diff options
Diffstat (limited to 'deployment')
26 files changed, 2869 insertions, 0 deletions
diff --git a/deployment/gexp.scm b/deployment/gexp.scm new file mode 100644 index 0000000..823b8d2 --- /dev/null +++ b/deployment/gexp.scm @@ -0,0 +1,57 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment gexp) + #:use-module (guix gexp)) + +(define-public aisaka-guix-key + (mixed-text-file "aisaka-guix-key.pub" + "(public-key\n" + " (ecc\n" + " (curve Ed25519)\n" + " (q #983CD313090D2699AD26AE5CB589A29F24A32E247A41EB4F4A22D196DFCD9D3C#)))")) + +(define-public akashi-guix-key + (mixed-text-file "akashi-guix-key.pub" + "(public-key\n" + " (ecc\n" + " (curve Ed25519)\n" + " (q #A3E347D0D79D616C4379C844C1D67DFC9BFD4F2011D4070EB3DB7EFA66D6F3D2#)))")) + +(define-public ayase-guix-key + (mixed-text-file "ayase-guix-key.pub" + "(public-key\n" + " (ecc\n" + " (curve Ed25519)\n" + " (q #B617E8D644A80841BDF060B67EA0772BA1688754F54582CFDEA899FD8010B3AE#)))")) + +(define-public mcdowell-guix-key + (mixed-text-file "mcdowell-guix-key.pub" + "(public-key\n" + " (ecc\n" + " (curve Ed25519)\n" + " (q #FDA720ED167E05AB735182D887A450DCD534A85F2697DE421E49CA043FC01E4D#)))")) + +(define-public rakan-guix-key + (mixed-text-file "rakan-guix-key.pub" + "(public-key\n" + " (ecc\n" + " (curve Ed25519)\n" + " (q #FDA720ED167E05AB735182D887A450DCD534A85F2697DE421E49CA043FC01E4D#)))")) diff --git a/deployment/machine.scm b/deployment/machine.scm new file mode 100644 index 0000000..dfb7dee --- /dev/null +++ b/deployment/machine.scm @@ -0,0 +1,47 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment machine) + #:use-module ((deployment machine ssh) + #:prefix deployment:machine:ssh:) + #:use-module ((deployment system) + #:prefix deployment:system:) + #:use-module ((gnu machine) + #:prefix gnu:machine:) + #:use-module ((gnu machine ssh) + #:prefix gnu:machine:ssh:)) + +(define aisaka-machine + (gnu:machine:machine + (operating-system deployment:system:aisaka) + (environment gnu:machine:ssh:managed-host-environment-type) + (configuration deployment:machine:ssh:aisaka-configuration))) + +(define-public aisaka + (list aisaka-machine)) + +(define akashi-machine + (gnu:machine:machine + (operating-system deployment:system:akashi) + (environment gnu:machine:ssh:managed-host-environment-type) + (configuration deployment:machine:ssh:akashi-configuration))) + +(define-public akashi + (list akashi-machine)) diff --git a/deployment/machine/ssh.scm b/deployment/machine/ssh.scm new file mode 100644 index 0000000..23dcbd7 --- /dev/null +++ b/deployment/machine/ssh.scm @@ -0,0 +1,64 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment machine ssh) + #:use-module ((deployment system aisaka) + #:prefix deployment:system:aisaka:) + #:use-module ((deployment system akashi) + #:prefix deployment:system:akashi:) + #:use-module ((gnu machine ssh) + #:prefix gnu:machine:ssh:) + #:use-module ((sovereign machine) + #:prefix sovereign:machine:)) + +(define open-machine-ssh-session* + (@@ (gnu machine ssh) + open-machine-ssh-session*)) + +(define-public aisaka-configuration + (gnu:machine:ssh:machine-ssh-configuration + (host-name deployment:system:aisaka:host-name-aisaka) + (system sovereign:machine:system-x86-linux) + (build-locally? #t) + (authorize? #t) + (allow-downgrades? #f) + (safety-checks? #t) + (port 22) + (user "marek") + (identity "./id_ed25519") + (session (open-machine-ssh-session* (@@ (gnu machine ssh) + this-machine-ssh-configuration))) + (host-key "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM0Eh0q54myeSEironEP9DEKl+ownYuH7oSgAVuLIDNt marek@aisaka"))) + +(define-public akashi-configuration + (gnu:machine:ssh:machine-ssh-configuration + (host-name deployment:system:akashi:host-name) + (system sovereign:machine:system-x86-linux) + (build-locally? #t) + (authorize? #t) + (allow-downgrades? #f) + (safety-checks? #t) + (port 22) + (user "marek") + (identity "./id_ed25519") + (session (open-machine-ssh-session* (@@ (gnu machine ssh) + this-machine-ssh-configuration))) + (host-key "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICtEYtiph2TwshHHSQhLL7A2ZvFMCogWuI8vfS3jLQsm marek@akashi"))) + diff --git a/deployment/services.scm b/deployment/services.scm new file mode 100644 index 0000000..f34e200 --- /dev/null +++ b/deployment/services.scm @@ -0,0 +1,26 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services) + #:use-module (sovereign services) + #:export (qemu-binfmt_rakan-record)) + +(define qemu-binfmt_rakan-record + (qemu-binfmt_service-record)) diff --git a/deployment/services/certbot.scm b/deployment/services/certbot.scm new file mode 100644 index 0000000..17fa421 --- /dev/null +++ b/deployment/services/certbot.scm @@ -0,0 +1,82 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services certbot) + #:export (aisaka-certbot-service) + #:use-module (gnu services) + #:use-module (gnu services certbot) + #:use-module (guix gexp) + #:use-module ((deployment services web) + #:prefix deployment:services:web:) + #:use-module ((gnu services web) + #:prefix gnu:services:web:)) + +(define nginx-extension-of-certbot + (service-extension deployment:services:web:nginx-service-type* + (@@ (gnu services certbot) + certbot-nginx-server-configurations))) + +(define (extend-certbot extension) + (let* + ((extension-target- (service-extension-target extension)) + (nginx-service-type?- (eq? extension-target- + gnu:services:web:nginx-service-type))) + (if nginx-service-type?- + nginx-extension-of-certbot + extension))) + +(define certbot-type + (let + ((certbot-extensions- (service-type-extensions certbot-service-type))) + (service-type + (inherit certbot-service-type) + (extensions (map extend-certbot + certbot-extensions-))))) + +(define nginx-deploy-hook-file + #~(let + ((pid (call-with-input-file "/var/run/nginx/pid" + read))) + (kill pid + SIGHUP))) + +(define aisaka-certificate-configuration + (certificate-configuration + (deploy-hook (program-file "nginx-deploy-hook" + nginx-deploy-hook-file)) + (domains (list "marekpasnikowski.pl" + "git.marekpasnikowski.pl" + "guix.marekpasnikowski.pl" + "matrix.marekpasnikowski.pl" + ;; "mx.marekpasnikowski.pl" + "radicale.marekpasnikowski.pl" + "www.marekpasnikowski.pl")))) + +(define aisaka-certbot-configuration + (certbot-configuration + (certificates (list aisaka-certificate-configuration)) + (email "marek@marekpasnikowski.pl") + (webroot "/srv/www/marek/marekpasnikowski.pl"))) + +(define aisaka-certbot-service + (service certbot-type + aisaka-certbot-configuration)) + +;;; EOF diff --git a/deployment/services/cgit.scm b/deployment/services/cgit.scm new file mode 100644 index 0000000..6bdf812 --- /dev/null +++ b/deployment/services/cgit.scm @@ -0,0 +1,94 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services cgit) + #:export (aisaka-cgit-service) + #:use-module (gnu services) + #:use-module (gnu services cgit) + #:use-module (gnu services web) + #:use-module ((deployment services version-control) + #:prefix deployment:services:version-control:) + #:use-module ((deployment services web) + #:prefix deployment:services:web:) + #:use-module ((gnu packages version-control) + #:prefix gnu:packages:version-control:) + #:use-module ((gnu services version-control) + #:prefix gnu:services:version-control:)) + +(define cgit-repository-configuration + (repository-cgit-configuration + (hide? #t) + (path "/srv/git/marek/packages"))) + +(define nginx-location-cgit + (nginx-location-configuration + (body (list "fastcgi_param HTTP_HOST $server_name ;" + "fastcgi_param PATH_INFO $uri ;" + "fastcgi_param QUERY_STRING $args ;" + "fastcgi_param SCRIPT_FILENAME $document_root/lib/cgit/cgit.cgi ;" + "fastcgi_pass 127.0.0.1:9000 ;")) + (uri "@cgit"))) + +(define nginx-server-cgit + (nginx-server-configuration + (locations (list deployment:services:version-control:aisaka-git-http-nginx-location + nginx-location-cgit + deployment:services:web:nginx-location-well-known)) + (listen (list "192.168.10.2:443 ssl")) + (root gnu:packages:version-control:cgit) + (server-name (list "git.marekpasnikowski.pl")) + (ssl-certificate "/etc/letsencrypt/live/marekpasnikowski.pl/fullchain.pem") + (ssl-certificate-key "/etc/letsencrypt/live/marekpasnikowski.pl/privkey.pem") + (try-files (list "$uri" "@cgit")))) + +(define nginx-extension-of-cgit + (service-extension deployment:services:web:nginx-service-type* + cgit-configuration-nginx-config)) + +(define (extend-cgit extension) + (let* + ((extension-target- (service-extension-target extension)) + (nginx-service-type?- (eq? extension-target- + nginx-service-type))) + (if nginx-service-type?- + nginx-extension-of-cgit + extension))) + +(define cgit-type + (let + ((cgit-extensions- (service-type-extensions cgit-service-type))) + (service-type + (inherit cgit-service-type) + (extensions (map extend-cgit + cgit-extensions-))))) + +(define aisaka-cgit-configuration + (cgit-configuration + (nginx (list nginx-server-cgit)) + (repositories (list cgit-repository-configuration)) + (project-list (list "deployment.git" + "sovereign.git")) + (repository-directory "/var/lib/gitolite/repositories"))) + +(define-public aisaka-cgit-service + (service cgit-type + aisaka-cgit-configuration)) + +;;; EOF diff --git a/deployment/services/databases.scm b/deployment/services/databases.scm new file mode 100644 index 0000000..7451477 --- /dev/null +++ b/deployment/services/databases.scm @@ -0,0 +1,63 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services databases) + #:use-module (gnu services) + #:use-module (gnu services databases) + #:use-module (guix gexp) + #:use-module ((gnu packages databases) + #:prefix gnu:packages:databases:) + #:export (matrix-postgresql-service)) + +(define postgres-hba + (mixed-text-file "pg_hba.conf" + "host synapse synapse_user 127.0.0.1/32 trust\n" + "host synapse synapse_user ::1/128 trust\n" + "local all all peer\n" + "host all all 127.0.0.1/32 md5\n" + "host all all ::1/128 md5\n")) + +(define config-file + (postgresql-config-file + (log-destination "syslog") + (hba-file postgres-hba) + (ident-file (@@ (gnu services databases) + %default-postgres-ident)) + (socket-directory "/var/run/postgresql") + (extra-config (list)))) + +(define matrix-postgresql-service-configuration + (postgresql-configuration + (postgresql gnu:packages:databases:postgresql-17) + (port 