linode-guix-system-configuration/gnucode.me-current-config.scm

;; this is the current configuration for my gnucode.me,
;; propernaming.org, and gnu-hurd.com

(add-to-load-path (dirname (current-filename)))

(add-to-load-path "/home/joshua/prog/gnu/guix/guixrus")

(use-modules (gnu)
             (guix modules)
             ;;(secret nginx)
             (public-keys)
             ;;(gnucode-form)
             (nftables)
             (endlessh-service)
             ;;(opensmtpd-records)
             ;;(gnu services mail)
             (guixrus services opensmtpd)
             (gnu packages mail)
             ((gnu services mail)
              #:hide (opensmtpd-configuration
                      opensmtpd-configuration?
                      opensmtpd-service-type
                      %default-opensmtpd-config-file))
             )
(use-service-modules admin ; unattended-upgrades
                     certbot
                     ;; mail
                     mcron
                     messaging
                     networking
                     sysctl
                     ssh
                     vpn ;;wireguard
                     web)
(use-package-modules admin
                     certs
                     package-management
                     ssh
                     tls)

(define %nginx-deploy-hook
  (program-file
   "nginx-deploy-hook"
   #~(let ((pid (call-with-input-file "/var/run/nginx/pid" read)))
       (kill pid SIGHUP))))

(define %my-base-services
  (modify-services %base-services
    (guix-service-type config =>
                       (guix-configuration (inherit config)
                                           (discover? #t)
                                           (substitute-urls
                                            (append (list
                                                     "https://bordeaux-us-east-mirror.cbaines.net/"
                                                     "https://guix.tobias.gr")
                                                    %default-substitute-urls))
                                           (authorized-keys
                                            (append (list
                                                     ;; setting up guix deploy from dobby.
                                                     (local-file "./dobby-guix-signing-key.pub")
                                                     (plain-file
                                                      "guix.tobias.gr"
                                                      "(public-key
 (ecc
  (curve Ed25519)
  (q #E21911E159DB6D031A763509A255B054360A4A96F5668CBBAC48052E67D274D3#)
  )
 )
")
                                                     (plain-file
                                                      "bordeaux.guix.gnu.org.signing.key"
                                                      "
(public-key
 (ecc
  (curve Ed25519)
  (q #7D602902D3A2DBB83F8A0FB98602A754C5493B0B778C8D1DD4E0F41DE14DE34F#)
  )
 )")
                                                     )))
                                           (extra-options '("--max-jobs=1"))))

