linode-guix-system-configuration/linode-locke-lamora-current-config.scm

;; this is the current configuration for my linode "Guix System"

(add-to-load-path (dirname (current-filename)))

(use-modules (gnu)
             (guix modules)
             (secret nginx)
             (secret public-keys)
             ;;(gnucode-form)
             (mail)
             )
(use-service-modules admin ; unattended-upgrades
                     certbot
                     mail
                     messaging
                     networking
                     ssh
                     web)
(use-package-modules admin
                     certs
                     package-management
                     ssh
                     tls)

(define %nginx-deploy-hook
  (program-file
   "nginx-deploy-hook"
   #~(let ((pid (call-with-input-file "/var/run/nginx/pid" read)))
       (kill pid SIGHUP))))

(define %user "joshua")

(operating-system
 (host-name "locke-lamora")
 (timezone "America/Chicago")
 (locale "en_US.UTF-8")
 ;; This goofy code will generate the grub.cfg
 ;; without installing the grub bootloader on disk.
 (bootloader (bootloader-configuration
              (bootloader
               (bootloader
                (inherit grub-bootloader)
                (installer #~(const #t))))))
 (file-systems (cons (file-system
                      (device "/dev/sda")
                      (mount-point "/")
                      (type "ext4"))
                     %base-file-systems))

 (swap-devices (list "/dev/sdb"))

 (initrd-modules (cons "virtio_scsi"    ; Needed to find the disk
                       %base-initrd-modules))

 (users (cons* (user-account
                (name "joshua")
                (group "users")
                ;; Adding the account to the "wheel" group
                ;; makes it a sudoer.
                (supplementary-groups '("wheel"))
                (home-directory "/home/joshua"))
               (user-account
                (name "andrew")
                (group "users")
                (supplementary-groups '("wheel"))
                (home-directory "/home/andrew"))
               %base-user-accounts))

 (sudoers-file
  (plain-file "sudoers"
              (string-append (plain-file-content %sudoers-specification)
                             (format #f "~a ALL = NOPASSWD: ALL~%"
                                     "joshua"))))

 (packages (cons* nss-certs            ;for HTTPS access
                  openssh-sans-x
                  %base-packages))
 
 (services (cons*
            (service dhcp-client-service-type)

            (service certbot-service-type
                     (certbot-configuration
                      (email "jbranso@dismail.de")
                      (webroot "/srv/www")
                      (certificates
                       (list
                        (certificate-configuration
                         (name "gnucode.me")
                         (domains '("gnucode.me" "www.gnucode.me" "mail.gnucode.me" "imap.gnucode.me" "smtp.gnucode.me"))
                         (deploy-hook %nginx-deploy-hook))
                        (certificate-configuration
                         (name "gnu-hurd.com")
                         (domains '("gnu-hurd.com" "www.gnu-hurd.com"))
                         (deploy-hook %nginx-deploy-hook))
                        (certificate-configuration
                         (name "propernaming.org")
                         (domains '("propernaming.org" "www.propernaming.org"))
                         (deploy-hook %nginx-deploy-hook))
                        ))))

            (dovecot-service #:config
                             (dovecot-configuration
                              (protocols
                               (list
                                (protocol-configuration
                                 (name "imap")
                                 (mail-max-userip-connections 3))))
                              (services
                               (list
                                (service-configuration
                                 (kind "imap"))
                                (service-configuration
                                 (kind "imap-login"))
                                (service-configuration
                                 (kind "auth"))
                                (service-configuration
                                 (kind "auth-worker"))
                                (service-configuration
                                 (kind "dict"))))
                              (ssl-cert  "/etc/letsencrypt/live/gnucode.me/fullchain.pem")
                              (ssl-key "/etc/letsencrypt/live/gnucode.me/privkey.pem")
                              ))

            ;;(service gnucode-form-service-type)

