diff options
Diffstat (limited to 'deployment')
| -rw-r--r-- | deployment/systems/aisaka.scm | 974 |
1 files changed, 487 insertions, 487 deletions
diff --git a/deployment/systems/aisaka.scm b/deployment/systems/aisaka.scm index f2b4b90..816b234 100644 --- a/deployment/systems/aisaka.scm +++ b/deployment/systems/aisaka.scm @@ -2,69 +2,69 @@ ;;; SPDX-FileCopyrightText: 2024-2026 Marek Paśnikowski <marek@marekpasnikowski.pl> (define-module (deployment systems aisaka) - #:use-module (guix gexp) - #:use-module ((deployment keys) - #:prefix deployment:keys:) - #:use-module ((gnu bootloader) - #:prefix gnu:bootloader:) - #:use-module ((gnu bootloader grub) - #:prefix gnu:bootloader:grub:) - #:use-module ((gnu packages) - #:prefix gnu:packages:) - #:use-module ((gnu packages linux) - #:prefix gnu:packages:linux:) - #:use-module ((gnu packages tls) - #:prefix gnu:packages:tls:) - #:use-module ((gnu packages version-control) - #:prefix gnu:packages:version-control:) - #:use-module ((gnu services) - #:prefix gnu:services:) - #:use-module ((gnu services base) - #:prefix gnu:services:base:) - #:use-module ((gnu services certbot) - #:prefix gnu:services:certbot:) - #:use-module ((gnu services cgit) - #:prefix gnu:services:cgit:) - #:use-module ((gnu services dns) - #:prefix gnu:services:dns:) - #:use-module ((gnu services mail) - #:prefix gnu:services:mail:) - #:use-module ((gnu services networking) - #:prefix gnu:services:networking:) - #:use-module ((gnu services shepherd) - #:prefix gnu:services:shepherd:) - #:use-module ((gnu services ssh) - #:prefix gnu:services:ssh:) - #:use-module ((gnu services version-control) - #:prefix gnu:services:version-control:) - #:use-module ((gnu services web) - #:prefix gnu:services:web:) - #:use-module ((gnu system) - #:prefix gnu:system:) - #:use-module ((gnu system accounts) - #:prefix gnu:system:accounts:) - #:use-module ((gnu system file-systems) - #:prefix gnu:system:file-systems:) - #:use-module ((gnu system keyboard) - #:prefix gnu:system:keyboard:) - #:use-module ((gnu system shadow) - #:prefix gnu:system:shadow:) - #:use-module ((nongnu packages linux) - #:prefix nongnu:packages:linux:) - #:use-module ((nongnu system linux-initrd) - #:prefix nongnu:system:linux-initrd:) - #:use-module ((sovereign devices) - #:prefix sovereign:devices:) - #:use-module ((sovereign devices amd64) - #:prefix sovereign:devices:amd64:) - #:use-module ((sovereign packages jekyll) - #:prefix sovereign:packages:jekyll:) - #:use-module ((sovereign systems) - #:prefix sovereign:systems:) - #:use-module ((users id1000) - #:prefix users:id1000:) - #:use-module ((users vmail) - #:prefix users:vmail:)) + #:use-module (guix gexp) + #:use-module ((deployment keys) + #:prefix deployment:keys:) + #:use-module ((gnu bootloader) + #:prefix gnu:bootloader:) + #:use-module ((gnu bootloader grub) + #:prefix gnu:bootloader:grub:) + #:use-module ((gnu packages) + #:prefix gnu:packages:) + #:use-module ((gnu packages linux) + #:prefix gnu:packages:linux:) + #:use-module ((gnu packages tls) + #:prefix gnu:packages:tls:) + #:use-module ((gnu packages version-control) + #:prefix gnu:packages:version-control:) + #:use-module ((gnu services) + #:prefix gnu:services:) + #:use-module ((gnu services base) + #:prefix gnu:services:base:) + #:use-module ((gnu services certbot) + #:prefix gnu:services:certbot:) + #:use-module ((gnu services cgit) + #:prefix gnu:services:cgit:) + #:use-module ((gnu services dns) + #:prefix gnu:services:dns:) + #:use-module ((gnu services mail) + #:prefix gnu:services:mail:) + #:use-module ((gnu services networking) + #:prefix gnu:services:networking:) + #:use-module ((gnu services shepherd) + #:prefix gnu:services:shepherd:) + #:use-module ((gnu services ssh) + #:prefix gnu:services:ssh:) + #:use-module ((gnu services version-control) + #:prefix gnu:services:version-control:) + #:use-module ((gnu services web) + #:prefix gnu:services:web:) + #:use-module ((gnu system) + #:prefix gnu:system:) + #:use-module ((gnu system accounts) + #:prefix gnu:system:accounts:) + #:use-module ((gnu system file-systems) + #:prefix gnu:system:file-systems:) + #:use-module ((gnu system keyboard) + #:prefix gnu:system:keyboard:) + #:use-module ((gnu system shadow) + #:prefix gnu:system:shadow:) + #:use-module ((nongnu packages linux) + #:prefix nongnu:packages:linux:) + #:use-module ((nongnu system linux-initrd) + #:prefix nongnu:system:linux-initrd:) + #:use-module ((sovereign devices) + #:prefix sovereign:devices:) + #:use-module ((sovereign devices amd64) + #:prefix sovereign:devices:amd64:) + #:use-module ((sovereign packages jekyll) + #:prefix sovereign:packages:jekyll:) + #:use-module ((sovereign