version-control)) + +(define aisaka-git-http-configuration + (git-http-configuration + (git-root "/var/lib/gitolite/repositories") + (uri-path "/git"))) + +(define-public aisaka-git-http-nginx-location + (git-http-nginx-location-configuration aisaka-git-http-configuration)) + +;;; EOF diff --git a/deployment/services/vpn.scm b/deployment/services/vpn.scm new file mode 100644 index 0000000..53a7623 --- /dev/null +++ b/deployment/services/vpn.scm @@ -0,0 +1,115 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services vpn) + #:export (wireguard-service-aisaka + wireguard-service-akashi + wireguard-service-ayase + wireguard-service-giewont + wireguard-service-rakan) + #:use-module (gnu services) + #:use-module (gnu services vpn) + #:use-module (sovereign services vpn) + #:use-module ((deployment services dns) + #:prefix deployment:services:dns:)) + +(define wireguard-peer-aisaka + (wireguard-peer + (inherit %wireguard-peer) + (name "aisaka") + (endpoint deployment:services:dns:wireguard-endpoint) + (public-key "7B6fgIKVZs6DWN3hdDGlYI8XpvHWGCjZKh6kbY/KKg8="))) + +(define wireguard-peer-akashi + (wireguard-peer + (inherit %wireguard-peer) + (name "akashi") + (public-key "p0X7zaemU0NyuJ+UiKVZ/4HfC8vj5z9kJK9j/iJDwT8=") + (allowed-ips (list "10.0.0.4/32")))) + +(define wireguard-peer-ayase + (wireguard-peer + (inherit %wireguard-peer) + (name "ayase") + (public-key "mzz5aZ0TLPj1WNK+PqpPILlUn16i371OGWVwuU0iDnQ=") + (allowed-ips (list "10.0.0.5/32")))) + +(define wireguard-peer-giewont + (wireguard-peer + (inherit %wireguard-peer) + (name "giewont") + (public-key "/XsuEpAHX1iEc5abcmY9sYTx8qETAuSLjEmx5ekqfwM=") + (allowed-ips (list "10.0.0.2/32")))) + +(define wireguard-peer-rakan + (wireguard-peer + (inherit %wireguard-peer) + (name "rakan") + (public-key "vOEJivgw9C7wZwYX3Kiqw3Ycl6wErr8N9z3BmkhF0Us=") + (allowed-ips (list "10.0.0.3/32")))) + +(define wireguard-configuration-aisaka + (wireguard-configuration + (inherit %wireguard-configuration) + (peers (list wireguard-peer-akashi + wireguard-peer-ayase + wireguard-peer-giewont + wireguard-peer-rakan)))) + +(define wireguard-configuration-akashi + (wireguard-configuration + (inherit %wireguard-configuration) + (addresses (list "10.0.0.4/24")) + (peers (list wireguard-peer-aisaka)))) + +(define wireguard-configuration-ayase + (wireguard-configuration + (inherit %wireguard-configuration) + (addresses (list "10.0.0.5/24")) + (peers (list wireguard-peer-aisaka)))) + +(define wireguard-configuration-giewont + (wireguard-configuration + (inherit %wireguard-configuration) + (addresses (list "10.0.0.2/24")) + (peers (list wireguard-peer-aisaka)))) + +(define wireguard-configuration-rakan + (wireguard-configuration + (inherit %wireguard-configuration) + (addresses (list "10.0.0.3/24")) + (peers (list wireguard-peer-aisaka)))) + +(define wireguard-service-aisaka + (wireguard-service wireguard-configuration-aisaka)) + +(define wireguard-service-akashi + (wireguard-service wireguard-configuration-akashi)) + +(define wireguard-service-ayase + (wireguard-service wireguard-configuration-ayase)) + +(define wireguard-service-giewont + (wireguard-service wireguard-configuration-giewont)) + +(define wireguard-service-rakan + (wireguard-service wireguard-configuration-rakan)) + +;;; EOF diff --git a/deployment/services/web.scm b/deployment/services/web.scm new file mode 100644 index 0000000..b076056 --- /dev/null +++ b/deployment/services/web.scm @@ -0,0 +1,182 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services web) + #:export (fcgiwrap-service-aisaka + nginx-service-aisaka + nginx-location-well-known + nginx-service-type*) + #:use-module (gnu services) + #:use-module (gnu services web) + #:use-module (guix gexp) + #:use-module ((gnu packages matrix) + #:prefix gnu:packages:matrix:) + #:use-module ((gnu packages web) + #:prefix gnu:packages:web:) + #:use-module ((gnu system shadow) + #:prefix gnu:system:shadow:) + #:use-module ((sovereign system accounts) + #:prefix sovereign:system:accounts:)) + +(define fcgiwrap-configuration-aisaka + (fcgiwrap-configuration + (package gnu:packages:web:fcgiwrap) + (socket "tcp:127.0.0.1:9000") + (user "git") + (group "git"))) + +(define fcgiwrap-service-aisaka + (service + fcgiwrap-service-type + fcgiwrap-configuration-aisaka)) + +(define nginx-accounts + (let + ((accounts- (list sovereign:system:accounts:nginx-group + sovereign:system:accounts:nginx-account))) + (const accounts-))) + +(define nginx-extension-of-account + (service-extension gnu:system:shadow:account-service-type + nginx-accounts)) + +(define (extend-account extension) + (let* + ((extension-target- (service-extension-target extension)) + (account-service-type?