    ;; security stuff.
    (sysctl-service-type config =>
                         (sysctl-configuration
                          (settings
                           (append
                            '(
                              ;;disable ipv6
                              ("net.ipv6.conf.all.disable_ipv6"        . "1")
                              ("net.ipv6.conf.all.disable_policy"      . "1")
                              ("net.ipv6.conf.default.disable_ipv6"    . "1")
                              ("net.ipv6.conf.default.disable_policy"  . "1")
                              ("net.ipv6.conf.enp0s10.disable_ipv6"    . "1")
                              ("net.ipv6.conf.enp0s10.disable_policy"  . "1")
                              ("net.ipv6.conf.lo.disable_ipv6"         . "1")
                              ("net.ipv6.conf.lo.disable_policy"       . "1")
                              ;; disable ebpf in kernel virtual machine for unprivledged users
                              ("sysctl kernel.unprivileged_bpf_disabled" . "1")
                              ("spec_store_bypass_disable" . "on")
                              ("spectre_v2" . "on")
                              ("lld_flush" . "on")
                              ;; need to enable apparmor for this...
                              ;;("lockdown" . "confidentiality")
                              ("init_on_alloc" . "1")
                              ("init_on_free"  . "1")
                              ("page_alloc.shuffle" . "1")
                              ;;("slab_nomerge")
                              ("vsyscall"      . "1")
                              ;; ("slub_debug" . "F")
                              ("randomize_kstack_offset" . "1")
                              ;; disable re-leading a running kernel
                              ("kernel.kexec_load_disabled" . "1")
                              ;; restrict kernel pointers
                              ("kernel.kptr_restrict" . "2")
                              ;; unprivledegd users cannot get perf events
                              ("kernel.perf_event_paranoid" . "3")
                              ;; only privledged users can use bpf
                              ("net.core.bpf_jit_harden" . "2")
                              ("kernel.unprivleged_bpf" . "1")
                              ;; prevest some proofing attacks
                              ("net.ipv4.conf.all.rp_filter" . "1")
                              ("net.ipv4.conf.default.rp_filter" . "1")
                              ;; disable icmp redirects and
                              ;; RFC1620 shared media redirects
                              ("net.ipv4.conf.all.accept_redirects" . "0")
                              ("net.ipv4.conf.all.secure_redirects" . "0")
                              ("net.ipv4.conf.all.send_redirects" . "0")
                              ("net.ipv4.conf.all.shared_media" . "0")
                              ("net.ipv4.conf.default.accept_redirects" . "0")
                              ("net.ipv4.conf.default.secure_redirects" . "0")
                              ("net.ipv4.conf.default.send_redirects" . "0")
                              ("net.ipv4.conf.default.shared_media" . "0")
                              ("net.ipv6.conf.all.accept_redirects" . "0")
                              ("net.ipv6.conf.default.accept_redirects" . "0")
                              ;; disallow source-routed packets
                              ("net.ipv4.conf.all.accept_source_route" . "0")
                              ("net.ipv4.conf.default.accept_source_route" . "0")
                              ("net.ipv6.conf.all.accept_source_route" . "0")
                              ("net.ipv6.conf.default.accept_source_route" . "0")
                              ;; disable pings sent to a broadcast address
                              ("net.ipv4.icmp_echo_ignore_broadcasts" . "1")
                              ;; disable bogus icmp error responses
                              ("net.ipv4.icmp_ignore_bogus_error_responses" . "1")

                              ;; protect against time-wait assassination hazards in tcp
                              ("net.ipv4.tcp_rfc1337" . "1")

                              ("net.ipv4.tcp_sack" . "0")
                              ("net.ipv4.tcp_dsack" . "0")

                              ("net.ipv4.tcp_timestamps" . "0")
                              ("vm.mmap_rnd_bits" . "32")
                              ("vm.mmap_rnd_compat_bits" . "16")
                              ("net.ipv4.icmp_echo_ignore_all" . "1")
                              )
                            %default-sysctl-settings))))))

(define %system
  (operating-system
   (host-name "copertino")
   (timezone "America/Chicago")
   (locale "en_US.UTF-8")
   ;; This goofy code will generate the grub.cfg
   ;; without installing the grub bootloader on disk.
   (bootloader (bootloader-configuration
                (bootloader
                 (bootloader
                  (inherit grub-bootloader)
                  (installer #~(const #t))))))
   (file-systems (cons (file-system
                        (device "/dev/sda")
                        (mount-point "/")
                        (type "ext4"))
                       %base-file-systems))

   (swap-devices (list
                  (swap-space (target "/dev/sdb"))))

   (initrd-modules (cons "virtio_scsi"    ; Needed to find the disk
                         %base-initrd-modules))

   (users (cons* (user-account
                  (name "joshua")
                  (group "users")
                  ;; Adding the account to the "wheel" group
                  ;; makes it a sudoer.
                  (supplementary-groups '("wheel"))
                  (home-directory "/home/joshua"))
                 ;;                 (user-account
                 ;;                  (name "vmail")
                 ;;                  (group "vmail")
                 ;;                  (home-directory "vmail")
                 ;;                  (system? #t)
                 ;;                  (comment "User that dovecot users to deliver emails
                 ;; to /home/vmail/gnucode.me/joshua"))
                 %base-user-accounts))

   ;; (groups (cons* (user-group
   ;;                 (name "vmail")
   ;;                 (system? #t))
   ;;                %base-groups))

