linode-guix-system-configuration/linode-locke-lamora-current-config.scm

;; this was the original file that I used to create my remote linode

(add-to-load-path (dirname (current-filename)))

(use-modules (gnu)
             (guix modules)
             (secret nginx)
             )
(use-service-modules certbot
                     messaging
                     networking
                     ssh
                     web)
(use-package-modules admin
                     certs
                     package-management
                     ssh
                     tls)


(define %nginx-deploy-hook
  (program-file
   "nginx-deploy-hook"
   #~(let ((pid (call-with-input-file "/var/run/nginx/pid" read)))
       (kill pid SIGHUP))))

(define %user "joshua")

(operating-system
 (host-name "locke-lamora")
 (timezone "America/Chicago")
 (locale "en_US.UTF-8")
 ;; This goofy code will generate the grub.cfg
 ;; without installing the grub bootloader on disk.
 (bootloader (bootloader-configuration
              (bootloader
               (bootloader
                (inherit grub-bootloader)
                (installer #~(const #t))))))
 (file-systems (cons (file-system
                      (device "/dev/sda")
                      (mount-point "/")
                      (type "ext4"))
                     %base-file-systems))

 (swap-devices (list "/dev/sdb"))

 (initrd-modules (cons "virtio_scsi"    ; Needed to find the disk
                       %base-initrd-modules))

 (users (cons (user-account
               (name %user)
               (group "users")
               ;; Adding the account to the "wheel" group
               ;; makes it a sudoer.
               (supplementary-groups '("wheel"))
               (home-directory (string-append "/home/" %user)))
              %base-user-accounts))

 (sudoers-file
  (plain-file "sudoers"
              (string-append (plain-file-content %sudoers-specification)
                             (format #f "~a ALL = NOPASSWD: ALL~%"
                                     %user))))

 (packages (cons* nss-certs            ;for HTTPS access
                  openssh-sans-x
                  %base-packages))

 (services (cons*
            (service dhcp-client-service-type)

            (service certbot-service-type
                     (certbot-configuration
                      (email "jbranso@dismail.de")
                      (webroot "/srv/www")
                      (certificates
                       (list
                        (certificate-configuration
                         (name "gnucode.me")
                         (domains '("gnucode.me" "www.gnucode.me"))
                         (deploy-hook %nginx-deploy-hook))
                        (certificate-configuration
                         (name "gnu-hurd.com")
                         (domains '("gnu-hurd.com" "www.gnu-hurd.com"))
                         (deploy-hook %nginx-deploy-hook))
                        ))))

            (service nginx-service-type
                     (nginx-configuration
                      (server-blocks
                       (list
                        (nginx-server-configuration
                         (server-name '("gnucode.me"))
                         (listen '("80" "443 ssl"))
                         (root "/srv/www/html/gnucode.me/site/")
                         ;; tell browsers my site supports HTTPS, and tell them that it will
                         ;; at least work for 1/2 hour.  Gradually,  I will increase this number.
                         (raw-content (list "add_header Strict-Transport-Security max-age=1800;"))
                         (ssl-certificate "/etc/letsencrypt/live/gnucode.me/fullchain.pem")
                         (ssl-certificate-key "/etc/letsencrypt/live/gnucode.me/privkey.pem")
                         (locations
                          (list
                           (nginx-location-configuration          ;certbot
                            (uri "/.well-known")
                            (body (list "root /srv/www;")))
                           %gnucode-location 
                           )))
                        (nginx-server-configuration
                         (server-name '("gnu-hurd.com"))
                         (listen '("80" "443 ssl"))
                         (root "/srv/www/html/gnu-hurd.com/")
                         (ssl-certificate "/etc/letsencrypt/live/gnu-hurd.com/fullchain.pem")
                         (ssl-certificate-key "/etc/letsencrypt/live/gnu-hurd.com/privkey.pem")
                         ;; tell browsers my site supports HTTPS, and tell them that it will
                         ;; at least work for 1/2 hour.  Gradually,  I will increase this number.
                         (raw-content (list "add_header Strict-Transport-Security max-age=1800;"))
                         (locations
                          (list
                           (nginx-location-configuration          ;certbot
                            (uri "/.well-known")
                            (body (list "root /srv/www;"))))))
                        ))))
            (service openssh-service-type
                     (openssh-configuration
                      (openssh openssh-sans-x)
                      (password-authentication? #f)
                      (authorized-keys
                       `((%user ,(local-file
                                  (string-append
                                   "/home/" %user "/linode-guix-system-configuration/id_rsa.pub")))
                         ("root" ,(local-file
                                   (string-append
                                    "/home/" %user "/linode-guix-system-configuration/id_rsa.pub")))))))

            ;; I've created the prosody admin user, and I imported the cert...
            ;; but pidgin tells me that I the XMPP server at gnucode.me does not support encryption.
            (service prosody-service-type
                     (prosody-configuration
                      (admins '("jbranso@dismail.de"))
                      (virtualhosts
                       (list
                        (virtualhost-configuration
                         (domain "gnucode.me"))))))
            %base-services)))