5432) + (locale "pl_PL.utf8") + (config-file config-file) + (log-directory "/var/log/postgresql") + (data-directory "/var/lib/postgresql/data") + (extension-packages (list)) + (create-account? #t) + (home-directory "/var/lib/postgresql") + (allow-login? #t) + (uid 501) + (gid 501))) + +(define matrix-postgresql-service + (service postgresql-service-type + matrix-postgresql-service-configuration)) diff --git a/deployment/services/dns.scm b/deployment/services/dns.scm new file mode 100644 index 0000000..3b423b0 --- /dev/null +++ b/deployment/services/dns.scm @@ -0,0 +1,83 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services dns) + #:export (knot-service-aisaka + wireguard-endpoint) + #:use-module (gnu services) + #:use-module (gnu services dns)) + +(define ip-multimedia "81.190.248.246") + +(define ip-otvarta "95.171.119.109") + +(define ttl "3600") + +(define spf-value + (string-append "\"v=spf1 ip4:" + ip-otvarta + " -all\"")) + +(define wireguard-endpoint + (string-append ip-multimedia + ":51820")) + +(define-zone-entries marekpasnikowski.pl-entries + ("@" ttl "IN" "A" ip-otvarta) + ("1" ttl "IN" "A" ip-otvarta) + ("ns1" ttl "IN" "A" ip-otvarta) + ("@" ttl "IN" "NS" "ns1.marekpasnikowski.pl.") + ("@" ttl "IN" "A" ip-multimedia) + ("2" ttl "IN" "A" ip-multimedia) + ("ns2" ttl "IN" "A" ip-multimedia) + ("@" ttl "IN" "NS" "ns2.marekpasnikowski.pl.") + ("@" ttl "IN" "MX" "10 1.marekpasnikowski.pl.") + ("@" ttl "IN" "TXT" spf-value) + ("_caldavs._tcp" ttl "IN" "SRV" "10 0 443 radicale.marekpasnikowski.pl") + ("_carddavs._tcp" ttl "IN" "SRV" "10 0 443 radicale.marekpasnikowski.pl") + ("_dmarc" ttl "IN" "TXT" "\"adkim=s; aspf=s; p=reject; pct=100; sp=reject; v=DMARC1\"") + ("dkim._domainkey" ttl "IN" "TXT" "\"v=DKIM1; d=marekpasnikowski.pl; t=s; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo/b/WV5EUxqAhBgJ4v5K3sP8QI+IwziRJ/F9SDO3p3QOMjZd9AGVt2/AztZ4EmcOJnTlbQnLE/DKCOq4HAdxSZjIqj5AXyMddvWiO78+ugdame/flV0tjdDGNflx65Twap3qgJ9jzhvJfZ1BDuh2WC06fn2pyFl1TCETEGp6ZDkI41FW5GH8l9Jk7hhCmr+Mau0EpE7V42lBdireItOA1e7jQcub50584QATme4rYxA7WR4AeIsknOkUo4q8vkVrssoP11nSg/sNM9RGn1QDfVMJRX0twtgGnJ8N5QE4Ia9DvXL4Y0PNMC0/frp13pB6m1VQP/Z4jfDy+TQzEdSRaQIDAQAB\"") + ("git" ttl "IN" "CNAME" "2") + ("guix" ttl "IN" "CNAME" "2") + ("matrix" ttl "IN" "CNAME" "2") + ("radicale" ttl "IN" "CNAME" "2") + ("www" ttl "IN" "CNAME" "2")) + +(define marekpasnikowski.pl-zone + (zone-file + (entries marekpasnikowski.pl-entries) + (origin "marekpasnikowski.pl") + (ns "ns1.marekpasnikowski.pl.") + (mail "marek.marekpasnikowski.pl.") + (serial 2026042801))) + +(define aisaka-master-zone + (knot-zone-configuration + (domain "marekpasnikowski.pl") + (zone marekpasnikowski.pl-zone))) + +(define aisaka-knot-configuration + (knot-configuration + (listen-v4 "0.0.0.0") + (zones (list aisaka-master-zone)))) + +(define knot-service-aisaka + (service knot-service-type + aisaka-knot-configuration)) diff --git a/deployment/services/mail.scm b/deployment/services/mail.scm new file mode 100644 index 0000000..0101de9 --- /dev/null +++ b/deployment/services/mail.scm @@ -0,0 +1,177 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2019 Julien Lepiller <julien@lepiller.eu> +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2019, Julien Lepiller <julien@lepiller.eu> +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services mail) + #:export (dkimproxy-out-service + etc-mailname-aisaka + smtp-service-aisaka) + #:use-module (gnu services) + #:use-module (gnu services mail) + #:use-module (guix gexp) + #:use-module (sovereign services mail) + #:use-module ((gnu packages mail) + #:prefix gnu:packages:mail:)) + +(define dkimproxy-out-signature-configuration-marekpasnikowski.pl-dkim + (dkimproxy-out-signature-configuration + (algorithm "rsa-sha256") + (key "/etc/mail/dkim/marekpasnikowski.pl.key") + (method "relaxed") + (selector "dkim") + (type 'dkim))) + +(define dkimproxy-out-signature-configuration-marekpasnikowski.pl-domainkeys + (dkimproxy-out-signature-configuration + (method "mofws") + (type 'domainkeys))) + +(define dkimproxy-out-signature-configurations-marekpasnikowski.pl + (list dkimproxy-out-signature-configuration-marekpasnikowski.pl-dkim + dkimproxy-out-signature-configuration-marekpasnikowski.pl-domainkeys)) + +(define dkimproxy-out-configuration-sender-map-marekpasnikowski.pl + (list "marekpasnikowski.pl" + dkimproxy-out-signature-configurations-marekpasnikowski.pl)) + +(define dkimproxy-out-configuration-marekpasnikowski.pl + (dkimproxy-out-configuration + (listen "127.0.0.1:10027") + (relay "127.0.0.1:10028") + (sender-map (list dkimproxy-out-configuration-sender-map-marekpasnikowski.pl)))) + +(define dkimproxy-out-service + (service dkimproxy-out-service-type + dkimproxy-out-configuration-marekpasnikowski.pl)) + +(define aliases-file + (mixed-text-file "aliases" + "@ vmail\n")) + +(define blacklist-file + (mixed-text-file "blacklist" + "@yahoo.com.cn\n" + "@qq.com\n" + "@fnac.com\n" + "@just-aero.us\n" + "@elitetorrent1.com\n")) + +(define relays-file + (mixed-text-file "other-relays" + "mx1.forwardemail.net\n" + "mx2.forwardemail.net\n")) + +(define smtpd-keys "/secrets/smtpd") + +(define (smtpd-conf interface domain) + (mixed-text-file "smtpd.conf" + "# This is the smtpd server system-wide configuration file.\n" + "# See smtpd.conf(5) for more information.\n" + "\n" + "# My TLS certificate and key\n" + "pki marekpasnikowski.pl cert \"/etc/letsencrypt/live/" domain "/fullchain.pem\"\n" + "pki marekpasnikowski.pl key \"/etc/letsencrypt/live/" domain "/privkey.pem\"\n" + "\n" + "# Edit this file to add add more virtual users (passwords are read in that file\n" + "# instead of /etc/passwd\n" + "table passwd file:" smtpd-keys "\n" + "\n" + "# table other-relays file:" relays-file "\n" + "table blacklist file:" blacklist-file "\n" + "\n" + "# A simple spam filter\n" + "# filter spam-filter phase mail-from match mail-from <blacklist> reject \"555\"\n" + "\n" + "# port 25 is used only for receiving from external servers, and they may start\n" + "# a TLS session if they want.\n" + "listen on " interface " port 25 # tls pki marekpasnikowski.pl filter spam-filter\n" + "\n" + "# For sending messages from outside of this server, you need to authenticate and\n" + "# use TLS.\n" + "listen on " interface " port 465 smtps pki marekpasnikowski.pl mask-src auth <passwd>\n" + "\n" + "# Localhost is used by the .onion, so we use the same configuration for \n" + "# local connections." + "listen on lo port 25 tls pki marekpasnikowski.pl filter spam-filter\n" + "# Since incoming connection uses tor, we don't need tls, but still require\n" + "# authentication; we're not a relay\n" + "# listen on lo port 587 tls pki marekpasnikowski.pl mask-src auth <passwd>\n" + "\n" + "# DKIMproxy\n" + "listen on lo port 10028 tag DKIM_OUT\n" + "\n" + "# The socket is considered an internal connection\n" + "listen on socket mask-src\n" + "\n" + "# Maybe it'll work better if we connect to gmail only with v4?\n" + "# limit mta for domain gmail.com inet4\n" + "\n" + "# TODO: manage these files directly in the configuration?\n" + "# If you edit the file, you have to run \"smtpctl update table aliases\"\n" + "table aliases file:" aliases-file "\n" + "\n" + "# We define some actions\n" + "action receive lmtp \"/var/run/dovecot/lmtp\" rcpt-to virtual <aliases>\n" + "action godkim relay host smtp://localhost:10027\n" + "action outbound relay src \"192.168.1.2\" helo " domain "\n" + "\n" + "# We accept to relay any mail from authenticated users\n" + "match for any from any auth action godkim\n" + "match tag DKIM_OUT for any action outbound\n" + "\n" + "# Then, we reject on some other conditions:\n" + "\n" + "# If the mail tries to impersonate us\n" + "# match !from src <other-relays> mail-from \"@marekpasnikowski.pl\" for any reject\n" + "\n" + "# If it comes from someone on the blacklist\n" + "match from any mail-from <blacklist> reject\n" + "\n" + "# Finally, if we accept incoming messages\n" + "match from any for domain \"marekpasnikowski.pl\" action receive\n" + "match for local action receive\n" )) + +(define opensmtpd-configuration-aisaka + (opensmtpd-configuration + (package gnu:packages:mail:opensmtpd) + (shepherd-requirement (list 'dkimproxy-out + 'networking)) + (config-file (smtpd-conf "enp2s0" + "marekpasnikowski.pl")) + (log-file "/val/log/mail.log") + (setgid-commands? #t))) + +(define etc-mailname-aisaka + (let* + ((file (plain-file "mailname-aisaka" + "marekpasnikowski.pl\n")) + (mailname (list "mailname" + file)) + (links (list mailname))) + (simple-service 'etc-mailname + etc-service-type + links))) + +(define smtp-service-aisaka + (service opensmtpd-service-type + opensmtpd-configuration-aisaka)) + +;;; EOF diff --git a/deployment/services/matrix.scm b/deployment/services/matrix.scm new file mode 100644 index 0000000..aeac883 --- /dev/null +++ b/deployment/services/matrix.scm @@ -0,0 +1,80 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services matrix) + #:use-module (gnu services) + #:use-module (guix gexp) + #:use-module (sovereign services matrix) + #:use-module ((gnu packages matrix) + #:prefix gnu:packages:matrix:) + #:export (matrix-service-aisaka + matrix-service-rakan)) + +(define matrix-service-aisaka + (service matrix-service-type)) + +(define homeserver-configuration-file-rakan + (mixed-text-file "homeserver.yaml" + "# Configuration file for Synapse.