systems) + #:prefix sovereign:systems:) + #:use-module ((users id1000) + #:prefix users:id1000:) + #:use-module ((users vmail) + #:prefix users:vmail:)) (define system-name "aisaka") @@ -73,9 +73,9 @@ (define ip-otvarta "95.171.119.109") (define spf-value - (string-append "\"v=spf1 ip4:" - ip-otvarta - " -all\"")) + (string-append "\"v=spf1 ip4:" + ip-otvarta + " -all\"")) (define ttl "3600") @@ -89,7 +89,7 @@ ("mx" ttl "IN" "A" ip-otvarta) ("@" ttl "IN" "MX" "10 mx1.forwardemail.net.") ("@" ttl "IN" "MX" "10 mx2.forwardemail.net.") - ;("@" ttl "IN" "MX" "20 mx.marekpasnikowski.pl.") + ;("@" ttl "IN" "MX" "20 mx.marekpasnikowski.pl.") ("@" ttl "IN" "TXT" "\"forward-email-port=49152\"") ("@" ttl "IN" "TXT" "\"forward-email=marekpasnikowski.pl\"") ("@" ttl "IN" "TXT" spf-value) @@ -105,273 +105,273 @@ ("www" ttl "IN" "A" ip-multimedia)) (define marekpasnikowski.pl-zone - (gnu:services:dns:zone-file - (entries marekpasnikowski.pl-entries) - (origin "marekpasnikowski.pl") - (ns "ns1.marekpasnikowski.pl.") - (mail "marek.marekpasnikowski.pl.") - (serial 2026022703))) + (gnu:services:dns:zone-file + (entries marekpasnikowski.pl-entries) + (origin "marekpasnikowski.pl") + (ns "ns1.marekpasnikowski.pl.") + (mail "marek.marekpasnikowski.pl.") + (serial 2026022703))) (define master-zone - (gnu:services:dns:knot-zone-configuration - (domain "marekpasnikowski.pl") - (zone marekpasnikowski.pl-zone))) + (gnu:services:dns:knot-zone-configuration + (domain "marekpasnikowski.pl") + (zone marekpasnikowski.pl-zone))) (define knot-configuration - (gnu:services:dns:knot-configuration + (gnu:services:dns:knot-configuration (listen-v4 "192.168.1.2") (zones (list master-zone)))) (define knot - (gnu:services:service - gnu:services:dns:knot-service-type - knot-configuration)) + (gnu:services:service + gnu:services:dns:knot-service-type + knot-configuration)) (define radicale-keys "/secrets/radicale/keys") (define dovecot-keys "/secrets/dovecot") (define nginx-account - (gnu:system:accounts:user-account - (name "nginx") - (group "nginx") - (supplementary-groups '("git")) - (system? #t) - (comment "nginx server user") - (home-directory "/var/empty") - (shell (file-append (gnu:packages:specification->package "shadow") - "/sbin/nologin")))) + (gnu:system:accounts:user-account + (name "nginx") + (group "nginx") + (supplementary-groups '("git")) + (system? #t) + (comment "nginx server user") + (home-directory "/var/empty") + (shell (file-append (gnu:packages:specification->package "shadow") + "/sbin/nologin")))) (define nginx-group - (gnu:system:accounts:user-group - (name "nginx") - (system? #t))) + (gnu:system:accounts:user-group + (name "nginx") + (system? #t))) (define nginx-accounts - (let - ((accounts- (list nginx-group - nginx-account))) - (const accounts-))) + (let + ((accounts- (list nginx-group + nginx-account))) + (const accounts-))) (define nginx-extension-of-account - (gnu:services:service-extension - gnu:system:shadow:account-service-type - nginx-accounts)) + (gnu:services:service-extension + gnu:system:shadow:account-service-type + nginx-accounts)) (define (extend-account extension) - (let* - ((extension-target- (gnu:services:service-extension-target extension)) - (account-service-type?- (eq? extension-target- - gnu:system:shadow:account-service-type))) - (if account-service-type?- - nginx-extension-of-account - extension))) + (let* + ((extension-target- (gnu:services:service-extension-target extension)) + (account-service-type?- (eq? extension-target- + gnu:system:shadow:account-service-type))) + (if account-service-type?- + nginx-extension-of-account + extension))) (define nginx-service-type* - (let - ((nginx-extensions- (gnu:services:service-type-extensions gnu:services:web:nginx-service-type))) - (gnu:services:service-type - (inherit gnu:services:web:nginx-service-type) - (extensions (map extend-account - nginx-extensions-))))) + (let + ((nginx-extensions- (gnu:services:service-type-extensions gnu:services:web:nginx-service-type))) + (gnu:services:service-type + (inherit gnu:services:web:nginx-service-type) + (extensions (map extend-account + nginx-extensions-))))) (define cgit-repository-configuration - (gnu:services:cgit:repository-cgit-configuration - (hide? #t) - (path "/srv/git/marek/packages"))) + (gnu:services:cgit:repository-cgit-configuration + (hide? #t) + (path "/srv/git/marek/packages"))) (define git-http-configuration - (gnu:services:version-control:git-http-configuration - (git-root "/var/lib/gitolite/repositories") - (uri-path "/git"))) + (gnu:services:version-control:git-http-configuration + (git-root "/var/lib/gitolite/repositories") + (uri-path "/git"))) (define nginx-extension-of-cgit - (gnu:services:service-extension - nginx-service-type* - gnu:services:cgit:cgit-configuration-nginx-config)) + (gnu:services:service-extension + nginx-service-type* + gnu:services:cgit:cgit-configuration-nginx-config)) (define (extend-cgit extension) - (let* - ((extension-target- (gnu:services:service-extension-target extension)) - (nginx-service-type?