            (service nginx-service-type
                     (nginx-configuration
                      (server-blocks
                       (list
                        (nginx-server-configuration
                         (server-name '("gnucode.me"))
                         (listen '("80" "443 ssl"))
                         (root "/srv/www/html/gnucode.me/site/")
                         ;; tell browsers my site supports HTTPS, and tell them that it will
                         ;; at least work for 1/2 hour.  Gradually,  I will increase this number.
                         (raw-content (list "add_header Strict-Transport-Security max-age=1800;"))
                         (ssl-certificate "/etc/letsencrypt/live/gnucode.me/fullchain.pem")
                         (ssl-certificate-key "/etc/letsencrypt/live/gnucode.me/privkey.pem")
                         (locations
                          (list
                           (nginx-location-configuration          ;certbot
                            (uri "/.well-known")
                            (body (list "root /srv/www;")))
                           (nginx-location-configuration
                            (uri "/form/")
                            (body '("proxy_pass http://127.0.0.1:8081;")))
                           %gnucode-location 
                           )))
                        (nginx-server-configuration
                         (server-name '("gnu-hurd.com"))
                         (listen '("80" "443 ssl"))
                         (root "/srv/www/html/gnu-hurd.com/")
                         (ssl-certificate "/etc/letsencrypt/live/gnu-hurd.com/fullchain.pem")
                         (ssl-certificate-key "/etc/letsencrypt/live/gnu-hurd.com/privkey.pem")
                         ;; tell browsers my site supports HTTPS, and tell them that it will
                         ;; at least work for 1/2 hour.  Gradually,  I will increase this number.
                         (raw-content (list "add_header Strict-Transport-Security max-age=1800;"))
                         (locations
                          (list
                           (nginx-location-configuration          ;certbot
                            (uri "/.well-known")
                            (body (list "root /srv/www;"))))))
                        (nginx-server-configuration
                         (server-name '("propernaming.org"))
                         (listen '("80" "443 ssl"))
                         (root "/srv/www/html/propernaming.org/site/")
                         (ssl-certificate "/etc/letsencrypt/live/propernaming.org/fullchain.pem")
                         (ssl-certificate-key "/etc/letsencrypt/live/propernaming.org/privkey.pem")
                         ;; tell browsers my site supports HTTPS, and tell them that it will
                         ;; at least work for 1/2 hour.  Gradually,  I will increase this number.
                         (raw-content (list "add_header Strict-Transport-Security max-age=1800;"))
                         (locations
                          (list
                           (nginx-location-configuration          ;certbot
                            (uri "/.well-known")
                            (body (list "root /srv/www;"))))))
                        ))))
            (service openssh-service-type
                     (openssh-configuration
                      (openssh openssh-sans-x)
                      (password-authentication? #f)
                      (authorized-keys
                       `(
                         ;;("joshua" ,(local-file "/home/joshua/linode-guix-system-configuration/id_rsa.pub"))
                         ("joshua" ,(plain-file "id_rsa.pub" %joshua-ssh-key))
                         ;;("root" ,(local-file "/home/joshua/linode-guix-system-configuration/id_rsa.pub"))
                         ("root" ,(plain-file "id_rsa.pub" %joshua-ssh-key))
                         ("andrew" ,(plain-file "andrew_rsa.pub" %andrew-ssh-key)) 
                         ))))

            ;; I've created the prosody admin user, and I imported the cert...
            ;; but pidgin tells me that I the XMPP server at gnucode.me does not support encryption.
            (service prosody-service-type
                     (prosody-configuration
                      (admins '("jbranso@dismail.de"))
                      (virtualhosts
                       (list
                        (virtualhost-configuration
                         (domain "gnucode.me"))))))

            (service mail-aliases-service-type
                     '(("webmaster" "root")
                       ("postmaster" "root")
                       ("abuse" "root")))

            ;; I can test send an email from my ssh machine via:
            ;; cat test-email.txt  | msmtp -- jbranso@dismail.de
            (service opensmtpd-service-type
                     (opensmtpd-configuration
                      (config-file %smtpd.conf)))
            (service unattended-upgrade-service-type)
            %base-services)))