\n" + "#\n" + "# This is a YAML file: see [1] for a quick introduction. Note in particular\n" + "# that *indentation is important*: all the elements of a list or dictionary\n" + "# should have the same indentation." + "#\n" + "# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html\n" + "# For more information on how to configura Synapse, including a complete accounting of\n" + "# each option, go to docs/usage/configuratoin/config_documentation.md or\n" + "# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html\n" + "server_name: \"marekpasnikowski.pl\"\n" + "pid_file: /home/matrix/data/homeserver.pid\n" + "listeners:\n" + " - port: 8008\n" + " tls: false\n" + " type: http\n" + " x_forwarded: true\n" + " bind_addresses: ['::1', '127.0.0.1']\n" + " resources:\n" + " - names: [client]\n" + " compress: false\n" + "database:\n" + " name: sqlite3\n" + " args:\n" + " database: /home/matrix/data/homeserver.db\n" + "log_config: \"/home/matrix/keys/marekpasnikowski.pl.log.config\"\n" + "media_store_path: /home/matrix/data/media_store\n" + "registration_shared_secret: /home/matrix/keys/registration_shared_secret\n" + "report_stats: false\n" + "macaroon_secret_key: /home/matrix/keys/macaroon_secret_key\n" + "form_secret: /home/matrix/keys/form_secret\n" + "signing_key_path: \"/home/matrix/keys/marekpasnikowski.pl.signing.key\"\n" + "trusted_key_servers:\n" + " - server_name: \"matrix.org\"\n" + "\n" + "\n" + "# vim:ft=yaml\n")) + +(define matrix-configuration-rakan + (matrix-configuration + (package gnu:packages:matrix:synapse) + (homeserver-yaml homeserver-configuration-file-rakan))) + +(define matrix-service-rakan + (service matrix-service-type + matrix-configuration-rakan)) diff --git a/deployment/services/networking.scm b/deployment/services/networking.scm new file mode 100644 index 0000000..a205fc4 --- /dev/null +++ b/deployment/services/networking.scm @@ -0,0 +1,28 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services networking) + #:export (network-online-service-aisaka) + #:use-module ((sovereign services networking) + #:prefix sovereign:services:networking:)) + +(define network-online-service-aisaka sovereign:services:networking:network-online-throwaway-service) + +;;; EOF diff --git a/deployment/services/nfs.scm b/deployment/services/nfs.scm new file mode 100644 index 0000000..2e9336b --- /dev/null +++ b/deployment/services/nfs.scm @@ -0,0 +1,95 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services nfs) + #:export (autofs-aisaka_service + autofs-akashi_service + autofs-rakan_service-record + nfs-akashi_service + nfs-rakan_service-record + service-nfs-aisaka) + #:use-module (gnu services nfs) + #:use-module (sovereign services nfs)) + +(define autofs-indirect-map/mnt_record + (autofs-indirect-map + (inherit %autofs-indirect-map/mnt_record) + (entries (list (autofs-map-entry + (inherit %autofs-map-entry/nfs_record) + (device "10.0.0.1:/home/marek/Szablony") + (mount-point "szablony")) + (autofs-map-entry + (inherit %autofs-map-entry/nfs_record) + (device "10.0.0.1:/home/marek/Dokumenty") + (mount-point "dokumenty")))))) + +(define autofs-aisaka_record + (autofs-configuration + (inherit %autofs-configuration_record) + (mounts (list autofs-indirect-map/mnt_record)))) + +(define autofs-akashi_record + (autofs-configuration + (inherit %autofs-configuration_record) + (mounts (list autofs-indirect-map/mnt_record)))) + +(define autofs-rakan_configuration-record + (autofs-configuration + (inherit %autofs-configuration_record) + (mounts (list autofs-indirect-map/mnt_record)))) + +(define nfs-server-aisaka + (let + ((Export-Dokumenty (list "/home/marek/Dokumenty" + "10.0.0.0/24(rw)")) + (Export-Szablony (list "/home/marek/Szablony" + "10.0.0.0/24(rw)"))) + (nfs-configuration + (inherit %nfs-configuration) + (exports (list Export-Dokumenty + Export-Szablony))))) + +(define nfs-client-akashi + (nfs-configuration + (inherit %nfs-configuration))) + +(define nfs-rakan_service-record + (nfs-configuration + (inherit %nfs-configuration))) + +(define autofs-aisaka_service + (autofs_proc autofs-aisaka_record)) + +(define autofs-akashi_service + (autofs_proc autofs-akashi_record)) + +(define autofs-rakan_service-record + (autofs_proc autofs-rakan_configuration-record)) + +(define service-nfs-aisaka + (service-nfs nfs-server-aisaka)) + +(define nfs-akashi_service + (service-nfs nfs-client-akashi)) + +(define nfs-rakan_service-record + (service-nfs nfs-rakan_service-record)) + +;;; EOF diff --git a/deployment/services/version-control.scm b/deployment/services/version-control.scm new file mode 100644 index 0000000..3c89c05 --- /dev/null +++ b/deployment/services/version-control.scm @@ -0,0 +1,33 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services version-control) + #:export (aisaka-git-http-nginx-location) + #:use-module (gnu services version-control)) + +(define aisaka-git-http-configuration + (git-http-configuration + (git-root "/var/lib/gitolite/repositories") + (uri-path "/git"))) + +(define-public aisaka-git-http-nginx-location + (git-http-nginx-location-configuration aisaka-git-http-configuration)) + +;;; EOF diff --git a/deployment/services/vpn.scm b/deployment/services/vpn.scm new file mode 100644 index 0000000..53a7623 --- /dev/null +++ b/deployment/services/vpn.scm @@ -0,0 +1,115 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services vpn) + #:export (wireguard-service-aisaka + wireguard-service-akashi + wireguard-service-ayase + wireguard-service-giewont + wireguard-service-rakan) + #:use-module (gnu services) + #:use-module (gnu services vpn) + #:use-module (sovereign services vpn) + #:use-module ((deployment services dns) + #:prefix deployment:services:dns:)) + +(define wireguard-peer-aisaka + (wireguard-peer + (inherit %wireguard-peer) + (name "aisaka") + (endpoint deployment:services:dns:wireguard-endpoint) + (public-key "7B6fgIKVZs6DWN3hdDGlYI8XpvHWGCjZKh6kbY/KKg8="))) + +(define wireguard-peer-akashi + (wireguard-peer + (inherit %wireguard-peer) + (name "akashi") + (public-key "p0X7zaemU0NyuJ+UiKVZ/4HfC8vj5z9kJK9j/iJDwT8=") + (allowed-ips (list "10.0.0.4/32")))) + +(define wireguard-peer-ayase + (wireguard-peer + (inherit %wireguard-peer) + (name "ayase") + (public-key "mzz5aZ0TLPj1WNK+PqpPILlUn16i371OGWVwuU0iDnQ=") + (allowed-ips (list "10.0.0.5/32")))) + +(define wireguard-peer-giewont + (wireguard-peer + (inherit %wireguard-peer) + (name "giewont") + (public-key "/XsuEpAHX1iEc5abcmY9sYTx8qETAuSLjEmx5ekqfwM=") + (allowed-ips (list "10.0.0.2/32")))) + +(define wireguard-peer-rakan + (wireguard-peer + (inherit %wireguard-peer) + (name "rakan") + (public-key "vOEJivgw9C7wZwYX3Kiqw3Ycl6wErr8N9z3BmkhF0Us=") + (allowed-ips (list "10.0.0.3/32")))) + +(define wireguard-configuration-aisaka + (wireguard-configuration + (inherit %wireguard-configuration) + (peers (list wireguard-peer-akashi + wireguard-peer-ayase + wireguard-peer-giewont + wireguard-peer-rakan)))) + +(define wireguard-configuration-akashi + (wireguard-configuration + (inherit %wireguard-configuration) + (addresses (list "10.0.0.4/24")) + (peers (list wireguard-peer-aisaka)))) + +(define wireguard-configuration-ayase + (wireguard-configuration + (inherit %wireguard-configuration) + (addresses (list "10.0.0.5/24")) + (peers (list wireguard-peer-aisaka)))) + +(define wireguard-configuration-giewont + (wireguard-configuration + (inherit %wireguard-configuration) + (addresses (list "10.0.0.2/24")) + (peers (list wireguard-peer-aisaka)))) + +(define wireguard-configuration-rakan + (wireguard-configuration + (inherit %wireguard-configuration) + (addresses (list "10.0.0.3/24")) + (peers (list wireguard-peer-aisaka)))) + +(define wireguard-service-aisaka + (wireguard-service wireguard-configuration-aisaka)) + +(define wireguard-service-akashi + (wireguard-service wireguard-configuration-akashi)) + +(define wireguard-service-ayase + (wireguard-service wireguard-configuration-ayase)) + +(define wireguard-service-giewont + (wireguard-service wireguard-configuration-giewont)) + +(define wireguard-service-rakan + (wireguard-service wireguard-configuration-rakan)) + +;;; EOF diff --git a/deployment/services/web.scm b/deployment/services/web.scm new file mode 100644 index 0000000..b076056 --- /dev/null +++ b/deployment/services/web.scm @@ -0,0 +1,182 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment services web) + #:export (fcgiwrap-service-aisaka + nginx-service-aisaka + nginx-location-well-known + nginx-service-type*) + #:use-module (gnu services) + #:use-module (gnu services web) + #:use-module (guix gexp) + #:use-module ((gnu packages matrix) + #:prefix gnu:packages:matrix:) + #:use-module ((gnu packages web) + #:prefix gnu:packages:web:) + #:use-module ((gnu system shadow) + #:prefix gnu:system:shadow:) + #:use-module ((sovereign system accounts) + #:prefix sovereign:system:accounts:)) + +(define fcgiwrap-configuration-aisaka + (fcgiwrap-configuration + (package gnu:packages:web:fcgiwrap) + (socket "tcp:127.0.0.1:9000") + (user "git") + (group "git"))) + +(define fcgiwrap-service-aisaka + (service + fcgiwrap-service-type + fcgiwrap-configuration-aisaka)) + +(define nginx-accounts + (let + ((accounts- (list sovereign:system:accounts:nginx-group + sovereign:system:accounts:nginx-account))) + (const accounts-))) + +(define nginx-extension-of-account + (service-extension gnu:system:shadow:account-service-type + nginx-accounts)) + +(define (extend-account extension) + (let* + ((extension-target- (service-extension-target extension)) + (account-service-type?- (eq? extension-target- + gnu:system:shadow:account-service-type))) + (if account-service-type?- + nginx-extension-of-account + extension))) + +(define nginx-service-type* + (let + ((nginx-extensions- (service-type-extensions nginx-service-type))) + (service-type + (inherit nginx-service-type) + (extensions (map extend-account + nginx-extensions-))))) + +(define nginx-location-proxy-guix + (nginx-location-configuration + (body (list "proxy_pass http://localhost:8080/ ;" + "proxy_set_header X-Script-Name \"\" ;" + "proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for ;" + "proxy_set_header Host $http_host ;" + "proxy_pass_header Authorization ;")) + (uri "/"))) + +(define nginx-location-proxy-matrix + (nginx-location-configuration + (body (list "proxy_pass http://localhost:8008 ;" + "proxy_set_header X-Forwarded-For $remote_addr ;" + "proxy_set_header X-Forwarded-Proto $scheme ;" + "proxy_set_header Host $host:$server_port ;" + "client_max_body_size 1024M ;")) + (uri "~ ^(/_matrix|/_synapse/client)"))) + +(define nginx-location-proxy-radicale + (nginx-location-configuration + (body (list "proxy_pass http://localhost:5232/ ;" + "proxy_set_header X-Script-Name \"\" ;" + "proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for ;" + "proxy_set_header Host $http_host ;" + "proxy_pass_header Authorization ;")) + (uri "/"))) + +(define nginx-location-proxy-auth + (nginx-location-configuration + (body (list "proxy_set_header Host $host;" + "proxy_set_header X-Real-IP $remote_addr;" + "proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;" + "proxy_set_header X-Forwarded-Proto $scheme;" + "if ($ssl_client_verify != SUCCESS) {return 403;}")) + (uri "/"))) + +(define nginx-location-well-known + (nginx-location-configuration + (body (list "root /srv/www/marek/marekpasnikowski.pl ;")) + (uri "/.well-known"))) + +(define nginx-location-well-known-matrix-client + (nginx-location-configuration + (body (list "return 200 '{\"m.homeserver\": {\"base_url\": \"https://matrix.marekpasnikowski.pl\"}}' ;" + "default_type application/json ;" + "add_header Access-Control-Allow-Origin * ;")) + (uri "/.well-known/matrix/client"))) + +(define nginx-server-guix + (nginx-server-configuration + (locations (list nginx-location-proxy-guix)) + (listen (list "192.168.10.2:443 ssl")) + (server-name (list "guix.marekpasnikowski.pl")) + (ssl-certificate "/etc/letsencrypt/live/marekpasnikowski.pl/fullchain.pem") + (ssl-certificate-key "/etc/letsencrypt/live/marekpasnikowski.pl/privkey.pem"))) + +(define nginx-server-matrix + (nginx-server-configuration + (locations (list nginx-location-proxy-matrix)) + (listen (list "192.168.10.2:443 ssl" + "192.168.10.2:8448 ssl default_server")) + (root (file-append gnu:packages:matrix:synapse + "/lib/python3.11/site-packages/synapse/static")) + (server-name (list "matrix.marekpasnikowski.pl")) + (ssl-certificate "/etc/letsencrypt/live/marekpasnikowski.pl/fullchain.pem") + (ssl-certificate-key "/etc/letsencrypt/live/marekpasnikowski.pl/privkey.pem") + (raw-content (list "proxy_http_version 1.1 ;")))) + +(define nginx-server-portal + (nginx-server-configuration + (locations (list nginx-location-well-known + nginx-location-well-known-matrix-client)) + (listen (list "192.168.10.2:443 ssl")) + (root "/srv/www/marek/marekpasnikowski.pl") + (server-name (list 'default + "marekpasnikowski.pl")) + (ssl-certificate "/etc/letsencrypt/live/marekpasnikowski.pl/fullchain.pem") + (ssl-certificate-key "/etc/letsencrypt/live/marekpasnikowski.pl/privkey.pem"))) + +(define nginx-server-radicale + (nginx-server-configuration + (locations (list nginx-location-proxy-radicale + nginx-location-well-known)) + (listen (list "192.168.10.2:443 ssl")) + (server-name (list "radicale.marekpasnikowski.pl")))) + +(define nginx-server-www + (nginx-server-configuration + (listen (list "192.168.10.2:443 ssl")) + (root "/srv/www/marek/marekpasnikowski.pl") + (server-name (list "www.marekpasnikowski.pl")))) + +(define nginx-configuration* + (nginx-configuration + (shepherd-requirement (list 'networking)) + (server-blocks (list nginx-server-portal + nginx-server-www + nginx-server-guix + nginx-server-matrix + nginx-server-radicale)))) + +(define nginx-service-aisaka + (service nginx-service-type* + nginx-configuration*)) + +;;; EOF diff --git a/deployment/system.scm b/deployment/system.scm new file mode 100644 index 0000000..0b411da --- /dev/null +++ b/deployment/system.scm @@ -0,0 +1,251 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment system) + #:export (aisaka + akashi + asakura + ayase + cokolwiek + mcdowell + rakan) + #:use-module (deployment system file-systems) + #:use-module (deployment services vpn) + #:use-module (gnu services) + #:use-module (gnu services base) + #:use-module (gnu system file-systems) + #:use-module (gnu system shadow) + #:use-module (guix gexp) + #:use-module (sovereign system file-systems) + #:use-module (sovereign systems) + #:use-module (users id1000) + #:use-module ((deployment system aisaka) + #:prefix deployment:system:aisaka:) + #:use-module ((deployment system akashi) + #:prefix deployment:system:akashi:) + #:use-module ((deployment system asakura) + #:prefix deployment:system:asakura:) + #:use-module ((deployment system ayase) + #:prefix deployment:system:ayase:) + #:use-module ((deployment system cokolwiek) + #:prefix deployment:system:cokolwiek:) + #:use-module ((deployment system mcdowell) + #:prefix deployment:system:mcdowell:) + #:use-module ((deployment system rakan) + #:prefix deployment:system:rakan:) + #:use-module ((gnu packages linux) + #:prefix gnu:packages:linux:) + #:use-module ((gnu packages tls) + #:prefix gnu:packages:tls:) + #:use-module ((gnu packages matrix) + #:prefix gnu:packages:matrix:) + #:use-module ((gnu system) + #:prefix gnu:system:) + #:use-module ((gnu system file-systems) + #:prefix gnu:system:file-systems:) + #:use-module ((gnu system linux-initrd) + #:prefix gnu:system:linux-initrd:) + #:use-module ((gnu system locale) + #:prefix gnu:system:locale:) + #:use-module ((gnu system nss) + #:prefix gnu:system:nss:) + #:use-module ((gnu system pam) + #:prefix gnu:system:pam:) + #:use-module ((gnu system shadow) + #:prefix gnu:system:shadow:) + #:use-module ((guix diagnostics) + #:prefix guix:diagnostics:) + #:use-module ((nongnu packages linux) + #:prefix nongnu:packages:linux:) + #:use-module ((nongnu system linux-initrd) + #:prefix nongnu:system:linux-initrd:) + #:use-module ((sovereign packages jekyll) + #:prefix sovereign:packages:jekyll:) + #:use-module ((sovereign services) + #:prefix sovereign:services:) + #:use-module ((sovereign systems) + #:prefix sovereign:systems:) + #:use-module ((users id1000) + #:prefix users:id1000:) + #:use-module ((users vmail) + #:prefix users:vmail:)) + +(define aisaka + (gnu:system:operating-system + (kernel nongnu:packages:linux:linux) + (kernel-loadable-modules (list)) + (kernel-arguments gnu:system:%default-kernel-arguments) + (hurd #f) + (bootloader deployment:system:aisaka:bootloader-aisaka) + (label (sovereign:systems:operating-system-label* deployment:system:aisaka:host-name-aisaka + gnu:system:this-operating-system)) + (keyboard-layout deployment:system:aisaka:system-keyboard-layout) + (initrd nongnu:system:linux-initrd:microcode-initrd) + (initrd-modules gnu:system:linux-initrd:%base-initrd-modules) + (firmware (list nongnu:packages:linux:linux-firmware)) + (host-name deployment:system:aisaka:host-name-aisaka) + (hosts-file #f) + (mapped-devices (list)) + (file-systems deployment:system:aisaka:file-systems) + (swap-devices (list)) + (users (cons* users:id1000:uid1000-account + users:vmail:vmail-account + gnu:system:shadow:%base-user-accounts)) + (groups (cons* deployment:system:aisaka:vmail-group + gnu:system:shadow:%base-groups)) + (skeletons (gnu:system:shadow:default-skeletons)) + (issue (@@ (gnu system) + %default-issue)) + (packages (cons* sovereign:packages:jekyll:custom-jekyll + gnu:packages:tls:openssl + gnu:system:%base-packages)) + (timezone "Europe/Warsaw") + (locale sovereign:systems:pl-locale) + (locale-definitions sovereign:systems:%sovereign-locale-definitions) + (locale-libcs gnu:system:locale:%default-locale-libcs) + (name-service-switch gnu:system:nss:%default-nss) + (essential-services (gnu:system:operating-system-default-essential-services gnu:system:this-operating-system)) + (services deployment:system:aisaka:services) + (pam-services (gnu:system:pam:base-pam-services)) + (privileged-programs gnu:system:%default-privileged-programs) + (setuid-programs gnu:system:%setuid-programs) + (sudoers-file sovereign:systems:%sovereign-sudoers-specification) + (location (and=> (current-source-location) + guix:diagnostics:source-properties->location)))) + +(define akashi deployment:system:akashi:system) + +(define asakura deployment:system:asakura:system) + +(define ayase + (gnu:system:operating-system + (inherit sovereign:systems:%sovereign-operating-system) + (kernel deployment:system:ayase:kernel) + (kernel-arguments (list "no_console_suspend" + "cryptomgr.notests" + "loglevel=3" + "clk_ignore_unused" + "cma=256M" + "swiotlb=65535" + "console=tty1")) + (bootloader deployment:system:ayase:bootloader) + (label "ayase") + (keyboard-layout sovereign:systems:keyboard-layout) + (initrd-modules (list "rfkill" + "dm_mod" + "rk805_pwrkey" + "hantro_vpu" + "snd_soc_wm8960" + ;; "rockchip_vdec2" + "v4l2_vp9" + "rockchip_saradc" + "v4l2_h264" + "v4l2_jpeg" + "industrialio_triggered_buffer" + "v4l2_mem2mem" + "rockchip_thermal" + "kfifo_buf" + "snd_soc_rockchip_i2s_tdm" + "videobuf2_dma_contig" + "videobuf2_memops" + "videobuf2_v4l2" + "panthor" + "videodev" + "drm_gpuvm" + "videobuf2_common" + "drm_exec" + "snd_soc_audio_graph_card" + "mc" + "drm_shmem_helper" + "gpu_sched" + "snd_soc_simple_card_utils" + "pci_endpoint_test" + "fuse" + ;; "ip_tables" + "x_tables" + "ipv6" + "onboard_usb_dev" + "dwmac_rk" + "stmmac_platform" + "stmmac" + ;; "crct10dif_ce" + "phy_rockchip_naneng_combphy" + "phy_rockchip_usbdp" + "typec" + "rtc_pcf8523" + "phy_rockchip_samsung_hdptx" + "pcs_xpcs" + "nvme" + "nvme_core" + "rockchipdrm" + "analogix_dp" + "dw_hdmi_qp" + "dw_mipi_dsi" + + ;; Some taken from in %base-initrd-modules a.k.a. default-initrd-modules + ;; May not be strictly needed... but you never know. + "ahci" + "dm-crypt" + "xts" + )) + (firmware (list ;; arm-trusted-firmware-rk3588 + nongnu:packages:linux:linux-firmware + gnu:packages:linux:wireless-regdb)) + (host-name "ayase") + (file-systems (cons* (file-system + (device (file-system-label "ayase-root")) + (mount-point "/") + (type "ext4")) + file-system-dokumenty + file-system-szablony + %base-file-systems)) + ;; (swap-devices ) + (users (cons* uid1000-account + %base-user-accounts)) + (skeletons (gnu:system:shadow:default-skeletons)) + (timezone "Europe/Warsaw") + (locale "pl_PL.utf8") + (services (cons* wireguard-service-ayase + (guix-home-service (list named-home-environment)) + (simple-service 'offload-extension + guix-service-type + (guix-extension + (authorized-keys (list (mixed-text-file "aisaka-guix-key.pub" + "(public-key\n" + " (ecc\n" + " (curve Ed25519)\n" + " (q #983CD313090D2699AD26AE5CB589A29F24A32E247A41EB4F4A22D196DFCD9D3C#)))"))) + (build-machines (list #~(build-machine + (name "www.marekpasnikowski.pl") + (systems (list "x86_64-linux" + "i686-linux" + "aarch64-linux")) + (user "marek") + (host-key "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM0Eh0q54myeSEironEP9DEKl+ownYuH7oSgAVuLIDNt root@aisaka") + (port 23) + (private-key "/home/marek/.ssh/id_ed25519")))))) + %sovereign-services)) + (sudoers-file sovereign:systems:%sovereign-sudoers-specification))) + +(define cokolwiek deployment:system:cokolwiek:system) + +(define mcdowell deployment:system:mcdowell:system) + +(define rakan deployment:system:rakan:system) diff --git a/deployment/system/aisaka.scm b/deployment/system/aisaka.scm new file mode 100644 index 0000000..aaebe5e --- /dev/null +++ b/deployment/system/aisaka.scm @@ -0,0 +1,358 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment system aisaka) + #:export (bootloader-aisaka + file-systems + host-name-aisaka + services) + #:use-module (guix gexp) + #:use-module (sovereign bootloader) + #:use-module (sovereign system file-systems) + #:use-module ((deployment gexp) + #:prefix deployment:gexp:) + #:use-module ((deployment services certbot) + #:prefix deployment:services:certbot:) + #:use-module ((deployment services cgit) + #:prefix deployment:services:cgit:) + #:use-module ((deployment services databases) + #:prefix deployment:services:databases:) + #:use-module ((deployment services dns) + #:prefix deployment:services:dns:) + #:use-module ((deployment services mail) + #:prefix deployment:services:mail:) + #:use-module ((deployment services matrix) + #:prefix deployment:services:matrix:) + #:use-module ((deployment services networking) + #:prefix deployment:services:networking:) + #:use-module ((deployment services nfs) + #:prefix deployment:services:nfs:) + #:use-module ((deployment services vpn) + #:prefix deployment:services:vpn:) + #:use-module ((deployment services web) + #:prefix deployment:services:web:) + #:use-module ((gnu bootloader) + #:prefix gnu:bootloader:) + #:use-module ((gnu bootloader grub) + #:prefix gnu:bootloader:grub:) + #:use-module ((gnu packages) + #:prefix gnu:packages:) + #:use-module ((gnu packages linux) + #:prefix gnu:packages:linux:) + #:use-module ((gnu packages tls) + #:prefix gnu:packages:tls:) + #:use-module ((gnu services) + #:prefix gnu:services:) + #:use-module ((gnu services base) + #:prefix gnu:services:base:) + #:use-module ((gnu services mail) + #:prefix gnu:services:mail:) + #:use-module ((gnu services networking) + #:prefix gnu:services:networking:) + #:use-module ((gnu services shepherd) + #:prefix gnu:services:shepherd:) + #:use-module ((gnu services version-control) + #:prefix gnu:services:version-control:) + #:use-module ((gnu system) + #:prefix gnu:system:) + #:use-module ((gnu system accounts) + #:prefix gnu:system:accounts:) + #:use-module ((gnu system file-systems) + #:prefix gnu:system:file-systems:) + #:use-module ((gnu system keyboard) + #:prefix gnu:system:keyboard:) + #:use-module ((gnu system linux-initrd) + #:prefix gnu:system:linux-initrd:) + #:use-module ((gnu system locale) + #:prefix gnu:system:locale:) + #:use-module ((gnu system nss) + #:prefix gnu:system:nss:) + #:use-module ((gnu system pam) + #:prefix gnu:system:pam:) + #:use-module ((guix diagnostics) + #:prefix guix:diagnostics:) + #:use-module ((nongnu packages linux) + #:prefix nongnu:packages:linux:) + #:use-module ((nongnu system linux-initrd) + #:prefix nongnu:system:linux-initrd:) + #:use-module ((sovereign packages jekyll) + #:prefix sovereign:packages:jekyll:) + #:use-module ((sovereign services) + #:prefix sovereign:services:) + #:use-module ((sovereign systems) + #:prefix sovereign:systems:) + #:use-module ((users id1000) + #:prefix users:id1000:) + #:use-module ((users vmail) + #:prefix users:vmail:)) + +(define gitolite-rc-file + (gnu:services:version-control:gitolite-rc-file + (umask #o0027))) + +(define gitolite-configuration + (gnu:services:version-control:gitolite-configuration + (rc-file gitolite-rc-file) + (admin-pubkey #f))) + +(define-public gitolite + (gnu:services:service + gnu:services:version-control:gitolite-service-type + gitolite-configuration)) + +(define-public system-keyboard-layout + (gnu:system:keyboard:keyboard-layout "pl")) + +(define rakan-machine + #~(build-machine + (name "rakan") + (systems (list "x86_64-linux" + "i686-linux" + "aarch64-linux")) + (user "marek") + (host-key "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFxlIhNlkWCNA+l/RiOJztB+VWhuJtDTUvSwwlE3MpgJ root@rakan") + (private-key "/home/marek/.ssh/id_ed25519"))) + +(define guix-offload-rakan + (gnu:services:base:guix-extension + (authorized-keys (list deployment:gexp:akashi-guix-key + deployment:gexp:ayase-guix-key + deployment:gexp:rakan-guix-key)) + (build-machines (list rakan-machine)))) + +(define-public offload-rakan + (gnu:services:simple-service 'offload-rakan + gnu:services:base:guix-service-type + guix-offload-rakan)) + +(define radicale-auth-configuration + (gnu:services:mail:radicale-auth-configuration + (type 'htpasswd) + (htpasswd-filename "/secrets/radicale/keys") + (htpasswd-encryption 'plain))) + +(define radicale-storage-configuration + (gnu:services:mail:radicale-storage-configuration + (filesystem-folder "/data/radicale/collections"))) + +(define radicale-configuration + (gnu:services:mail:radicale-configuration + (auth radicale-auth-configuration) + (storage radicale-storage-configuration))) + +(define-public radicale + (gnu:services:service + gnu:services:mail:radicale-service-type + radicale-configuration)) + +(define enp1s0-address-4 + (gnu:services:base:network-address + (device "enp1s0") + (value "192.168.10.2/24") + (ipv6? #f))) + +(define enp2s0-address-4 + (gnu:services:base:network-address + (device "enp2s0") + (value "192.168.1.2/24") + (ipv6? #f))) + +(define enp1s0-route-4-default + (gnu:services:base:network-route + (destination "default") + (source #f) + (device #f) + (ipv6? #f) + (gateway "192.168.10.1"))) + +(define network-hardware + (gnu:services:base:static-networking + (addresses (list enp1s0-address-4 + enp2s0-address-4)) + (links (list)) + (routes (list enp1s0-route-4-default)) + (name-servers (list "192.168.10.1" + "192.168.1.1")) + (provision (list 'network-hardware)) + (requirement (list)))) + +(define static-networking-configuration + (list network-hardware)) + +(define-public static-networking + (gnu:services:service + gnu:services:networking:static-networking-service-type + static-networking-configuration)) + +(define ip-command + (file-append gnu:packages:linux:iproute + "/sbin/ip")) + +(define network-enp2s0-route-default + (let + ((route-default- #~(list #$ip-command + "route" + "add" + "default" + "via" + "192.168.1.1" + "table" + "1"))) + (gnu:services:shepherd:shepherd-service + (provision (list 'network-enp2s0-route-default)) + (requirement (list 'network-enp2s0-table)) + (one-shot? #t) + (respawn? #f) + (start #~(make-forkexec-constructor #$route-default-)) + (stop #~(const #f)) + (actions (list)) + (auto-start? #t) + (documentation "Sets up a default route for traffic from enp2s0.") + (modules gnu:services:shepherd:%default-modules)))) + +(define network-enp2s0-table + (let + ((table- #~(list #$ip-command + "rule" + "add" + "from" + "192.168.1.2" + "table" + "1" + "prio" + "1"))) + (gnu:services:shepherd:shepherd-service + (provision (list 'network-enp2s0-table)) + (requirement (list 'network-hardware)) + (one-shot? #t) + (respawn? #f) + (start #~(make-forkexec-constructor #$table-)) + (stop #~(const #f)) + (actions (list)) + (auto-start? #t) + (documentation "Defines a table of rules number 1 for routes through enp2s0.") + (modules gnu:services:shepherd:%default-modules)))) + +(define networking + (gnu:services:shepherd:shepherd-service + (provision (list 'networking)) + (requirement (list 'network-enp2s0-table + 'network-enp2s0-route-default + 'network-online)) + (one-shot? #t) + (respawn? #f) + (start #~(const #t)) + (stop #~(const #f)) + (actions (list)) + (auto-start? #t) + (documentation "Defines a graph root of one-shot services to invoke various ip commands.") + (modules gnu:services:shepherd:%default-modules))) + +(define-public iproute2-networking + (let + ((extensions- (list network-enp2s0-table + network-enp2s0-route-default + networking))) + (gnu:services:simple-service 'networking + gnu:services:shepherd:shepherd-root-service-type + extensions-))) + +(define swap-device-izumi-1-label + (gnu:system:file-systems:file-system-label "izumi-swap-f")) + +(define-public %sovereign-services* + (gnu:services:modify-services sovereign:systems:%sovereign-services + (gnu:services:delete gnu:services:networking:network-manager-service-type))) + +(define-public system-bootloader + (gnu:bootloader:bootloader-configuration + (bootloader gnu:bootloader:grub:grub-efi-bootloader) + (targets (list "/boot")) + (keyboard-layout sovereign:systems:keyboard-layout))) + +(define-public vmail-group + (gnu:system:accounts:user-group + (name "vmail") + (system? #t))) + +(define named-home-environments + (list users:id1000:named-home-environment)) + +(define guix-publish-configuration + (gnu:services:base:guix-publish-configuration + (host "0.0.0.0") + (port 8080) + (advertise? #t))) + +(define-public guix-home-service + (sovereign:systems:guix-home-service named-home-environments)) + +(define-public guix-publish-service + (sovereign:services:guix-publish-service guix-publish-configuration)) + +(define host-name-aisaka "aisaka") + +(define bootloader-configuration-targets-aisaka + (list "/dev/nvme0n1")) + +(define bootloader-aisaka + (custom-bootloader-configuration bootloader-configuration-targets-aisaka)) + +(define file-system-boot + (gnu:system:file-systems:file-system + (inherit file-system/efi) + (device (file-system-label* "BOOT")))) + +(define file-system-root + (gnu:system:file-systems:file-system + (inherit file-system/root) + (device (file-system-label* host-name-aisaka + "root")))) + +(define file-systems + (cons* file-system-root + file-system-boot + gnu:system:file-systems:%base-file-systems)) + +(define services + (cons* deployment:services:certbot:aisaka-certbot-service + deployment:services:cgit:aisaka-cgit-service + deployment:services:mail:dkimproxy-out-service + users:id1000:dovecot-service + deployment:services:mail:etc-mailname-aisaka + deployment:services:web:fcgiwrap-service-aisaka + gitolite + guix-home-service + guix-publish-service + iproute2-networking + deployment:services:dns:knot-service-aisaka + deployment:services:databases:matrix-postgresql-service + deployment:services:matrix:matrix-service-aisaka + deployment:services:networking:network-online-service-aisaka + deployment:services:nfs:service-nfs-aisaka + deployment:services:web:nginx-service-aisaka + offload-rakan + radicale + deployment:services:mail:smtp-service-aisaka + static-networking + deployment:services:vpn:wireguard-service-aisaka + %sovereign-services*)) + +;;; EOF diff --git a/deployment/system/akashi.scm b/deployment/system/akashi.scm new file