- (eq? extension-target- - gnu:services:web:nginx-service-type))) - (if nginx-service-type?- - nginx-extension-of-cgit - extension))) + (let* + ((extension-target- (gnu:services:service-extension-target extension)) + (nginx-service-type?- (eq? extension-target- + gnu:services:web:nginx-service-type))) + (if nginx-service-type?- + nginx-extension-of-cgit + extension))) (define cgit-type - (let - ((cgit-extensions- (gnu:services:service-type-extensions gnu:services:cgit:cgit-service-type))) - (gnu:services:service-type + (let + ((cgit-extensions- (gnu:services:service-type-extensions gnu:services:cgit:cgit-service-type))) + (gnu:services:service-type (inherit gnu:services:cgit:cgit-service-type) (extensions (map extend-cgit cgit-extensions-))))) (define nginx-location-cgit - (gnu:services:web:nginx-location-configuration - (body (list "fastcgi_param HTTP_HOST $server_name ;" - "fastcgi_param PATH_INFO $uri ;" - "fastcgi_param QUERY_STRING $args ;" - "fastcgi_param SCRIPT_FILENAME $document_root/lib/cgit/cgit.cgi ;" - "fastcgi_pass 127.0.0.1:9000 ;")) - (uri "@cgit"))) + (gnu:services:web:nginx-location-configuration + (body (list "fastcgi_param HTTP_HOST $server_name ;" + "fastcgi_param PATH_INFO $uri ;" + "fastcgi_param QUERY_STRING $args ;" + "fastcgi_param SCRIPT_FILENAME $document_root/lib/cgit/cgit.cgi ;" + "fastcgi_pass 127.0.0.1:9000 ;")) + (uri "@cgit"))) (define nginx-location-proxy - (gnu:services:web:nginx-location-configuration - (body (list "proxy_pass http://localhost:5232/ ;" - "proxy_set_header X-Script-Name \"\" ;" - "proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for ;" - "proxy_set_header Host $http_host ;" - "proxy_pass_header Authorization ;")) - (uri "/"))) + (gnu:services:web:nginx-location-configuration + (body (list "proxy_pass http://localhost:5232/ ;" + "proxy_set_header X-Script-Name \"\" ;" + "proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for ;" + "proxy_set_header Host $http_host ;" + "proxy_pass_header Authorization ;")) + (uri "/"))) (define nginx-location-proxy-auth - (gnu:services:web:nginx-location-configuration - (body (list "proxy_set_header Host $host;" - "proxy_set_header X-Real-IP $remote_addr;" - "proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;" - "proxy_set_header X-Forwarded-Proto $scheme;" - "if ($ssl_client_verify != SUCCESS) {return 403;}")) - (uri "/"))) + (gnu:services:web:nginx-location-configuration + (body (list "proxy_set_header Host $host;" + "proxy_set_header X-Real-IP $remote_addr;" + "proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;" + "proxy_set_header X-Forwarded-Proto $scheme;" + "if ($ssl_client_verify != SUCCESS) {return 403;}")) + (uri "/"))) (define nginx-location-well-known - (gnu:services:web:nginx-location-configuration - (body (list "root /srv/www/marek/marekpasnikowski.pl ;")) - (uri "/.well-known"))) + (gnu:services:web:nginx-location-configuration + (body (list "root /srv/www/marek/marekpasnikowski.pl ;")) + (uri "/.well-known"))) (define nginx-server-cgit - (let - ((git-http- (gnu:services:version-control:git-http-nginx-location-configuration git-http-configuration))) + (let + ((git-http- (gnu:services:version-control:git-http-nginx-location-configuration git-http-configuration))) + (gnu:services:web:nginx-server-configuration + (locations (list git-http- + nginx-location-cgit + nginx-location-well-known)) + (listen (list "192.168.10.2:443 ssl")) + (root gnu:packages:version-control:cgit) + (server-name (list "git.marekpasnikowski.pl")) + (ssl-certificate "/etc/letsencrypt/live/marekpasnikowski.pl/fullchain.pem") + (ssl-certificate-key "/etc/letsencrypt/live/marekpasnikowski.pl/privkey.pem") + (try-files (list "$uri" "@cgit"))))) + +(define nginx-server-portal (gnu:services:web:nginx-server-configuration - (locations (list git-http- - nginx-location-cgit - nginx-location-well-known)) + (locations (list nginx-location-well-known)) (listen (list "192.168.10.2:443 ssl")) - (root gnu:packages:version-control:cgit) - (server-name (list "git.marekpasnikowski.pl")) + (root "/home/marek/Publiczne/www") + (server-name (list "marekpasnikowski.pl")) (ssl-certificate "/etc/letsencrypt/live/marekpasnikowski.pl/fullchain.pem") - (ssl-certificate-key "/etc/letsencrypt/live/marekpasnikowski.pl/privkey.pem") - (try-files (list "$uri" "@cgit"))))) - -(define