diff options
Diffstat (limited to 'deployment/system/aisaka.scm')
| -rw-r--r-- | deployment/system/aisaka.scm | 358 |
1 files changed, 358 insertions, 0 deletions
diff --git a/deployment/system/aisaka.scm b/deployment/system/aisaka.scm new file mode 100644 index 0000000..aaebe5e --- /dev/null +++ b/deployment/system/aisaka.scm @@ -0,0 +1,358 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment system aisaka) + #:export (bootloader-aisaka + file-systems + host-name-aisaka + services) + #:use-module (guix gexp) + #:use-module (sovereign bootloader) + #:use-module (sovereign system file-systems) + #:use-module ((deployment gexp) + #:prefix deployment:gexp:) + #:use-module ((deployment services certbot) + #:prefix deployment:services:certbot:) + #:use-module ((deployment services cgit) + #:prefix deployment:services:cgit:) + #:use-module ((deployment services databases) + #:prefix deployment:services:databases:) + #:use-module ((deployment services dns) + #:prefix deployment:services:dns:) + #:use-module ((deployment services mail) + #:prefix deployment:services:mail:) + #:use-module ((deployment services matrix) + #:prefix deployment:services:matrix:) + #:use-module ((deployment services networking) + #:prefix deployment:services:networking:) + #:use-module ((deployment services nfs) + #:prefix deployment:services:nfs:) + #:use-module ((deployment services vpn) + #:prefix deployment:services:vpn:) + #:use-module ((deployment services web) + #:prefix deployment:services:web:) + #:use-module ((gnu bootloader) + #:prefix gnu:bootloader:) + #:use-module ((gnu bootloader grub) + #:prefix gnu:bootloader:grub:) + #:use-module ((gnu packages) + #:prefix gnu:packages:) + #:use-module ((gnu packages linux) + #:prefix gnu:packages:linux:) + #:use-module ((gnu packages tls) + #:prefix gnu:packages:tls:) + #:use-module ((gnu services) + #:prefix gnu:services:) + #:use-module ((gnu services base) + #:prefix gnu:services:base:) + #:use-module ((gnu services mail) + #:prefix gnu:services:mail:) + #:use-module ((gnu services networking) + #:prefix gnu:services:networking:) + #:use-module ((gnu services shepherd) + #:prefix gnu:services:shepherd:) + #:use-module ((gnu services version-control) + #:prefix gnu:services:version-control:) + #:use-module ((gnu system) + #:prefix gnu:system:) + #:use-module ((gnu system accounts) + #:prefix gnu:system:accounts:) + #:use-module ((gnu system file-systems) + #:prefix gnu:system:file-systems:) + #:use-module ((gnu system keyboard) + #:prefix gnu:system:keyboard:) + #:use-module ((gnu system linux-initrd) + #:prefix gnu:system:linux-initrd:) + #:use-module ((gnu system locale) + #:prefix gnu:system:locale:) + #:use-module ((gnu system nss) + #:prefix gnu:system:nss:) + #:use-module ((gnu system pam) + #:prefix gnu:system:pam:) + #:use-module ((guix diagnostics) + #:prefix guix:diagnostics:) + #:use-module ((nongnu packages linux) + #:prefix nongnu:packages:linux:) + #:use-module ((nongnu system linux-initrd) + #:prefix nongnu:system:linux-initrd:) + #:use-module ((sovereign packages jekyll) + #:prefix sovereign:packages:jekyll:) + #:use-module ((sovereign services) + #:prefix sovereign:services:) + #:use-module ((sovereign systems) + #:prefix sovereign:systems:) + #:use-module ((users id1000) + #:prefix users:id1000:) + #:use-module ((users vmail) + #:prefix users:vmail:)) + +(define gitolite-rc-file + (gnu:services:version-control:gitolite-rc-file + (umask #o0027))) + +(define gitolite-configuration + (gnu:services:version-control:gitolite-configuration + (rc-file gitolite-rc-file) + (admin-pubkey #f))) + +(define-public gitolite + (gnu:services:service + gnu:services:version-control:gitolite-service-type + gitolite-configuration)) + +(define-public system-keyboard-layout + (gnu:system:keyboard:keyboard-layout "pl")) + +(define rakan-machine + #~(build-machine + (name "rakan") + (systems (list "x86_64-linux" + "i686-linux" + "aarch64-linux")) + (user "marek") + (host-key "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFxlIhNlkWCNA+l/RiOJztB+VWhuJtDTUvSwwlE3MpgJ root@rakan") + (private-key "/home/marek/.ssh/id_ed25519"))) + +(define guix-offload-rakan + (gnu:services:base:guix-extension + (authorized-keys (list deployment:gexp:akashi-guix-key + deployment:gexp:ayase-guix-key + deployment:gexp:rakan-guix-key)) + (build-machines (list rakan-machine)))) + +(define-public offload-rakan + (gnu:services:simple-service 'offload-rakan + gnu:services:base:guix-service-type + guix-offload-rakan)) + +(define radicale-auth-configuration + (gnu:services:mail:radicale-auth-configuration + (type 'htpasswd) + (htpasswd-filename "/secrets/radicale/keys") + (htpasswd-encryption 'plain))) + +(define radicale-storage-configuration + (gnu:services:mail:radicale-storage-configuration + (filesystem-folder "/data/radicale/collections"))) + +(define radicale-configuration + (gnu:services:mail:radicale-configuration + (auth radicale-auth-configuration) + (storage radicale-storage-configuration))) + +(define-public radicale + (gnu:services:service + gnu:services:mail:radicale-service-type + radicale-configuration)) + +(define enp1s0-address-4 + (gnu:services:base:network-address + (device "enp1s0") + (value "192.168.10.2/24") + (ipv6? #f))) + +(define