mode 100644 index 0000000..4e2bb24 --- /dev/null +++ b/deployment/system/akashi.scm @@ -0,0 +1,158 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment system akashi) + #:export (host-name) + #:use-module (guix gexp) + #:use-module (sovereign bootloader) + #:use-module (sovereign system file-systems) + #:use-module (users id1000) + #:use-module ((deployment gexp) + #:prefix deployment:gexp:) + #:use-module ((deployment services nfs) + #:prefix deployment:services:nfs:) + #:use-module ((deployment services vpn) + #:prefix deployment:services:vpn:) + #:use-module ((deployment system file-systems) + #:prefix deployment:system:file-systems:) + #:use-module ((gnu packages linux) + #:prefix gnu:packages:linux:) + #:use-module ((gnu services) + #:prefix gnu:services:) + #:use-module ((gnu services base) + #:prefix gnu:services:base:) + #:use-module ((gnu services guix) + #:prefix gnu:services:guix:) + #:use-module ((gnu system) + #:prefix gnu:system:) + #:use-module ((gnu system file-systems) + #:prefix gnu:system:file-systems:) + #:use-module ((gnu system keyboard) + #:prefix gnu:system:keyboard:) + #:use-module ((gnu system linux-initrd) + #:prefix gnu:system:linux-initrd:) + #:use-module ((gnu system locale) + #:prefix gnu:system:locale:) + #:use-module ((gnu system nss) + #:prefix gnu:system:nss:) + #:use-module ((gnu system pam) + #:prefix gnu:system:pam:) + #:use-module ((gnu system shadow) + #:prefix gnu:system:shadow:) + #:use-module ((guix diagnostics) + #:prefix guix:diagnostics:) + #:use-module ((sovereign systems) + #:prefix sovereign:systems:)) + +(define host-name "akashi") + +(define file-system-boot + (gnu:system:file-systems:file-system + (inherit file-system/efi) + (device (file-system-label* "BOOT")))) + +(define root-partition + ((@ (gnu system file-systems) file-system) + (mount-point "/") + (device ((@ (gnu system file-systems) file-system-label) "akashi-root")) + (type "ext4"))) + +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; + +(define system-keyboard-layout + (gnu:system:keyboard:keyboard-layout "pl")) + +(define offload-hub + #~(build-machine + (name "www.marekpasnikowski.pl") + (systems (list "x86_64-linux" + "i686-linux")) + (user "marek") + (host-key "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM0Eh0q54myeSEironEP9DEKl+ownYuH7oSgAVuLIDNt root@aisaka") + (port 23) + (private-key "/home/marek/.ssh/id_ed25519"))) + +(define guix-offload-targets + (gnu:services:base:guix-extension + (authorized-keys (list deployment:gexp:aisaka-guix-key)) + (build-machines (list offload-hub)))) + +(define offload-extension + (gnu:services:simple-service 'offload-extension + gnu:services:base:guix-service-type + guix-offload-targets)) + +(define home-environments + `((,uid1000-name ,uid1000-home-environment))) + +(define guix-home + (gnu:services:service gnu:services:guix:guix-home-service-type + home-environments)) + +(define-public system + (gnu:system:operating-system + (kernel gnu:packages:linux:linux-libre) + (kernel-loadable-modules (list)) + (kernel-arguments (cons* "thinkpad_acpi.fan_control=1" + "thinkpad_acpi.fan='level 2'" + gnu:system:%default-kernel-arguments)) + (hurd #f) + (bootloader (custom-bootloader-configuration (list "/dev/sda"))) + (label (sovereign:systems:operating-system-label* host-name + gnu:system:this-operating-system)) + (keyboard-layout system-keyboard-layout) + (initrd gnu:system:linux-initrd:base-initrd) + (initrd-modules gnu:system:linux-initrd:%base-initrd-modules) + (firmware (list)) + (host-name host-name) + (hosts-file #f) + (mapped-devices (list)) + (file-systems (cons* root-partition + file-system-boot + deployment:system:file-systems:file-system-dokumenty + deployment:system:file-systems:file-system-szablony + gnu:system:file-systems:%base-file-systems)) + (swap-devices (list)) + (users (list uid1000-account)) + (groups gnu:system:shadow:%base-groups) + (skeletons (gnu:system:shadow:default-skeletons)) + (issue (@@ (gnu system) + %default-issue)) + (packages gnu:system:%base-packages) + (timezone "Europe/Warsaw") + (locale sovereign:systems:pl-locale) + (locale-definitions sovereign:systems:%sovereign-locale-definitions) + (locale-libcs gnu:system:locale:%default-locale-libcs) + (name-service-switch gnu:system:nss:%default-nss) + (essential-services (gnu:system:operating-system-default-essential-services gnu:system:this-operating-system)) + (services (cons* guix-home + offload-extension + deployment:services:nfs:nfs-akashi_service + deployment:services:nfs:autofs-akashi_service + deployment:services:vpn:wireguard-service-akashi + sovereign:systems:%sovereign-services)) + (pam-services (gnu:system:pam:base-pam-services)) + (privileged-programs gnu:system:%default-privileged-programs) + (setuid-programs gnu:system:%setuid-programs) + (sudoers-file sovereign:systems:%sovereign-sudoers-specification) + (location (and=> (current-source-location) + guix:diagnostics:source-properties->location)))) + +(define-public operating-system* system) diff --git a/deployment/system/asakura.scm b/deployment/system/asakura.scm new file mode 100644 index 0000000..51e1610 --- /dev/null +++ b/deployment/system/asakura.scm @@ -0,0 +1,142 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment system asakura) + #:use-module (sovereign bootloader) + #:use-module ((gnu system) #:prefix gnu:system:) + #:use-module ((gnu system file-systems) #:prefix gnu:system:file-systems:) + #:use-module ((gnu system uuid) #:prefix gnu:system:uuid:) + #:use-module ((nongnu packages linux) #:prefix nongnu:packages:linux:) + #:use-module ((nongnu system linux-initrd) #:prefix nongnu:system:linux-initrd:) + #:use-module ((sovereign packages protonmail) #:prefix sovereign:packages:protonmail:) + #:use-module ((sovereign systems) #:prefix sovereign:systems:) + #:use-module ((users id1000) #:prefix users:id1000:)) + +(define efi-filesystem-uuid + (gnu:system:uuid:uuid + "B4FB-CBD9" + 'fat32)) + +(define host-name + "asakura") + +(define (label number) + (gnu:system:file-systems:file-system-label + (string-append host-name + "-swap" + number))) + +(define root-filesystem-uuid + (gnu:system:uuid:uuid + "615a98cd-a632-4ee5-a6f4-e5ebcaa6fb8c")) + +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; + +(define efi-partition + (gnu:system:file-systems:file-system + (mount-point "/boot") + (device efi-filesystem-uuid) + (type "vfat"))) + +(define keyboard-layout + ((@ (gnu system keyboard) keyboard-layout) + "pl")) + +(define (libvirt-service) + (use-modules (gnu services virtualization)) + ((@ (gnu services) service) + libvirt-service-type)) + +(define (virtlog-service) + (use-modules (gnu services virtualization)) + ((@ (gnu services) service) + virtlog-service-type)) + +(define root-partition + (gnu:system:file-systems:file-system + (mount-point "/") + (device root-filesystem-uuid) + (type "ext4"))) + +(define (swap-label number) + (let ((target-label (label number))) + (gnu:system:file-systems:swap-space + (target target-label)))) + +(define (system-packages-service) + (use-modules (gnu packages gnupg) + (gnu packages kde-pim) + (gnu services)) + (simple-service 'system-packages + profile-service-type + (list kgpg + pinentry-qt + pinentry-tty))) + +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; + +(define (file-systems) + (append gnu:system:file-systems:%base-file-systems + (list root-partition + efi-partition))) + +(define services + (let* + ( (l-guix-homes (list users:id1000:named-home-environment)) + (l-guix-home-service (sovereign:systems:guix-home-service l-guix-homes))) + (append sovereign:systems:%sovereign-services + (list sovereign:packages:protonmail:nogui-profile + l-guix-home-service + (system-packages-service))))) + +(define swap-device-1 + (swap-label "-1")) + +(define swap-device-2 + (swap-label "-2")) + +(define (users) + (use-modules (gnu system accounts)) + (append (@ (gnu system shadow) %base-user-accounts) + (list users:id1000:uid1000-account))) + +;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; + +(define-public system + (gnu:system:operating-system + (kernel nongnu:packages:linux:linux) + (bootloader (custom-bootloader-configuration (list))) + (label (sovereign:systems:operating-system-label* host-name + gnu:system:this-operating-system)) + (keyboard-layout keyboard-layout) + (initrd nongnu:system:linux-initrd:microcode-initrd) + (firmware (list nongnu:packages:linux:linux-firmware)) + (host-name host-name) + (file-systems (file-systems)) + (swap-devices (list swap-device-1 + swap-device-2)) + (users (users)) + (timezone "Europe/Warsaw") + (locale sovereign:systems:pl-locale) + (locale-definitions sovereign:systems:%sovereign-locale-definitions) + (services services) + (sudoers-file sovereign:systems:%sovereign-sudoers-specification))) + +(define-public operating-system* system) diff --git a/deployment/system/ayase.scm b/deployment/system/ayase.scm new file mode 100644 index 0000000..ea4f595 --- /dev/null +++ b/deployment/system/ayase.scm @@ -0,0 +1,36 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment system ayase) + #:export (bootloader + kernel) + #:use-module (gnu bootloader) + #:use-module ((mnt-reform rk3588) + #:prefix mnt-reform:rk3588:) + #:use-module ((sovereign packages linux) + #:prefix sovereign:packages:linux:)) + +(define bootloader + (bootloader-configuration + (targets (list "/dev/mmcblk0" + "/dev/nvme0n1")) + (bootloader mnt-reform:rk3588:pocket-rk3588-u-boot-bootloader))) + +(define kernel sovereign:packages:linux:linux-mnt-rk3588) diff --git a/deployment/system/cokolwiek.scm b/deployment/system/cokolwiek.scm new file mode 100644 index 0000000..e591e28 --- /dev/null +++ b/deployment/system/cokolwiek.scm @@ -0,0 +1,124 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment system cokolwiek) + #:use-module (sovereign bootloader) + #:use-module ( (deployment services vpn) + #:prefix deployment:services:vpn:) + #:use-module ( (gnu packages package-management) + #:prefix gnu:packages:package-management:) + #:use-module ( (gnu services) + #:prefix gnu:services:) + #:use-module ( (gnu services base) + #:prefix gnu:services:base:) + #:use-module ( (gnu services guix) + #:prefix gnu:services:guix:) + #:use-module ( (gnu system) + #:prefix gnu:system:) + #:use-module ( (gnu system file-systems) + #:prefix