- (eq? extension-target- + gnu:system:shadow:account-service-type))) + (if account-service-type?- + nginx-extension-of-account + extension))) + +(define nginx-service-type* + (let + ((nginx-extensions- (service-type-extensions nginx-service-type))) + (service-type + (inherit nginx-service-type) + (extensions (map extend-account + nginx-extensions-))))) + +(define nginx-location-proxy-guix + (nginx-location-configuration + (body (list "proxy_pass http://localhost:8080/ ;" + "proxy_set_header X-Script-Name \"\" ;" + "proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for ;" + "proxy_set_header Host $http_host ;" + "proxy_pass_header Authorization ;")) + (uri "/"))) + +(define nginx-location-proxy-matrix + (nginx-location-configuration + (body (list "proxy_pass http://localhost:8008 ;" + "proxy_set_header X-Forwarded-For $remote_addr ;" + "proxy_set_header X-Forwarded-Proto $scheme ;" + "proxy_set_header Host $host:$server_port ;" + "client_max_body_size 1024M ;")) + (uri "~ ^(/_matrix|/_synapse/client)"))) + +(define nginx-location-proxy-radicale + (nginx-location-configuration + (body (list "proxy_pass http://localhost:5232/ ;" + "proxy_set_header X-Script-Name \"\" ;" + "proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for ;" + "proxy_set_header Host $http_host ;" + "proxy_pass_header Authorization ;")) + (uri "/"))) + +(define nginx-location-proxy-auth + (nginx-location-configuration + (body (list "proxy_set_header Host $host;" + "proxy_set_header X-Real-IP $remote_addr;" + "proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;" + "proxy_set_header X-Forwarded-Proto $scheme;" + "if ($ssl_client_verify != SUCCESS) {return 403;}")) + (uri "/"))) + +(define nginx-location-well-known + (nginx-location-configuration + (body (list "root /srv/www/marek/marekpasnikowski.pl ;")) + (uri "/.well-known"))) + +(define nginx-location-well-known-matrix-client + (nginx-location-configuration + (body (list "return 200 '{\"m.homeserver\": {\"base_url\": \"https://matrix.marekpasnikowski.pl\"}}' ;" + "default_type application/json ;" + "add_header Access-Control-Allow-Origin * ;")) + (uri "/.well-known/matrix/client"))) + +(define nginx-server-guix + (nginx-server-configuration + (locations (list nginx-location-proxy-guix)) + (listen (list "192.168.10.2:443 ssl")) + (server-name (list "guix.marekpasnikowski.pl")) + (ssl-certificate "/etc/letsencrypt/live/marekpasnikowski.pl/fullchain.pem") + (ssl-certificate-key "/etc/letsencrypt/live/marekpasnikowski.pl/privkey.pem"))) + +(define nginx-server-matrix + (nginx-server-configuration + (locations (list nginx-location-proxy-matrix)) + (listen (list "192.168.10.2:443 ssl" + "192.168.10.2:8448 ssl default_server")) + (root (file-append gnu:packages:matrix:synapse + "/lib/python3.11/site-packages/synapse/static")) + (server-name (list "matrix.marekpasnikowski.pl")) + (ssl-certificate "/etc/letsencrypt/live/marekpasnikowski.pl/fullchain.pem") + (ssl-certificate-key "/etc/letsencrypt/live/marekpasnikowski.pl/privkey.pem") + (raw-content (list "proxy_http_version 1.1 ;")))) + +(define nginx-server-portal + (nginx-server-configuration + (locations (list nginx-location-well-known + nginx-location-well-known-matrix-client)) + (listen (list "192.168.10.2:443 ssl")) + (root "/srv/www/marek/marekpasnikowski.pl") + (server-name (list 'default + "marekpasnikowski.pl")) + (ssl-certificate "/etc/letsencrypt/live/marekpasnikowski.pl/fullchain.pem") + (ssl-certificate-key "/etc/letsencrypt/live/marekpasnikowski.pl/privkey.pem"))) + +(define nginx-server-radicale + (nginx-server-configuration + (locations (list nginx-location-proxy-radicale + nginx-location-well-known)) + (listen (list "192.168.10.2:443 ssl")) + (server-name (list "radicale.marekpasnikowski.pl")))) + +(define nginx-server-www + (nginx-server-configuration + (listen (list "192.168.10.2:443 ssl")) + (root "/srv/www/marek/marekpasnikowski.pl") + (server-name (list "www.marekpasnikowski.pl")))) + +(define nginx-configuration* + (nginx-configuration + (shepherd-requirement (list 'networking)) + (server-blocks (list nginx-server-portal + nginx-server-www + nginx-server-guix + nginx-server-matrix + nginx-server-radicale)))) + +(define nginx-service-aisaka + (service nginx-service-type* + nginx-configuration*)) + +;;; EOF |