231 lines
10 KiB
Scheme
231 lines
10 KiB
Scheme
(define-module (oms systems)
|
|
#:use-module (gnu)
|
|
#:use-module (gnu packages cups)
|
|
#:use-module (gnu services admin)
|
|
#:use-module (gnu services base)
|
|
#:use-module (gnu services cups)
|
|
#:use-module (gnu services desktop)
|
|
#:use-module (gnu services dns)
|
|
#:use-module (gnu services guix)
|
|
#:use-module (gnu services networking)
|
|
#:use-module (gnu services ssh)
|
|
#:use-module (gnu services sysctl)
|
|
#:use-module (gnu services vpn)
|
|
#:use-module (gnu services xorg)
|
|
#:use-module (gnu system pam)
|
|
#:use-module (guix gexp)
|
|
#:use-module (nongnu packages linux)
|
|
#:use-module (nongnu system linux-initrd)
|
|
#:use-module (oms channel-file)
|
|
#:use-module (oms home)
|
|
#:use-module (sops secrets)
|
|
#:use-module (sops services sops)
|
|
#:export (base-operating-system))
|
|
|
|
(define* (base-operating-system host-name)
|
|
(operating-system
|
|
(kernel linux)
|
|
(kernel-arguments
|
|
(append '("resume=oms-guix-swap") %default-kernel-arguments))
|
|
(initrd microcode-initrd)
|
|
(firmware (list linux-firmware))
|
|
(locale "fi_FI.utf8")
|
|
(timezone "Europe/Helsinki")
|
|
(keyboard-layout (keyboard-layout "fi"))
|
|
(host-name host-name)
|
|
(users (cons* (user-account
|
|
(name "oms")
|
|
(comment "Olarinmäen samoojat")
|
|
(group "users")
|
|
(home-directory "/home/oms")
|
|
(supplementary-groups '("wheel" "netdev" "audio" "video" "passwordlesslogin")))
|
|
%base-user-accounts))
|
|
(groups (cons (user-group (name "passwordlesslogin")) %base-groups))
|
|
(services
|
|
(append
|
|
(list (service gnome-desktop-service-type)
|
|
(service openssh-service-type
|
|
(openssh-configuration
|
|
(permit-root-login 'prohibit-password)
|
|
(authorized-keys
|
|
`(("root" ,(channel-file "keys/ssh/saku-laesvuori-x-kone.pub"))))))
|
|
(service guix-home-service-type `(("oms" ,oms-home-environment)))
|
|
(service guix-publish-service-type
|
|
(guix-publish-configuration
|
|
(port 8001)
|
|
(host "0.0.0.0")
|
|
(advertise? #t)))
|
|
(service cups-service-type
|
|
(cups-configuration
|
|
(web-interface? #t)
|
|
(extensions (list cups-filters epson-inkjet-printer-escpr))))
|
|
(simple-service 'passwordless-gdm-login pam-root-service-type
|
|
(list
|
|
(pam-extension
|
|
(transformer
|
|
(lambda (service)
|
|
(if (equal? (pam-service-name service)
|
|
"gdm-password")
|
|
(pam-service
|
|
(inherit service)
|
|
(auth
|
|
(cons (pam-entry
|
|
(control "sufficient")
|
|
(module "pam_succeed_if.so")
|
|
(arguments
|
|
'("user" "ingroup"
|
|
"passwordlesslogin")))
|
|
(pam-service-auth service))))
|
|
service))))))
|
|
(set-xorg-configuration (xorg-configuration (keyboard-layout keyboard-layout))))
|
|
(modify-services %desktop-services
|
|
(guix-service-type config =>
|
|
(guix-configuration
|
|
(inherit config)
|
|
(discover? #t)
|
|
(substitute-urls
|
|
(append %default-substitute-urls ; more often used servers first
|
|
(list "https://substitutes.nonguix.org")))
|
|
(authorized-keys
|
|
(append (list (channel-file "keys/guix/nonguix.pub")
|
|
(channel-file "keys/guix/saku-laesvuori-x-kone.pub"))
|
|
%default-authorized-guix-keys)))))))
|
|
(bootloader (bootloader-configuration
|
|
(bootloader grub-efi-bootloader)
|
|
(targets (list "/boot/efi"))
|
|
(keyboard-layout keyboard-layout)))
|
|
(swap-devices
|
|
(list (swap-space
|
|
(target (file-system-label "oms-guix-swap"))
|
|
(discard? #t))))
|
|
(file-systems
|
|
(append (list (file-system
|
|
(mount-point "/")
|
|
(device (file-system-label "oms-btrfs-root"))
|
|
(flags '(no-atime))
|
|
(options "compress-force=zstd")
|
|
(type "btrfs"))
|
|
(file-system
|
|
(mount-point "/boot/efi")
|
|
(device (file-system-label "OMS-F32-EFI"))
|
|
(type "vfat"))
|
|
(file-system
|
|
(mount-point "/tmp")
|
|
(device "tmpfs")
|
|
(type "tmpfs")
|
|
(check? #f)
|
|
(flags '(no-dev no-suid))
|
|
(options "size=70%")
|
|
(create-mount-point? #t)))
|
|
%base-file-systems))))
|
|
|
|
(define-syntax-rule (define-system id os)
|
|
"Extend the operating system OS with unattended upgrades and define a varible
|
|
ID with the extended system as it's value."
