Move all os/home configurations into modules.

1 files changed, 0 insertions, 348 deletions

diff --git a/takemi-os.scm b/takemi-os.scm
deleted file mode 100644
index 5bac09e..0000000
--- a/takemi-os.scm
+++ /dev/null
@@ -1,348 +0,0 @@
-(use-modules (gnu)
-             (gnu packages version-control)
-             (gnu services admin)
-             (gnu services certbot)
-             (gnu services cgit)
-             (gnu services ci)
-             (gnu services networking)
-             (gnu services ssh)
-             (gnu services version-control)
-             (gnu services web))
-
-(define letsencrypt-cert
-  "/etc/letsencrypt/live/dthompson.us/fullchain.pem")
-(define letsencrypt-cert-key
-  "/etc/letsencrypt/live/dthompson.us/privkey.pem")
-(define dave-pub-key (local-file "keys/dave.pub"))
-(define git-root "/var/lib/gitolite")
-(define fcgiwrap-socket "127.0.0.1:9000")
-
-(define nginx-accounts
-  (list (user-group (name "nginx") (system? #t))
-        (user-account
-         (name "nginx")
-         (group "nginx")
-         (supplementary-groups '("git"))
-         (system? #t)
-         (comment "nginx server user")
-         (home-directory "/var/empty")
-         (shell (file-append (specification->package "shadow")
-                             "/sbin/nologin")))))
-
-(define (nginx-signal name signal)
-  (program-file
-   name
-   #~(let ((pid (call-with-input-file "/var/run/nginx/pid" read)))
-       (kill pid #$signal))))
-
-;; Need to override the default nginx service account configuration so
-;; that the nginx user is a member of the git group.
-(define nginx-service-type*
-  (service-type
-   (inherit nginx-service-type)
-   (extensions
-    (map (lambda (extension)
-           (if (eq? (service-extension-target extension)
-                    account-service-type)
-               (service-extension account-service-type
-                                  (const nginx-accounts))
-               extension))
-         (service-type-extensions nginx-service-type)))))
-
-(define takemi-os
-  (operating-system
-    (locale "en_US.utf8")
-    (timezone "America/New_York")
-    (keyboard-layout (keyboard-layout "us"))
-    (host-name "takemi")
-    (users (cons* (user-account
-                   (name "dave")
-                   (comment "David Thompson")
-                   (group "users")
-                   (home-directory "/home/dave")
-                   (supplementary-groups
-                    '("wheel" "netdev")))
-                  (user-account
-                   (name "publish")
-                   (comment "Web file publisher")
-                   (group "publish")
-                   (home-directory "/var/www")
-                   (system? #t)
-                   (create-home-directory? #f))
-                  %base-user-accounts))
-    (groups (cons* (user-group
-                    (name "publish")
-                    (system? #t))
-                   %base-groups))
-    (sudoers-file
-     (plain-file "sudoers"
-                 (string-append (plain-file-content %sudoers-specification)
-                                ;; 'guix deploy' requires no password
-                                ;; sudo capability.
-                                "dave ALL = NOPASSWD: ALL\n")))
-    (packages
-     (append (map specification->package '("emacs" "nss-certs" "rsync" "git" "laminar"))
-             %base-packages))
-    (services
-     (cons*
-      (service dhcp-client-service-type)
-      (service openssh-service-type
-               (openssh-configuration
-                (password-authentication? #f)
-                ;; So I can forward ports from my local host to
-                ;; the server and have the ports accessible from
-                ;; the internet.
-                (gateway-ports? #t)
-                (authorized-keys
-                 `(("dave" ,dave-pub-key)
-                   ("publish" ,dave-pub-key)))))
-      ;; Git repository hosting.
-      (service gitolite-service-type
-               (gitolite-configuration
-                (admin-pubkey dave-pub-key)
-                (rc-file (gitolite-rc-file
-                          ;; Grant read access to git group so
-                          ;; cgit will work.
-                          (umask #o0027)
-                          (git-config-keys "gitweb\\..*")))))
-      ;; Continuous integration.
-      (service laminar-service-type
-               (laminar-configuration
-                (supplementary-groups '("git"))))
-      ;; TLS certificates.  Certbot extends nginx with configuration to
-      ;; redirect all HTTP requests to HTTPS.
-      (service (service-type
-                (inherit certbot-service-type)
-                (extensions
-                 ;; Replace original nginx-service-type with
-                 ;; our modified one.
-                 (map (lambda (extension)
-                        (if (eq? (service-extension-target extension)
-                                 nginx-service-type)
-                            (service-extension nginx-service-type*
-                                               (@@ (gnu services certbot)
-                                                   certbot-nginx-server-configurations))
-                            extension))
-                      (service-type-extensions certbot-service-type))))
-               (certbot-configuration
-                (email "dthompson2@worcester.edu")
-                (certificates
-                 (list
-                  (certificate-configuration
-                   (domains '("dthompson.us"
-                              "www.dthompson.us"
-                              "git.dthompson.us"
-                              "ci.dthompson.us"
-                              "files.dthompson.us"
-                              "haunt.dthompson.us"))
-                   ;; Send SIGHUP signal to nginx to trigger a
-                   ;; configuration reload, thus loading the
-                   ;; updated certificates.