enp2s0-address-4 + (gnu:services:base:network-address + (device "enp2s0") + (value "192.168.1.2/24") + (ipv6? #f))) + +(define enp1s0-route-4-default + (gnu:services:base:network-route + (destination "default") + (source #f) + (device #f) + (ipv6? #f) + (gateway "192.168.10.1"))) + +(define network-hardware + (gnu:services:base:static-networking + (addresses (list enp1s0-address-4 + enp2s0-address-4)) + (links (list)) + (routes (list enp1s0-route-4-default)) + (name-servers (list "192.168.10.1" + "192.168.1.1")) + (provision (list 'network-hardware)) + (requirement (list)))) + +(define static-networking-configuration + (list network-hardware)) + +(define-public static-networking + (gnu:services:service + gnu:services:networking:static-networking-service-type + static-networking-configuration)) + +(define ip-command + (file-append gnu:packages:linux:iproute + "/sbin/ip")) + +(define network-enp2s0-route-default + (let + ((route-default- #~(list #$ip-command + "route" + "add" + "default" + "via" + "192.168.1.1" + "table" + "1"))) + (gnu:services:shepherd:shepherd-service + (provision (list 'network-enp2s0-route-default)) + (requirement (list 'network-enp2s0-table)) + (one-shot? #t) + (respawn? #f) + (start #~(make-forkexec-constructor #$route-default-)) + (stop #~(const #f)) + (actions (list)) + (auto-start? #t) + (documentation "Sets up a default route for traffic from enp2s0.") + (modules gnu:services:shepherd:%default-modules)))) + +(define network-enp2s0-table + (let + ((table- #~(list #$ip-command + "rule" + "add" + "from" + "192.168.1.2" + "table" + "1" + "prio" + "1"))) + (gnu:services:shepherd:shepherd-service + (provision (list 'network-enp2s0-table)) + (requirement (list 'network-hardware)) + (one-shot? #t) + (respawn? #f) + (start #~(make-forkexec-constructor #$table-)) + (stop #~(const #f)) + (actions (list)) + (auto-start? #t) + (documentation "Defines a table of rules number 1 for routes through enp2s0.") + (modules gnu:services:shepherd:%default-modules)))) + +(define networking + (gnu:services:shepherd:shepherd-service + (provision (list 'networking)) + (requirement (list 'network-enp2s0-table + 'network-enp2s0-route-default + 'network-online)) + (one-shot? #t) + (respawn? #f) + (start #~(const #t)) + (stop #~(const #f)) + (actions (list)) + (auto-start? #t) + (documentation "Defines a graph root of one-shot services to invoke various ip commands.") + (modules gnu:services:shepherd:%default-modules))) + +(define-public iproute2-networking + (let + ((extensions- (list network-enp2s0-table + network-enp2s0-route-default + networking))) + (gnu:services:simple-service 'networking + gnu:services:shepherd:shepherd-root-service-type + extensions-))) + +(define swap-device-izumi-1-label + (gnu:system:file-systems:file-system-label "izumi-swap-f")) + +(define-public %sovereign-services* + (gnu:services:modify-services sovereign:systems:%sovereign-services + (gnu:services:delete gnu:services:networking:network-manager-service-type))) + +(define-public system-bootloader + (gnu:bootloader:bootloader-configuration + (bootloader gnu:bootloader:grub:grub-efi-bootloader) + (targets (list "/boot")) + (keyboard-layout sovereign:systems:keyboard-layout))) + +(define-public vmail-group + (gnu:system:accounts:user-group + (name "vmail") + (system? #t))) + +(define named-home-environments + (list users:id1000:named-home-environment)) + +(define guix-publish-configuration + (gnu:services:base:guix-publish-configuration + (host "0.0.0.0") + (port 8080) + (advertise? #t))) + +(define-public guix-home-service + (sovereign:systems:guix-home-service named-home-environments)) + +(define-public guix-publish-service + (sovereign:services:guix-publish-service guix-publish-configuration)) + +(define host-name-aisaka "aisaka") + +(define bootloader-configuration-targets-aisaka + (list "/dev/nvme0n1")) + +(define bootloader-aisaka + (custom-bootloader-configuration bootloader-configuration-targets-aisaka)) + +(define file-system-boot + (gnu:system:file-systems:file-system + (inherit file-system/efi) + (device (file-system-label* "BOOT")))) + +(define file-system-root + (gnu:system:file-systems:file-system + (inherit file-system/root) + (device (file-system-label* host-name-aisaka + "root")))) + +(define file-systems + (cons* file-system-root + file-system-boot + gnu:system:file-systems:%base-file-systems)) + +(define services + (cons* deployment:services:certbot:aisaka-certbot-service + deployment:services:cgit:aisaka-cgit-service + deployment:services:mail:dkimproxy-out-service + users:id1000:dovecot-service + deployment:services:mail:etc-mailname-aisaka + deployment:services:web:fcgiwrap-service-aisaka + gitolite + guix-home-service + guix-publish-service + iproute2-networking + deployment:services:dns:knot-service-aisaka + deployment:services:databases:matrix-postgresql-service + deployment:services:matrix:matrix-service-aisaka + deployment:services:networking:network-online-service-aisaka + deployment:services:nfs:service-nfs-aisaka + deployment:services:web:nginx-service-aisaka + offload-rakan + radicale + deployment:services:mail:smtp-service-aisaka + static-networking + deployment:services:vpn:wireguard-service-aisaka + %sovereign-services*)) + +;;; EOF |