nginx-server-portal - (gnu:services:web:nginx-server-configuration - (locations (list nginx-location-well-known)) - (listen (list "192.168.10.2:443 ssl")) - (root "/home/marek/Publiczne/www") - (server-name (list "marekpasnikowski.pl")) - (ssl-certificate "/etc/letsencrypt/live/marekpasnikowski.pl/fullchain.pem") - (ssl-certificate-key "/etc/letsencrypt/live/marekpasnikowski.pl/privkey.pem"))) + (ssl-certificate-key "/etc/letsencrypt/live/marekpasnikowski.pl/privkey.pem"))) (define nginx-server-radicale - (gnu:services:web:nginx-server-configuration - (locations (list nginx-location-proxy - nginx-location-well-known)) - (listen (list "192.168.10.2:443 ssl")) - (server-name (list "radicale.marekpasnikowski.pl")))) + (gnu:services:web:nginx-server-configuration + (locations (list nginx-location-proxy + nginx-location-well-known)) + (listen (list "192.168.10.2:443 ssl")) + (server-name (list "radicale.marekpasnikowski.pl")))) (define nginx-server-schron - (gnu:services:web:nginx-server-configuration - (locations (list nginx-location-proxy-auth)) - (listen (list "192.168.10.2:443 ssl")) - (root "/home/marek/Publiczne/schron") - (server-name (list "schron.marekpasnikowski.pl")) - (ssl-certificate "/etc/letsencrypt/live/marekpasnikowski.pl/fullchain.pem") - (ssl-certificate-key "/etc/letsencrypt/live/marekpasnikowski.pl/privkey.pem") - (raw-content (list "ssl_client_certificate /secrets/ca/intermediate/certs/ca-chain.cert.pem;" - "ssl_verify_client on;")))) + (gnu:services:web:nginx-server-configuration + (locations (list nginx-location-proxy-auth)) + (listen (list "192.168.10.2:443 ssl")) + (root "/home/marek/Publiczne/schron") + (server-name (list "schron.marekpasnikowski.pl")) + (ssl-certificate "/etc/letsencrypt/live/marekpasnikowski.pl/fullchain.pem") + (ssl-certificate-key "/etc/letsencrypt/live/marekpasnikowski.pl/privkey.pem") + (raw-content (list "ssl_client_certificate /secrets/ca/intermediate/certs/ca-chain.cert.pem;" + "ssl_verify_client on;")))) (define nginx-server-sejf - (gnu:services:web:nginx-server-configuration - (locations (list nginx-location-proxy-auth)) - (listen (list "192.168.10.2:443 ssl")) - (root "/home/marek/Publiczne/sejf") - (server-name (list "sejf.marekpasnikowski.pl")) - (ssl-certificate "/etc/letsencrypt/live/marekpasnikowski.pl/fullchain.pem") - (ssl-certificate-key "/etc/letsencrypt/live/marekpasnikowski.pl/privkey.pem") - (raw-content (list "ssl_client_certificate /secrets/ca/intermediate/certs/ca-chain.cert.pem;" - "ssl_verify_client on;")))) + (gnu:services:web:nginx-server-configuration + (locations (list nginx-location-proxy-auth)) + (listen (list "192.168.10.2:443 ssl")) + (root "/home/marek/Publiczne/sejf") + (server-name (list "sejf.marekpasnikowski.pl")) + (ssl-certificate "/etc/letsencrypt/live/marekpasnikowski.pl/fullchain.pem") + (ssl-certificate-key "/etc/letsencrypt/live/marekpasnikowski.pl/privkey.pem") + (raw-content (list "ssl_client_certificate /secrets/ca/intermediate/certs/ca-chain.cert.pem;" + "ssl_verify_client on;")))) (define nginx-server-test - (gnu:services:web:nginx-server-configuration - (locations (list nginx-location-proxy-auth)) - (listen (list "192.168.10.2:443 ssl")) - (root "/home/marek/Publiczne/schron") - (server-name (list "test.marekpasnikowski.pl")) - (ssl-certificate "/etc/letsencrypt/live/marekpasnikowski.pl/fullchain.pem") - (ssl-certificate-key "/etc/letsencrypt/live/marekpasnikowski.pl/privkey.pem") - (raw-content (list "ssl_client_certificate /secrets/ca/intermediate/certs/ca-chain.cert.pem;" - "ssl_verify_client on;")))) + (gnu:services:web:nginx-server-configuration + (locations (list nginx-location-proxy-auth)) + (listen (list "192.168.10.2:443 ssl")) + (root "/home/marek/Publiczne/schron") + (server-name (list "test.marekpasnikowski.pl")) + (ssl-certificate "/etc/letsencrypt/live/marekpasnikowski.pl/fullchain.pem") + (ssl-certificate-key "/etc/letsencrypt/live/marekpasnikowski.pl/privkey.pem") + (raw-content (list "ssl_client_certificate /secrets/ca/intermediate/certs/ca-chain.cert.pem;" + "ssl_verify_client on;")))) (define nginx-server-www - (gnu:services:web:nginx-server-configuration - (listen (list "192.168.10.2:443 ssl")) - (root "/home/marek/Publiczne/www") - (server-name (list "www.marekpasnikowski.pl")))) + (gnu:services:web:nginx-server-configuration + (listen (list "192.168.10.2:443 ssl")) + (root "/home/marek/Publiczne/www") + (server-name (list "www.marekpasnikowski.pl")))) (define cgit-configuration - (gnu:services:cgit:cgit-configuration - (nginx (list nginx-server-cgit)) - (repositories (list cgit-repository-configuration)) - (project-list (list "deployment.git" - "nonguix.git" - "sovereign.git")) - (repository-directory "/var/lib/gitolite/repositories"))) + (gnu:services:cgit:cgit-configuration + (nginx (list nginx-server-cgit)) + (repositories (list cgit-repository-configuration)) + (project-list (list "deployment.git" + "nonguix.git" + "sovereign.git")) + (repository-directory "/var/lib/gitolite/repositories"))) (define nginx-configuration* - (gnu:services:web:nginx-configuration - (shepherd-requirement (list 'networking)) - (server-blocks (list nginx-server-portal - nginx-server-www - nginx-server-test - nginx-server-schron - nginx-server-sejf - nginx-server-radicale)))) + (gnu:services:web:nginx-configuration + (shepherd-requirement (list 'networking)) + (server-blocks (list nginx-server-portal + nginx-server-www + nginx-server-test + nginx-server-schron + nginx-server-sejf + nginx-server-radicale)))) (define nginx-deploy-hook-file - #~(let - ((pid (call-with-input-file "/var/run/nginx/pid" - read))) - (kill pid SIGHUP))) + #~(let + ((pid (call-with-input-file "/var/run/nginx/pid" + read))) + (kill pid SIGHUP))) (define nginx-extension-of-certbot - (gnu:services:service-extension - nginx-service-type* - (@@ (gnu services certbot) certbot-nginx-server-configurations))) + (gnu:services:service-extension + nginx-service-type* + (@@ (gnu services certbot) certbot-nginx-server-configurations))) (define (extend-certbot extension) - (let* - ((extension-target- (gnu:services:service-extension-target extension)) - (nginx-service-type?- (eq? extension-target- - gnu:services:web:nginx-service-type))) - (if nginx-service-type?- - nginx-extension-of-certbot - extension))) + (let* + ((extension-target- (gnu:services:service-extension-target extension)) + (nginx-service-type?- (eq? extension-target- + gnu:services:web:nginx-service-type))) + (if nginx-service-type?- + nginx-extension-of-certbot + extension))) (define certbot-type - (let - ((certbot-extensions- (gnu:services:service-type-extensions gnu:services:certbot:certbot-service-type))) - (gnu:services:service-type - (inherit gnu:services:certbot:certbot-service-type) - (extensions (map extend-certbot - certbot-extensions-))))) + (let + ((certbot-extensions- (gnu:services:service-type-extensions gnu:services:certbot:certbot-service-type))) + (gnu:services:service-type + (inherit gnu:services:certbot:certbot-service-type) + (extensions (map extend-certbot + certbot-extensions-))))) (define certificate-configuration - (gnu:services:certbot:certificate-configuration - (deploy-hook (program-file "nginx-deploy-hook" - nginx-deploy-hook-file)) - (domains (list "marekpasnikowski.pl" - "git.marekpasnikowski.pl" - "radicale.marekpasnikowski.pl" - "schron.marekpasnikowski.pl" - "sejf.marekpasnikowski.pl" - "test.marekpasnikowski.pl" - "www.marekpasnikowski.pl")))) + (gnu:services:certbot:certificate-configuration + (deploy-hook (program-file "nginx-deploy-hook" + nginx-deploy-hook-file)) + (domains (list "marekpasnikowski.pl" + "git.marekpasnikowski.pl" + "radicale.marekpasnikowski.pl" + "schron.marekpasnikowski.pl" + "sejf.marekpasnikowski.pl" + "test.marekpasnikowski.pl" + "www.marekpasnikowski.pl")))) (define certbot-configuration - (gnu:services:certbot:certbot-configuration - (certificates (list certificate-configuration)) - (email "marek@marekpasnikowski.pl") - (webroot "/srv/www/marek/marekpasnikowski.pl"))) + (gnu:services:certbot:certbot-configuration + (certificates (list certificate-configuration)) + (email "marek@marekpasnikowski.pl") + (webroot "/srv/www/marek/marekpasnikowski.pl"))) (define certbot (gnu:services:service @@ -379,306 +379,306 @@ certbot-configuration)) (define cgit - (gnu:services:service - cgit-type - cgit-configuration)) + (gnu:services:service + cgit-type + cgit-configuration)) (define etc - (let* - ((mailname-file- (plain-file "mailname" - "marekpasnikowski.pl\n")) - (mailname-link- (list "mailname" - mailname-file-)) - (etc-links- (list mailname-link-))) - (gnu:services:simple-service 'etc-files - gnu:services:etc-service-type - etc-links-))) + (let* + ((mailname-file- (plain-file "mailname" + "marekpasnikowski.pl\n")) + (mailname-link- (list "mailname" + mailname-file-)) + (etc-links- (list mailname-link-))) + (gnu:services:simple-service 'etc-files + gnu:services:etc-service-type + etc-links-))) (define fcgiwrap-configuration - (gnu:services:web:fcgiwrap-configuration - (user "git") - (group "git"))) + (gnu:services:web:fcgiwrap-configuration + (user "git") + (group "git"))) (define fcgiwrap - (gnu:services:service - gnu:services:web:fcgiwrap-service-type - fcgiwrap-configuration)) + (gnu:services:service + gnu:services:web:fcgiwrap-service-type + fcgiwrap-configuration)) (define file-system-efi - (gnu:system:file-systems:file-system - (device (gnu:system:file-systems:file-system-label "AISAKA")) - (mount-point "/boot") - (type "vfat") - (flags (list)) - (options #f) - (mount? #t) - (mount-may-fail? #t) - (needed-for-boot? #f) - (check? #t) - (skip-check-if-clean? #f) - (repair 'preen) - (create-mount-point? #f) - (dependencies (list)) - (shepherd-requirements (list)) - (location (current-source-location)))) + (gnu:system:file-systems:file-system + (device (gnu:system:file-systems:file-system-label "AISAKA")) + (mount-point "/boot") + (type "vfat") + (flags (list)) + (options #f) + (mount? #t) + (mount-may-fail? #t) + (needed-for-boot? #f) + (check? #t) + (skip-check-if-clean? #f) + (repair 'preen) + (create-mount-point? #f) + (dependencies (list)) + (shepherd-requirements (list)) + (location (current-source-location)))) (define file-system-root - (gnu:system:file-systems:file-system - (device (gnu:system:file-systems:file-system-label "aisaka-root")) - (mount-point "/") - (type "ext4") - (flags (list)) - (options #f) - (mount? #t) - (mount-may-fail? #f) - (needed-for-boot? #t) - (check? #t) - (skip-check-if-clean? #f) - (repair 'preen) - (create-mount-point? #f) - (dependencies (list)) - (shepherd-requirements (list)) - (location (current-source-location)))) + (gnu:system:file-systems:file-system + (device (gnu:system:file-systems:file-system-label "aisaka-root")) + (mount-point "/") + (type "ext4") + (flags (list)) + (options #f) + (mount? #t) + (mount-may-fail? #f) + (needed-for-boot? #t) + (check? #t) + (skip-check-if-clean? #f) + (repair 'preen) + (create-mount-point? #f) + (dependencies (list)) + (shepherd-requirements (list)) + (location (current-source-location)))) (define gitolite-rc-file - (gnu:services:version-control:gitolite-rc-file - (umask #o0027))) + (gnu:services:version-control:gitolite-rc-file + (umask #o0027))) (define gitolite-configuration - (gnu:services:version-control:gitolite-configuration - (rc-file gitolite-rc-file) - (admin-pubkey #f))) + (gnu:services:version-control:gitolite-configuration + (rc-file gitolite-rc-file) + (admin-pubkey #f))) (define gitolite - (gnu:services:service - gnu:services:version-control:gitolite-service-type - gitolite-configuration)) + (gnu:services:service + gnu:services:version-control:gitolite-service-type + gitolite-configuration)) (define system-keyboard-layout - (gnu:system:keyboard:keyboard-layout "pl")) + (gnu:system:keyboard:keyboard-layout "pl")) (define nginx - (gnu:services:service - nginx-service-type* - nginx-configuration*)) + (gnu:services:service + nginx-service-type* + nginx-configuration*)) (define rakan-machine - #~(build-machine - (name "rakan") - (systems (list "x86_64-linux" - "i686-linux")) - (user "marek") - (host-key "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFxlIhNlkWCNA+l/RiOJztB+VWhuJtDTUvSwwlE3MpgJ root@rakan") - (private-key "/home/marek/.ssh/id_ed25519"))) + #~(build-machine + (name "rakan") + (systems (list "x86_64-linux" + "i686-linux")) + (user "marek") + (host-key "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFxlIhNlkWCNA+l/RiOJztB+VWhuJtDTUvSwwlE3MpgJ root@rakan") + (private-key "/home/marek/.ssh/id_ed25519"))) (define guix-offload-rakan - (gnu:services:base:guix-extension - (authorized-keys (list deployment:keys:akashi-guix - deployment:keys:rakan-guix)) - (build-machines (list rakan-machine)))) + (gnu:services:base:guix-extension + (authorized-keys (list deployment:keys:akashi-guix + deployment:keys:rakan-guix)) + (build-machines (list rakan-machine)))) (define offload-rakan - (gnu:services:simple-service 'offload-rakan - gnu:services:base:guix-service-type - guix-offload-rakan)) + (gnu:services:simple-service 'offload-rakan + gnu:services:base:guix-service-type + guix-offload-rakan)) (define openssh - (gnu:services:service - gnu:services:ssh:openssh-service-type)) + (gnu:services:service + gnu:services:ssh:openssh-service-type)) (define radicale-auth-configuration - (gnu:services:mail:radicale-auth-configuration - (type 'htpasswd) - (htpasswd-filename radicale-keys) - (htpasswd-encryption 'plain))) + (gnu:services:mail:radicale-auth-configuration + (type 'htpasswd) + (htpasswd-filename radicale-keys) + (htpasswd-encryption 'plain))) (define radicale-storage-configuration - (gnu:services:mail:radicale-storage-configuration - (filesystem-folder "/data/radicale/collections"))) + (gnu:services:mail:radicale-storage-configuration + (filesystem-folder "/data/radicale/collections"))) (define radicale-configuration - (gnu:services:mail:radicale-configuration - (auth radicale-auth-configuration) - (storage radicale-storage-configuration))) + (gnu:services:mail:radicale-configuration + (auth