-                   (deploy-hook (nginx-signal "nginx-deploy-hook" SIGHUP)))))
-                (webroot "/var/www/certbot")))
-      (service nginx-service-type*
-               (nginx-configuration
-                (server-blocks
-                 (list (nginx-server-configuration
-                        (listen '("443 ssl"))
-                        (server-name '("www.dthompson.us"))
-                        (root "/var/www/blog")
-                        ;; I used to check in the HTML output of
-                        ;; manuals to my blog's git repo which was
-                        ;; super gross.  This rewrite rule keeps those
-                        ;; links alive.
-                        (locations
-                         (list
-                          (nginx-location-configuration
-                           (uri "/manuals")
-                           (body '("rewrite ^/manuals/([^/]+)/(.*) https://files.dthompson.us/docs/$1/latest/$2 permanent;")))))
-                        (ssl-certificate letsencrypt-cert)
-                        (ssl-certificate-key letsencrypt-cert-key))
-                       (nginx-server-configuration
-                        (listen '("443 ssl"))
-                        (server-name '("files.dthompson.us"))
-                        (root "/var/www/files")
-                        (raw-content '("autoindex on;"))
-                        (ssl-certificate letsencrypt-cert)
-                        (ssl-certificate-key letsencrypt-cert-key))
-                       (nginx-server-configuration
-                        ;; Laminar recommends using HTTP2 here.
-                        (listen '("443 ssl http2"))
-                        (server-name '("ci.dthompson.us"))
-                        (locations
-                         (list
-                          ;; Reverse proxy to Laminar daemon.
-                          (nginx-location-configuration
-                           (uri "/")
-                           (body '("proxy_pass http://127.0.0.1:8080;"
-                                   "proxy_http_version 1.1;"
-                                   "proxy_set_header Connection \"\";")))
-                          ;; Serve static files directly.
-                          (nginx-location-configuration
-                           (uri "/archive")
-                           (body '("alias /var/lib/laminar/archive/;")))))
-                        (ssl-certificate letsencrypt-cert)
-                        (ssl-certificate-key letsencrypt-cert-key)
-                        ;; Modern TLS only.
-                        (raw-content
-                         '("ssl_protocols TLSv1.3;"
-                           "ssl_ciphers EECDH+AESGCM:EDH+AESGCM;")))
-                       ;; I used to have the Haunt website under
-                       ;; its own subdomain, and some sites still
-                       ;; point to it.
-                       (nginx-server-configuration
-                        (listen '("443 ssl"))
-                        (server-name '("haunt.dthompson.us"))
-                        (root "/var/www/haunt")
-                        (locations
-                         (list
-                          (nginx-location-configuration
-                           (uri "/")
-                           (body '("rewrite .* https://dthompson.us/projects/haunt.html permanent;")))))
-                        (ssl-certificate letsencrypt-cert)
-                        (ssl-certificate-key letsencrypt-cert-key))))))
-      ;; Git repository viewer.
-      (let ((cgit (specification->package "cgit")))
-        (service (service-type
-                  (inherit cgit-service-type)
-                  (extensions
-                   ;; Replace original nginx-service-type with
-                   ;; our modified one.
-                   (map (lambda (extension)
-                          (if (eq? (service-extension-target extension)
-                                   nginx-service-type)
-                              (service-extension nginx-service-type*
-                                                 cgit-configuration-nginx-config)
-                              extension))
-                        (service-type-extensions cgit-service-type))))
-                 (cgit-configuration
-                  (project-list (string-append git-root "/projects.list"))
-                  (repository-directory (string-append git-root "/repositories"))
-                  (root-desc "all i wanted was a pepsi") ; just one pepsi
-                  (enable-git-config? #t)
-                  ;; Cgit only supports the old HTTP "dumb"
-                  ;; protocol, which notably libgit2 won't even
-                  ;; entertain supporting.  So, we'll disable
-                  ;; that and use Git itself to provide the HTTP
-                  ;; "smart" protocol instead.
-                  (enable-http-clone? #f)
-                  (enable-index-links? #t)
-                  (enable-index-owner? #f)
-                  (enable-commit-graph? #t)
-                  (enable-log-filecount? #t)
-                  (enable-log-linecount? #t)
-                  (remove-suffix? #t)
-                  (clone-url '("https://git.dthompson.us/$CGIT_REPO_URL.git"))
-                  ;; Is there a way to avoid this wrapper script?