gnu:system:file-systems:) + #:use-module ( (gnu system linux-initrd) + #:prefix gnu:system:linux-initrd:) + #:use-module ( (gnu system shadow) + #:prefix gnu:system:shadow:) + #:use-module ( (nongnu packages linux) + #:prefix nongnu:packages:linux:) + #:use-module ( (nongnu system linux-initrd) + #:prefix nongnu:system:linux-initrd:) + #:use-module ( (sovereign channels) + #:prefix sovereign:channels:) + #:use-module ( (sovereign packages protonmail) + #:prefix sovereign:packages:protonmail:) + #:use-module ( (sovereign system file-systems) + #:prefix sovereign:system:file-systems:) + #:use-module ( (sovereign systems) + #:prefix sovereign:systems:) + #:use-module ( (users id1000) + #:prefix users:id1000:) + #:use-module ( (users id1001) + #:prefix users:id1001:)) + +(define system-name + "cokolwiek") + +(define file-system-efi + (let* + ( (l-system-name (string-upcase system-name)) + (l-device (sovereign:system:file-systems:file-system-label* "BOOT"))) + (gnu:system:file-systems:file-system + (inherit sovereign:system:file-systems:file-system/efi) + (device l-device)))) + +(define file-system-root + (let + ( (l-device (sovereign:system:file-systems:file-system-label* system-name + "root"))) + (gnu:system:file-systems:file-system + (inherit sovereign:system:file-systems:file-system/root) + (device l-device)))) + +(define swap + (let + ( (l-target (sovereign:system:file-systems:file-system-label* system-name + "swap"))) + (gnu:system:file-systems:swap-space + (inherit sovereign:system:file-systems:swap/no-trim) + (target l-target)))) + +(define-public system + (let* + ( (l-guix-homes (list users:id1000:named-home-environment + users:id1001:named-home-environment)) + (l-guix-home-service (sovereign:systems:guix-home-service l-guix-homes)) + (l-bootloader (custom-bootloader-configuration (list "/dev/sda"))) + (l-file-systems (cons* file-system-root + file-system-efi + gnu:system:file-systems:%base-file-systems)) + (l-firmware (list nongnu:packages:linux:linux-firmware)) + (l-initrd-modules (cons* "mei_me" + gnu:system:linux-initrd:%base-initrd-modules)) + (l-services (cons* l-guix-home-service + sovereign:packages:protonmail:nogui-profile + deployment:services:vpn:wireguard-service-giewont + sovereign:systems:%sovereign-services)) + (l-swap-devices (list swap)) + (l-users (cons* users:id1000:uid1000-account + users:id1001:user-account + gnu:system:shadow:%base-user-accounts))) + (gnu:system:operating-system + (kernel nongnu:packages:linux:linux) + (bootloader l-bootloader) + (label (sovereign:systems:operating-system-label* system-name + gnu:system:this-operating-system)) + (keyboard-layout sovereign:systems:keyboard-layout) + (initrd nongnu:system:linux-initrd:microcode-initrd) + (initrd-modules l-initrd-modules) + (firmware l-firmware) + (host-name system-name) + (file-systems l-file-systems) + (swap-devices l-swap-devices) + (users l-users) + (timezone "Europe/Warsaw") + (locale sovereign:systems:pl-locale) + (locale-definitions sovereign:systems:%sovereign-locale-definitions) + (services l-services) + (sudoers-file sovereign:systems:%sovereign-sudoers-specification)))) + +(define-public operating-system* system) diff --git a/deployment/system/file-systems.scm b/deployment/system/file-systems.scm new file mode 100644 index 0000000..2c36849 --- /dev/null +++ b/deployment/system/file-systems.scm @@ -0,0 +1,39 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment system file-systems) + #:export (file-system-dokumenty + file-system-szablony) + #:use-module (gnu system file-systems) + #:use-module (sovereign system file-systems)) + +(define file-system-dokumenty + (file-system + (inherit %file-system-nfs) + (mount-point "/mnt/dokumenty") + (device "10.0.0.1:/home/marek/Dokumenty"))) + +(define file-system-szablony + (file-system + (inherit %file-system-nfs) + (mount-point "/mnt/szablony") + (device "10.0.0.1:/home/marek/Szablony"))) + +;;; EOF diff --git a/deployment/system/git-ignore.conf b/deployment/system/git-ignore.conf new file mode 100644 index 0000000..73a9355 --- /dev/null +++ b/deployment/system/git-ignore.conf @@ -0,0 +1,68 @@ +# SPDX-License-Identifier: GPL-3.0-or-later +# SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +# COPYRIGHT NOTICE +# +# Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +# LICENSE NOTICE +# +# This library is free software: you can redistribute it and/or modify it under the terms of +# the GNU General Public License as published by the Free Software Foundation, +# either version 3 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +# without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +# See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along with this library. +# If not, see <https://www.gnu.org/licenses/>. + +# -*- mode: gitignore; -*- +*~ +\#*\# +/.emacs.desktop +/.emacs.desktop.lock +*.elc +auto-save-list +tramp +.\#* + +# Org-mode +.org-id-locations +*_archive + +# flymake-mode +*_flymake.* + +# eshell files +/eshell/history +/eshell/lastdir + +# elpa packages +/elpa/ + +# reftex files +*.rel + +# AUCTeX auto folder +/auto/ + +# cask packages +.cask/ +dist/ + +# Flycheck +flycheck_*.el + +# server auth directory +/server/ + +# projectiles files +.projectile + +# directory configuration +.dir-locals.el + +# network security +/network-security.data diff --git a/deployment/system/gitconfig b/deployment/system/gitconfig new file mode 100644 index 0000000..b1a384e --- /dev/null +++ b/deployment/system/gitconfig @@ -0,0 +1,30 @@ +# SPDX-License-Identifier: GPL-3.0-or-later +# SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +# COPYRIGHT NOTICE +# +# Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +# LICENSE NOTICE +# +# This library is free software: you can redistribute it and/or modify it under the terms of +# the GNU General Public License as published by the Free Software Foundation, +# either version 3 of the License, or (at your option) any later version. +# +# This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +# without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +# See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along with this library. +# If not, see <https://www.gnu.org/licenses/>. + +[commit] + gpgsign = true + +[user] + email = marek@marekpasnikowski.pl + name = Marek Paśnikowski + signingkey = 6D81B1207711899F + +[push] + autoSetupRemote = true diff --git a/deployment/system/mcdowell.scm b/deployment/system/mcdowell.scm new file mode 100644 index 0000000..d9f2ba8 --- /dev/null +++ b/deployment/system/mcdowell.scm @@ -0,0 +1,138 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment system mcdowell) + #:use-module (guix gexp) + #:use-module (sovereign bootloader) + #:use-module ( (deployment gexp) + #:prefix deployment:gexp:) + #:use-module ( (gnu packages package-management) + #:prefix gnu:packages:package-management:) + #:use-module ( (gnu services) + #:prefix gnu:services:) + #:use-module ( (gnu services base) + #:prefix gnu:services:base:) + #:use-module ( (gnu services guix) + #:prefix gnu:services:guix:) + #:use-module ( (gnu system) + #:prefix gnu:system:) + #:use-module ( (gnu system file-systems) + #:prefix gnu:system:file-systems:) + #:use-module ( (gnu system linux-initrd) + #:prefix gnu:system:linux-initrd:) + #:use-module ( (gnu system shadow) + #:prefix gnu:system:shadow:) + #:use-module ( (nongnu packages linux) + #:prefix nongnu:packages:linux:) + #:use-module ( (nongnu system linux-initrd) + #:prefix nongnu:system:linux-initrd:) + #:use-module ( (sovereign channels) + #:prefix sovereign:channels:) + #:use-module ( (sovereign packages protonmail) + #:prefix sovereign:packages:protonmail:) + #:use-module ( (sovereign system file-systems) + #:prefix sovereign:system:file-systems:) + #:use-module ( (sovereign systems) + #:prefix sovereign:systems:) + #:use-module ( (users id1000) + #:prefix users:id1000:)) + +(define system-name + "mcdowell") + +(define file-system-efi + (let* + ( (l-system-name (string-upcase system-name)) + (l-device (sovereign:system:file-systems:file-system-label* system-name))) + (gnu:system:file-systems:file-system + (inherit sovereign:system:file-systems:file-system/efi) + (device l-device) + (mount-point "/boot/EFI")))) + +(define file-system-root + (let + ( (l-device (sovereign:system:file-systems:file-system-label* system-name + "root"))) + (gnu:system:file-systems:file-system + (inherit sovereign:system:file-systems:file-system/root) + (device l-device)))) + +(define swap + (let + ( (l-target (sovereign:system:file-systems:file-system-label* system-name + "swap"))) + (gnu:system:file-systems:swap-space + (inherit sovereign:system:file-systems:swap/no-trim) + (target l-target)))) + +(define rakan-machine + #~(build-machine + (name "rakan") + (systems (list "x86_64-linux" + "i686-linux")) + (user "marek") + (host-key "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFxlIhNlkWCNA+l/RiOJztB+VWhuJtDTUvSwwlE3MpgJ root@mcdowell") + (private-key "/home/marek/.ssh/id_ed25519"))) + +(define guix-offload-rakan + (gnu:services:base:guix-extension + (authorized-keys (list deployment:gexp:rakan-guix-key)) + (build-machines (list rakan-machine)))) + +(define-public system + (let* + ( (l-guix-homes (list users:id1000:named-home-environment)) + (l-guix-home-service (sovereign:systems:guix-home-service l-guix-homes)) + (l-bootloader (custom-bootloader-configuration (list "/dev/sdb"))) + (l-file-systems (cons* file-system-root + file-system-efi + gnu:system:file-systems:%base-file-systems)) + (l-firmware (list nongnu:packages:linux:linux-firmware)) + (l-initrd-modules (cons* "mei_me" + gnu:system:linux-initrd:%base-initrd-modules)) + (l-services (cons* l-guix-home-service + sovereign:packages:protonmail:nogui-profile + (gnu:services:simple-service 'offload-rakan + gnu:services:base:guix-service-type + guix-offload-rakan) + sovereign:systems:%sovereign-services)) + (l-swap-devices (list swap)) + (l-users (cons* users:id1000:uid1000-account + gnu:system:shadow:%base-user-accounts))) + (gnu:system:operating-system + (kernel nongnu:packages:linux:linux) + (bootloader l-bootloader) + (label (sovereign:systems:operating-system-label* system-name + gnu:system:this-operating-system)) + (keyboard-layout sovereign:systems:keyboard-layout) + (initrd