|
|
(define-public id
|
|
(let ((base os))
|
|
(operating-system
|
|
(inherit base)
|
|
(services
|
|
(append
|
|
(list (service unattended-upgrade-service-type
|
|
(unattended-upgrade-configuration
|
|
(channels
|
|
#~(cons (channel
|
|
(name 'oms-tietokoneet)
|
|
(url "https://git.olarinmaensamoojat.fi/OMS/tietokoneet.git")
|
|
(branch "main")
|
|
(introduction
|
|
(make-channel-introduction
|
|
"a3665902d411cd473636a836c2efd707b3a25cfd"
|
|
(openpgp-fingerprint
|
|
"A0C9 1947 734F 076F 5F08 E9FF 257D 284A 2A1D 3A32"))))
|
|
%default-channels))
|
|
(operating-system-expression
|
|
#~(@ (oms systems) id)))))
|
|
(operating-system-user-services base)))))))
|
|
|
|
(define-system oms-morn (base-operating-system "OMS-morn"))
|
|
|
|
(define-system oms-celeb
|
|
(let ((base (base-operating-system "OMS-celeb")))
|
|
(operating-system
|
|
(inherit base)
|
|
(initrd-modules
|
|
(append '("vmd") (operating-system-initrd-modules base))))))
|
|
|
|
(define-system oms-kone
|
|
(let ((base (base-operating-system "OMS-kone"))
|
|
(wpa-psk (sops-secret
|
|
(key '("wpa-psk"))
|
|
(file (channel-file "sops/OMS-kone.yaml"))))
|
|
(wg-key (sops-secret
|
|
(key '("wg-private-key"))
|
|
(file (channel-file "sops/OMS-kone.yaml")))))
|
|
(operating-system
|
|
(inherit base)
|
|
(kernel-arguments %default-kernel-arguments)
|
|
(firmware (list ibt-hw-firmware iwlwifi-firmware))
|
|
(swap-devices '())
|
|
(services
|
|
(append
|
|
(list (service dhcpcd-service-type
|
|
(dhcpcd-configuration
|
|
(interfaces '("enp1s0"))))
|
|
(service dhcpd-service-type
|
|
(dhcpd-configuration
|
|
(interfaces '("wlp2s0"))
|
|
(config-file (channel-file "OMS-kone/dhcpd.conf"))))
|
|
(service dnsmasq-service-type
|
|
(dnsmasq-configuration
|
|
(listen-addresses '("192.168.1.1"))))
|
|
(service hostapd-service-type
|
|
(hostapd-configuration
|
|
(interface "wlp2s0")
|
|
(ssid "Samoojaverkko") ; muokatessa päivitä wpa_psk
|
|
(channel 1)
|
|
(extra-settings
|
|
(string-append "wpa=2\n" "wpa_psk_file="
|
|
(sops-secret->secret-file wpa-psk)))))
|
|
(service nftables-service-type
|
|
(nftables-configuration
|
|
(ruleset (channel-file "OMS-kone/nftables.rules"))))
|
|
(service sops-secrets-service-type
|
|
(sops-service-configuration
|
|
(secrets (list wpa-psk wg-key))))
|
|
(service static-networking-service-type
|
|
(list (static-networking
|
|
(provision '(wifi-ip))
|
|
(addresses (list (network-address
|
|
(device "wlp2s0")
|
|
(value "192.168.1.1/24")))))))
|
|
(service wireguard-service-type
|
|
(wireguard-configuration
|
|
(peers
|
|
(list
|
|
(wireguard-peer
|
|
(name "olarinmaensamoojat.fi")
|
|
(endpoint "olarinmaensamoojat.fi:51820")
|
|
(public-key "UT4RGKMzp61DYiiodsrvHc6m/tkSqLNo2wqxwACrdl4=")
|
|
(allowed-ips '("192.168.3.3/32"))
|
|
(keep-alive 25))))
|
|
(addresses '("192.168.3.2/24"))
|
|
(private-key (sops-secret->secret-file wg-key))
|
|
(shepherd-requirement '(networking)))))
|
|
(modify-services (operating-system-user-services base)
|
|
(elogind-service-type config =>
|
|
(elogind-configuration
|
|
(inherit config)
|
|
(handle-power-key 'ignore)))
|
|
(sysctl-service-type config =>
|
|
(sysctl-configuration
|
|
(inherit config)
|
|
(settings (cons '("net.ipv4.ip_forward" . "1")
|
|
%default-sysctl-settings))))
|
|
(gdm-service-type config =>
|
|
(gdm-configuration
|
|
(inherit config)
|
|
(auto-suspend? #f)))
|
|
(delete network-manager-service-type)
|
|
(delete wpa-supplicant-service-type)))))))
|