123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148 |
- ;; this was the original file that I used to create my remote linode
- (add-to-load-path (dirname (current-filename)))
- (use-modules (gnu)
- (guix modules)
- (secret nginx)
- )
- (use-service-modules certbot
- messaging
- networking
- ssh
- web)
- (use-package-modules admin
- certs
- package-management
- ssh
- tls)
- (define %nginx-deploy-hook
- (program-file
- "nginx-deploy-hook"
- #~(let ((pid (call-with-input-file "/var/run/nginx/pid" read)))
- (kill pid SIGHUP))))
- (define %user "joshua")
- (operating-system
- (host-name "locke-lamora")
- (timezone "America/Chicago")
- (locale "en_US.UTF-8")
- ;; This goofy code will generate the grub.cfg
- ;; without installing the grub bootloader on disk.
- (bootloader (bootloader-configuration
- (bootloader
- (bootloader
- (inherit grub-bootloader)
- (installer #~(const #t))))))
- (file-systems (cons (file-system
- (device "/dev/sda")
- (mount-point "/")
- (type "ext4"))
- %base-file-systems))
- (swap-devices (list "/dev/sdb"))
- (initrd-modules (cons "virtio_scsi" ; Needed to find the disk
- %base-initrd-modules))
- (users (cons (user-account
- (name %user)
- (group "users")
- ;; Adding the account to the "wheel" group
- ;; makes it a sudoer.
- (supplementary-groups '("wheel"))
- (home-directory (string-append "/home/" %user)))
- %base-user-accounts))
- (sudoers-file
- (plain-file "sudoers"
- (string-append (plain-file-content %sudoers-specification)
- (format #f "~a ALL = NOPASSWD: ALL~%"
- %user))))
- (packages (cons* nss-certs ;for HTTPS access
- openssh-sans-x
- %base-packages))
- (services (cons*
- (service dhcp-client-service-type)
- (service certbot-service-type
- (certbot-configuration
- (email "jbranso@dismail.de")
- (webroot "/srv/www")
- (certificates
- (list
- (certificate-configuration
- (name "gnucode.me")
- (domains '("gnucode.me" "www.gnucode.me"))
- (deploy-hook %nginx-deploy-hook))
- (certificate-configuration
- (name "gnu-hurd.com")
- (domains '("gnu-hurd.com" "www.gnu-hurd.com"))
- (deploy-hook %nginx-deploy-hook))
- ))))
- (service nginx-service-type
- (nginx-configuration
- (server-blocks
- (list
- (nginx-server-configuration
- (server-name '("gnucode.me"))
- (listen '("80" "443 ssl"))
- (root "/srv/www/html/gnucode.me/site/")
- ;; tell browsers my site supports HTTPS, and tell them that it will
- ;; at least work for 1/2 hour. Gradually, I will increase this number.
- (raw-content (list "add_header Strict-Transport-Security max-age=1800;"))
- (ssl-certificate "/etc/letsencrypt/live/gnucode.me/fullchain.pem")
- (ssl-certificate-key "/etc/letsencrypt/live/gnucode.me/privkey.pem")
- (locations
- (list
- (nginx-location-configuration ;certbot
- (uri "/.well-known")
- (body (list "root /srv/www;")))
- %gnucode-location
- )))
- (nginx-server-configuration
- (server-name '("gnu-hurd.com"))
- (listen '("80" "443 ssl"))
- (root "/srv/www/html/gnu-hurd.com/")
- (ssl-certificate "/etc/letsencrypt/live/gnu-hurd.com/fullchain.pem")
- (ssl-certificate-key "/etc/letsencrypt/live/gnu-hurd.com/privkey.pem")
- ;; tell browsers my site supports HTTPS, and tell them that it will
- ;; at least work for 1/2 hour. Gradually, I will increase this number.
- (raw-content (list "add_header Strict-Transport-Security max-age=1800;"))
- (locations
- (list
- (nginx-location-configuration ;certbot
- (uri "/.well-known")
- (body (list "root /srv/www;"))))))
- ))))
- (service openssh-service-type
- (openssh-configuration
- (openssh openssh-sans-x)
- (password-authentication? #f)
- (authorized-keys
- `((%user ,(local-file
- (string-append
- "/home/" %user "/linode-guix-system-configuration/id_rsa.pub")))
- ("root" ,(local-file
- (string-append
- "/home/" %user "/linode-guix-system-configuration/id_rsa.pub")))))))
- ;; I've created the prosody admin user, and I imported the cert...
- ;; but pidgin tells me that I the XMPP server at gnucode.me does not support encryption.
- (service prosody-service-type
- (prosody-configuration
- (admins '("jbranso@dismail.de"))
- (virtualhosts
- (list
- (virtualhost-configuration
- (domain "gnucode.me"))))))
- %base-services)))
|