nongnu:system:linux-initrd:microcode-initrd) + (initrd-modules l-initrd-modules) + (firmware l-firmware) + (host-name system-name) + (file-systems l-file-systems) + (swap-devices l-swap-devices) + (users l-users) + (timezone "Europe/Warsaw") + (locale sovereign:systems:pl-locale) + (locale-definitions sovereign:systems:%sovereign-locale-definitions) + (services l-services) + (sudoers-file sovereign:systems:%sovereign-sudoers-specification)))) + +(define-public operating-system* system) diff --git a/deployment/system/rakan.scm b/deployment/system/rakan.scm new file mode 100644 index 0000000..8edfa4a --- /dev/null +++ b/deployment/system/rakan.scm @@ -0,0 +1,299 @@ +;;; SPDX-License-Identifier: GPL-3.0-or-later +;;; SPDX-FileCopyrightText: 2026 Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; COPYRIGHT NOTICE +;;; +;;; Copyright 2026, Marek Paśnikowski <marek@marekpasnikowski.pl> + +;;; LICENSE NOTICE +;;; +;;; This library is free software: you can redistribute it and/or modify it under the terms of +;;; the GNU General Public License as published by the Free Software Foundation, +;;; either version 3 of the License, or (at your option) any later version. +;;; +;;; This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +;;; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +;;; See the GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License along with this library. +;;; If not, see <https://www.gnu.org/licenses/>. + +(define-module (deployment system rakan) + #:export (bootloader-configuration-targets-rakan) + #:use-module (guix gexp) + #:use-module (sovereign bootloader) + #:use-module ( (deployment gexp) + #:prefix deployment:gexp:) + #:use-module ( (deployment services) + #:prefix deployment:services:) + #:use-module ( (deployment services nfs) + #:prefix deployment:services:nfs:) + #:use-module ( (deployment services vpn) + #:prefix deployment:services:vpn:) + #:use-module ( (deployment system file-systems) + #:prefix deployment:system:file-systems:) + #:use-module ( (gnu home) + #:prefix gnu:home:) + #:use-module ( (gnu home services) + #:prefix gnu:home:services:) + #:use-module ( (gnu packages libreoffice) + #:prefix gnu:packages:libreoffice:) + #:use-module ( (gnu packages mail) + #:prefix gnu:packages:mail:) + #:use-module ( (gnu services) + #:prefix gnu:services:) + #:use-module ( (gnu services base) + #:prefix gnu:services:base:) + #:use-module ( (gnu services guix) + #:prefix gnu:services:guix:) + #:use-module ( (gnu services samba) + #:prefix gnu:services:samba:) + #:use-module ( (gnu system) + #:prefix gnu:system:) + #:use-module ( (gnu system file-systems) + #:prefix gnu:system:file-systems:) + #:use-module ( (gnu system linux-initrd) + #:prefix gnu:system:linux-initrd:) + #:use-module ( (gnu system locale) + #:prefix gnu:system:locale:) + #:use-module ( (gnu system nss) + #:prefix gnu:system:nss:) + #:use-module ( (gnu system pam) + #:prefix gnu:system:pam:) + #:use-module ( (gnu system shadow) + #:prefix gnu:system:shadow:) + #:use-module ( (guix diagnostics) + #:prefix guix:diagnostics:) + #:use-module ( (nongnu packages linux) + #:prefix nongnu:packages:linux:) + #:use-module ( (nongnu system linux-initrd) + #:prefix nongnu:system:linux-initrd:) + #:use-module ( (gnu home-services mail) + #:prefix rde/gnu:home-services:mail:) + #:use-module ( (sovereign packages emacs) + #:prefix sovereign:packages:emacs:) + #:use-module ( (sovereign packages protonmail) + #:prefix sovereign:packages:protonmail:) + #:use-module ( (sovereign services) + #:prefix sovereign:services:) + #:use-module ( (sovereign system file-systems) + #:prefix sovereign:system:file-systems:) + #:use-module ( (sovereign systems) + #:prefix sovereign:systems:) + #:use-module ( (users id1000) + #:prefix users:id1000:)) + +(define system-name + "rakan") + +(define file-system-efi + (let* + ( (l-system-name (string-upcase system-name)) + (l-device (sovereign:system:file-systems:file-system-label* "BOOT"))) + (gnu:system:file-systems:file-system + (inherit sovereign:system:file-systems:file-system/efi) + (device l-device)))) + +(define file-system-root + (let + ( (l-device (sovereign:system:file-systems:file-system-label* system-name + "root"))) + (gnu:system:file-systems:file-system + (inherit sovereign:system:file-systems:file-system/root) + (device l-device)))) + +(define file-system/root-btrfs + (gnu:system:file-systems:file-system + (type "btrfs") + (mount-point "/") + (device (sovereign:system:file-systems:file-system-label* system-name + "raid10")) + (flags (list)) + (options #f) + (mount? #t) + (needed-for-boot? #t) + (skip-check-if-clean? #f) + (repair #t) + (create-mount-point? #f) + (mount-may-fail? #f) + (dependencies (list)) + (shepherd-requirements (list)))) + +(define swap + (let + ( (l-target (sovereign:system:file-systems:file-system-label* system-name + "swap"))) + (gnu:system:file-systems:swap-space + (inherit sovereign:system:file-systems:swap/no-trim) + (target l-target)))) + +(define guix-offload-authorizations + (gnu:services:base:guix-extension + (authorized-keys (list deployment:gexp:aisaka-guix-key)))) + +(define (l2md-maildir name) + (string-append "~/Publiczne/l2md/" + name)) + +(define l2md-repo-guile-user + (rde/gnu:home-services:mail:l2md-repo + (name "guile-user") + (urls "https://yhetil.org/guile-user/0") + (maildir (l2md-maildir name)) + (pipe "") + (initial-import 0) + (sync-enabled? #t))) + +(define l2md-repo-guix-devel + (rde/gnu:home-services:mail:l2md-repo + (name "guix-devel") + (urls "https://yhetil.org/guix-devel/0") + (maildir (l2md-maildir name)) + (pipe "") + (initial-import 0) + (sync-enabled? #t))) + +(define l2md-repo-guix-user + (rde/gnu:home-services:mail:l2md-repo + (name "guix-user") + (urls "https://yhetil.org/guix-user/0") + (maildir (l2md-maildir name)) + (pipe "") + (initial-import 0) + (sync-enabled? #t))) + +(define l2md-configuration + (rde/gnu:home-services:mail:home-l2md-configuration + (l2md gnu:packages:mail:l2md) + (autostart? #t) + (period 180) + (oneshot 0) + (maildir "") + (pipe "") + (base "~/Publiczne/l2md") + (repos (list l2md-repo-guile-user + l2md-repo-guix-devel + l2md-repo-guix-user)))) + +(define home-l2md + (gnu:services:service + rde/gnu:home-services:mail:home-l2md-service-type + l2md-configuration)) + +(define samba-configuration + (gnu:services:samba:samba-configuration + (enable-smbd? #t) + (config-file (mixed-text-file "smb.conf" + "[global]\n" + "map to guest = Bad User\n" + "logging = syslog@1\n" + "\n" + "[public]\n" + "browsable = yes\n" + "path = /tmp\n" + "read only = no\n" + "guest ok = yes\n" + "guest only = yes\n")))) + +(define samba-service + (gnu:services:service + gnu:services:samba:samba-service-type + samba-configuration)) + +(define named-home-environment-1000 + (let + ( (named-home-environment- users:id1000:named-home-environment)) + (let + ( (home-environment- (car (cdr named-home-environment-))) + (name- (car named-home-environment-))) + (let* + ( (services- (gnu:home:home-environment-user-services home-environment-)) + (packages- (gnu:home:home-environment-packages home-environment-)) + (home-environment-* (gnu:home:home-environment + (inherit home-environment-) + (packages packages-) + (services (cons* home-l2md + services-))))) + (list name- + home-environment-*))))) + +(define guix-homes + (list named-home-environment-1000)) + +(define guix-home-service + (sovereign:systems:guix-home-service guix-homes)) + +(define offload-auth + (gnu:services:simple-service 'offload-authorizations + gnu:services:base:guix-service-type + guix-offload-authorizations)) + +(define guix-publish-configuration + (gnu:services:base:guix-publish-configuration + (host "0.0.0.0") + (port 8080) + (advertise? #t))) + +(define-public guix-publish-service + (sovereign:services:guix-publish-service guix-publish-configuration)) + +(define bootloader-configuration-targets-rakan + (list "/dev/sda" + "/dev/nvme0n1" + "/dev/nvme1n1" + "/dev/nvme2n1" + "/dev/nvme3n1")) + +(define-public system + (gnu:system:operating-system + (kernel nongnu:packages:linux:linux) + (kernel-loadable-modules (list)) + (kernel-arguments gnu:system:%default-kernel-arguments) + (hurd #f) + (bootloader (custom-bootloader-configuration bootloader-configuration-targets-rakan)) + (label (sovereign:systems:operating-system-label* system-name + gnu:system:this-operating-system)) + (keyboard-layout sovereign:systems:keyboard-layout) + (initrd nongnu:system:linux-initrd:microcode-initrd) + (initrd-modules (cons* "mei_me" + gnu:system:linux-initrd:%base-initrd-modules)) + (firmware (list nongnu:packages:linux:linux-firmware)) + (host-name system-name) + (hosts-file #f) + (mapped-devices (list)) + (file-systems (cons* file-system/root-btrfs + file-system-efi + deployment:system:file-systems:file-system-dokumenty + deployment:system:file-systems:file-system-szablony + gnu:system:file-systems:%base-file-systems)) + (swap-devices (list swap)) + (users (cons* users:id1000:uid1000-account + gnu:system:shadow:%base-user-accounts)) + (groups gnu:system:shadow:%base-groups) + (skeletons (gnu:system:shadow:default-skeletons)) + (issue (@@ (gnu system) %default-issue)) + (packages (cons* gnu:packages:libreoffice:libreoffice + gnu:system:%base-packages)) + (timezone "Europe/Warsaw") + (locale sovereign:systems:pl-locale) + (locale-definitions sovereign:systems:%sovereign-locale-definitions) + (locale-libcs gnu:system:locale:%default-locale-libcs) + (name-service-switch gnu:system:nss:%default-nss) + (essential-services (gnu:system:operating-system-default-essential-services gnu:system:this-operating-system)) + (services (cons* deployment:services:nfs:autofs-rakan_service-record + guix-home-service + guix-publish-service + deployment:services:nfs:nfs-rakan_service-record + sovereign:packages:protonmail:nogui-profile + offload-auth + deployment:services:qemu-binfmt_rakan-record + samba-service + deployment:services:vpn:wireguard-service-rakan + sovereign:systems:%sovereign-services)) + (pam-services (gnu:system:pam:base-pam-services)) + (privileged-programs gnu:system:%default-privileged-programs) + (sudoers-file sovereign:systems:%sovereign-sudoers-specification) + (location (and=> (current-source-location) + guix:diagnostics:source-properties->location)))) + +(define-public operating-system* system) |