radicale-auth-configuration) + (storage radicale-storage-configuration))) (define radicale - (gnu:services:service - gnu:services:mail:radicale-service-type - radicale-configuration)) + (gnu:services:service + gnu:services:mail:radicale-service-type + radicale-configuration)) (define enp1s0-address-4 - (gnu:services:base:network-address - (device "enp1s0") - (value "192.168.10.2/24") - (ipv6? #f))) + (gnu:services:base:network-address + (device "enp1s0") + (value "192.168.10.2/24") + (ipv6? #f))) (define enp2s0-address-4 - (gnu:services:base:network-address - (device "enp2s0") - (value "192.168.1.2/24") - (ipv6? #f))) + (gnu:services:base:network-address + (device "enp2s0") + (value "192.168.1.2/24") + (ipv6? #f))) (define enp1s0-route-4-default - (gnu:services:base:network-route - (destination "default") - (source #f) - (device #f) - (ipv6? #f) - (gateway "192.168.10.1"))) + (gnu:services:base:network-route + (destination "default") + (source #f) + (device #f) + (ipv6? #f) + (gateway "192.168.10.1"))) (define network-hardware - (gnu:services:base:static-networking - (addresses (list enp1s0-address-4 - enp2s0-address-4)) - (links (list)) - (routes (list enp1s0-route-4-default)) - (name-servers (list "192.168.10.1" - "192.168.1.1")) - (provision (list 'network-hardware)) - (requirement (list)))) + (gnu:services:base:static-networking + (addresses (list enp1s0-address-4 + enp2s0-address-4)) + (links (list)) + (routes (list enp1s0-route-4-default)) + (name-servers (list "192.168.10.1" + "192.168.1.1")) + (provision (list 'network-hardware)) + (requirement (list)))) (define static-networking-configuration - (list network-hardware)) + (list network-hardware)) (define static-networking - (gnu:services:service - gnu:services:networking:static-networking-service-type - static-networking-configuration)) + (gnu:services:service + gnu:services:networking:static-networking-service-type + static-networking-configuration)) (define ip-command - (file-append gnu:packages:linux:iproute - "/sbin/ip")) + (file-append gnu:packages:linux:iproute + "/sbin/ip")) (define network-enp2s0-route-default - (let - ((route-default- #~(list #$ip-command - "route" - "add" - "default" - "via" - "192.168.1.1" - "table" - "1"))) - (gnu:services:shepherd:shepherd-service - (provision (list 'network-enp2s0-route-default)) - (requirement (list 'network-enp2s0-table)) - (one-shot? #t) - (respawn? #f) - (start #~(make-forkexec-constructor #$route-default-)) - (stop #~(const #f)) - (actions (list)) - (auto-start? #t) - (documentation "Sets up a default route for traffic from enp2s0.") - (modules gnu:services:shepherd:%default-modules)))) + (let + ((route-default- #~(list #$ip-command + "route" + "add" + "default" + "via" + "192.168.1.1" + "table" + "1"))) + (gnu:services:shepherd:shepherd-service + (provision (list 'network-enp2s0-route-default)) + (requirement (list 'network-enp2s0-table)) + (one-shot? #t) + (respawn? #f) + (start #~(make-forkexec-constructor #$route-default-)) + (stop #~(const #f)) + (actions (list)) + (auto-start? #t) + (documentation "Sets up a default route for traffic from enp2s0.") + (modules gnu:services:shepherd:%default-modules)))) (define network-enp2s0-table - (let - ((table- #~(list #$ip-command - "rule" - "add" - "from" - "192.168.1.2" - "table" - "1" - "prio" - "1"))) + (let + ((table- #~(list #$ip-command + "rule" + "add" + "from" + "192.168.1.2" + "table" + "1" + "prio" + "1"))) + (gnu:services:shepherd:shepherd-service + (provision (list 'network-enp2s0-table)) + (requirement (list 'network-hardware)) + (one-shot? #t) + (respawn? #f) + (start #~(make-forkexec-constructor #$table-)) + (stop #~(const #f)) + (actions (list)) + (auto-start? #t) + (documentation "Defines a table of rules number 1 for routes through enp2s0.") + (modules gnu:services:shepherd:%default-modules)))) + +(define networking (gnu:services:shepherd:shepherd-service - (provision (list 'network-enp2s0-table)) - (requirement (list 'network-hardware)) + (provision (list 'networking)) + (requirement (list 'network-enp2s0-table + 'network-enp2s0-route-default)) (one-shot? #t) (respawn? #f) - (start #~(make-forkexec-constructor #$table-)) + (start #~(const #t)) (stop #~(const #f)) (actions (list)) (auto-start? #t) - (documentation "Defines a table of rules number 1 for routes through enp2s0.") - (modules gnu:services:shepherd:%default-modules)))) - -(define networking - (gnu:services:shepherd:shepherd-service - (provision (list 'networking)) - (requirement (list 'network-enp2s0-table - 'network-enp2s0-route-default)) - (one-shot? #t) - (respawn? #f) - (start #~(const #t)) - (stop #~(const #f)) - (actions (list)) - (auto-start? #t) - (documentation "Defines a graph root of one-shot services to invoke various ip commands.") - (modules gnu:services:shepherd:%default-modules))) + (documentation "Defines a graph root of one-shot services to invoke various ip commands.") + (modules gnu:services:shepherd:%default-modules))) (define iproute2-networking - (let - ((extensions- (list network-enp2s0-table - network-enp2s0-route-default - networking))) - (gnu:services:simple-service 'networking - gnu:services:shepherd:shepherd-root-service-type - extensions-))) + (let + ((extensions- (list network-enp2s0-table + network-enp2s0-route-default + networking))) + (gnu:services:simple-service 'networking + gnu:services:shepherd:shepherd-root-service-type + extensions-))) (define swap-device-izumi-1-label - (gnu:system:file-systems:file-system-label "izumi-swap-f")) + (gnu:system:file-systems:file-system-label "izumi-swap-f")) (define %sovereign-services* - (gnu:services:modify-services sovereign:systems:%sovereign-services - (gnu:services:delete gnu:services:networking:network-manager-service-type))) + (gnu:services:modify-services sovereign:systems:%sovereign-services + (gnu:services:delete gnu:services:networking:network-manager-service-type))) (define system-bootloader - (gnu:bootloader:bootloader-configuration - (bootloader gnu:bootloader:grub:grub-efi-bootloader) - (targets (list "/boot")) - (keyboard-layout sovereign:devices:pl-keyboard-layout))) + (gnu:bootloader:bootloader-configuration + (bootloader gnu:bootloader:grub:grub-efi-bootloader) + (targets (list "/boot")) + (keyboard-layout sovereign:devices:pl-keyboard-layout))) (define vmail-group - (gnu:system:accounts:user-group - (name "vmail") - (system? #t))) + (gnu:system:accounts:user-group + (name "vmail") + (system? #t))) (define-public system - (let* - ((home-environments- (list users:id1000:name/home-environment)) - (home-service- (sovereign:systems:guix-home-service home-environments-))) - (gnu:system:operating-system - (bootloader system-bootloader) - (label (sovereign:systems:operating-system-label* system-name - gnu:system:this-operating-system)) - (kernel nongnu:packages:linux:linux) - (keyboard-layout system-keyboard-layout) - (initrd nongnu:system:linux-initrd:microcode-initrd) - (firmware (list nongnu:packages:linux:linux-firmware)) - (host-name system-name) - (file-systems (cons* file-system-root - file-system-efi - gnu:system:file-systems:%base-file-systems)) - (users (cons* users:id1000:uid1000-account - users:vmail:vmail-account - gnu:system:shadow:%base-user-accounts)) - (groups (cons* vmail-group - gnu:system:shadow:%base-groups)) - (packages (cons* sovereign:packages:jekyll:custom-jekyll - gnu:packages:tls:openssl - gnu:system:%base-packages)) - (timezone "Europe/Warsaw") - (locale sovereign:systems:pl-locale) - (locale-definitions sovereign:systems:%sovereign-locale-definitions) - (services (cons* users:id1000:dkim-service - users:id1000:dovecot-service - users:id1000:smtp-service - knot - certbot - cgit - etc - fcgiwrap - gitolite - home-service- - nginx - offload-rakan - openssh - radicale - static-networking - iproute2-networking - %sovereign-services*)) - (sudoers-file sovereign:systems:%sovereign-sudoers-specification)))) + (let* + ((home-environments- (list users:id1000:name/home-environment)) + (home-service- (sovereign:systems:guix-home-service home-environments-))) + (gnu:system:operating-system + (bootloader system-bootloader) + (label (sovereign:systems:operating-system-label* system-name + gnu:system:this-operating-system)) + (kernel nongnu:packages:linux:linux) + (keyboard-layout system-keyboard-layout) + (initrd nongnu:system:linux-initrd:microcode-initrd) + (firmware (list nongnu:packages:linux:linux-firmware)) + (host-name system-name) + (file-systems (cons* file-system-root + file-system-efi + gnu:system:file-systems:%base-file-systems)) + (users (cons* users:id1000:uid1000-account + users:vmail:vmail-account + gnu:system:shadow:%base-user-accounts)) + (groups (cons* vmail-group + gnu:system:shadow:%base-groups)) + (packages (cons* sovereign:packages:jekyll:custom-jekyll + gnu:packages:tls:openssl + gnu:system:%base-packages)) + (timezone "Europe/Warsaw") + (locale sovereign:systems:pl-locale) + (locale-definitions sovereign:systems:%sovereign-locale-definitions) + (services (cons* users:id1000:dkim-service + users:id1000:dovecot-service + users:id1000:smtp-service + knot + certbot + cgit + etc + fcgiwrap + gitolite + home-service- + nginx + offload-rakan + openssh + radicale + static-networking + iproute2-networking + %sovereign-services*)) + (sudoers-file sovereign:systems:%sovereign-sudoers-specification)))) (define-public operating-system* system) |