-                  (source-filter (program-file
-                                  "cgit-syntax-highlight"
-                                  #~(apply execl
-                                           (string-append #$cgit "/lib/cgit/filters/syntax-highlighting.py")
-                                           (command-line))))
-                  (nginx
-                   (list (nginx-server-configuration
-                          (listen '("443 ssl"))
-                          (server-name '("git.dthompson.us"))
-                          (root cgit)
-                          (locations
-                           (list
-                            ;; URI paths with .git are handled by
-                            ;; Git's "smart" HTTP protocol.
-                            (nginx-location-configuration
-                             (uri "~ (/.*\\.git/.*)")
-                             (body
-                              `(("fastcgi_pass " ,fcgiwrap-socket ";")
-                                ("fastcgi_param SCRIPT_FILENAME "
-                                 ,git "/libexec/git-core/git-http-backend;")
-                                "fastcgi_param QUERY_STRING $query_string;"
-                                "fastcgi_param REQUEST_METHOD $request_method;"
-                                "fastcgi_param CONTENT_TYPE $content_type;"
-                                "fastcgi_param CONTENT_LENGTH $content_length;"
-                                ("fastcgi_param GIT_PROJECT_ROOT "
-                                 ,git-root "/repositories;")
-                                "fastcgi_param PATH_INFO $1;")))
-                            ;; Redirect old URLs to .git pages to
-                            ;; the new .git-less URL.  This
-                            ;; doesn't handle deeper links but
-                            ;; that's okay.
-                            (nginx-location-configuration
-                             (uri "~ (/.*)\\.git")
-                             (body
-                              `("return 301 $1;")))
-                            ;; Serve a static file if one exists,
-                            ;; otherwise send the request to
-                            ;; cgit.
-                            (nginx-location-configuration
-                             (uri "/")
-                             (body
-                              '("try_files $uri @cgit;")))
-                            (nginx-location-configuration
-                             (uri "@cgit")
-                             (body `("fastcgi_param SCRIPT_FILENAME $document_root/lib/cgit/cgit.cgi;"
-                                     "fastcgi_param PATH_INFO $uri;"
-                                     "fastcgi_param QUERY_STRING $args;"
-                                     "fastcgi_param HTTP_HOST $server_name;"
-                                     ("fastcgi_pass " ,fcgiwrap-socket ";"))))))
-                          (ssl-certificate letsencrypt-cert)
-                          (ssl-certificate-key letsencrypt-cert-key)))))))
-      ;; fcgriwrap wraps cgit.
-      (service fcgiwrap-service-type
-               (fcgiwrap-configuration
-                ;; Use git group for read-only access to gitolite
-                ;; repos.
-                (group "git")
-                (socket (string-append "tcp:" fcgiwrap-socket))))
-      ;; Log rotation.
-      (simple-service 'rotate-logs
-                      rottlog-service-type
-                      (list (log-rotation
-                             (frequency 'daily)
-                             (files '("/var/log/nginx/access.log"
-                                      "/var/log/nginx/error.log"))
-                             (options `("storedir /var/log/nginx"
-                                        ;; Keep a week of logs.
-                                        "rotate 6"
-                                        ;; Run post-rotate once per
-                                        ;; rotation rather than once
-                                        ;; for each file.
-                                        "sharedscripts"
-                                        ,@%default-log-rotation-options))
-                             ;; Tell nginx to reopen its log files after rotation.
-                             (post-rotate (nginx-signal "nginx-post-rotate-hook" SIGUSR1)))
-                            (log-rotation
-                             (frequency 'daily)
-                             (files '("/var/log/fcgiwrap.log"))
-                             (options `("rotate 6"
-                                        ,@%default-log-rotation-options)))))
-      (modify-services %base-services
-        (guix-service-type config =>
-                           (guix-configuration
-                            (inherit config)
-                            (authorized-keys (cons (local-file "keys/signing-key.pub")
-                                                   %default-authorized-guix-keys)))))))
-    (bootloader
-     (bootloader-configuration
-      (bootloader grub-bootloader)
-      (targets '("/dev/vda"))
-      (keyboard-layout keyboard-layout)))
-    (initrd-modules
-     (append '("virtio_scsi") %base-initrd-modules))
-    (swap-devices (list (swap-space (target "/dev/vda2"))))
-    (file-systems
-     (cons* (file-system
-              (mount-point "/")
-              (device (uuid "f99d3ff5-57ea-4b20-bca7-bc2d58b4c364" 'ext4))
-              (type "ext4"))
-            %base-file-systems))))
-
-(define takemi-host-key
-  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOrptBAMgs8dGDerBkcmZQ2W/0nEXtOBCl8nLlEwjKdI")
-
-(list (machine
-       (operating-system takemi-os)
-       (environment managed-host-environment-type)
-       (configuration (machine-ssh-configuration
-                       (host-name "dthompson.us")
-                       (system "x86_64-linux")
-                       (user "dave")
-                       (host-key takemi-host-key)))))