   ;; I can read 'man 5 suoders' for tips about the syntax of suoders file.
   ;; the very end of the file has some examples.
   (sudoers-file
    (plain-file "sudoers"
                (string-append (plain-file-content %sudoers-specification)
                               (format #f "~a ALL = NOPASSWD: ALL~%"
                                       "joshua"))))

   (packages (cons* nss-certs             ;for HTTPS access
                    openssh-sans-x
                    %base-packages))

   (services (cons*
              (service dhcp-client-service-type)

              (service certbot-service-type
                       (certbot-configuration
                        (email "jbranso@dismail.de")
                        (webroot "/srv/www")
                        (certificates
                         (list
                          (certificate-configuration
                           (name "gnucode.me")
                           (domains '("gnucode.me" "www.gnucode.me"
                                      "imap.gnucode.me"
                                      "smtp.gnucode.me"))
                           (deploy-hook %nginx-deploy-hook))
                          (certificate-configuration
                           (name "gnu-hurd.com")
                           (domains '("gnu-hurd.com" "www.gnu-hurd.com"))
                           (deploy-hook %nginx-deploy-hook))
                          (certificate-configuration
                           (name "propernaming.org")
                           (domains '("propernaming.org" "www.propernaming.org"))
                           (deploy-hook %nginx-deploy-hook))
                          ))))

              (dovecot-service #:config
                               (dovecot-configuration
                                (mail-location "maildir:/home/%n/Maildir")
                                (protocols
                                 (list
                                  (protocol-configuration
                                   (name "imap")
                                   (mail-max-userip-connections 3))
                                  ;;(protocol-configuration name "lmtp")
                                  ))

                                ;; I am hoping to set up LMTP, that way I can set up Sieve filtering.
                                ;; https://doc.dovecot.org/configuration_manual/sieve/configuration/
                                ;; https://doc.dovecot.org/configuration_manual/protocols/lmtp_server/#lmtp-server
                                ;; (services
                                ;;  (list
                                ;;   (service-configuration
                                ;;    (kind "imap"))))

                                ;; someone tries to login via joshua@gnucode.me
                                ;; this strips away that login username to "joshua"
                                ;; when I set up virtual users, I'll need to delete this!
                                ;; https://wiki.dovecot.org/DomainLost
                                ;; auth_username_format = %Ln
                                ;; lowercases the username but also
                                ;; drops the domain. Use
                                ;; auth_username_format = %Lu instead.
                                ;; (auth-username-format "%Ln")
                                ;; for now just use the defaults...
                                ;; (services
                                ;;  (list
                                ;;   (service-configuration
                                ;;    (kind "imap")
                                ;;    (client-limit 2))
                                ;;   (service-configuration
                                ;;    (kind "imap-login")
                                ;;    (clint-limit 2))
                                ;;   (service-configuration
                                ;;    (kind "auth")
                                ;;    (client-limit 2))
                                ;;   (service-configuration
                                ;;    (kind "auth-worker")
                                ;;    (client-limit 2))
                                ;;   (service-configuration
                                ;;    (kind "dict")
                                ;;    (client-limit 2)))
                                ;;  )

                                ;; perhaps I DO NOT need to use letsencrypt certs...
                                ;; because guix creates these certs for me by default in
                                ;; /etc/dovecot/
                                ;; I guess that I do need/want these certs.  Otherwise dovecot
                                ;; tries to connect to my server insecurely.
                                ;; which means that I probably need to change my user joshua password
                                ;; since I have been sending it insecurely!
                                (ssl-cert  "</etc/letsencrypt/live/gnucode.me/fullchain.pem")
                                (ssl-key "</etc/letsencrypt/live/gnucode.me/privkey.pem")
                                ))

              ;; (service endlessh-service-type)

              ;;(service gnucode -form-service-type)

              ;; (service mcron-service-type
              ;;          (mcron-configuration
              ;;           (jobs (list
              ;;                  ;; run endlessh every 5 minutes
              ;;                  #~(job "*/1 0 * * *"
              ;;                         (string-append #$endlessh "/bin/endlessh -p 22")
              ;;                         #:user "root")))))

              (let ([default-listen (list "80"
                                          "443 ssl http2"
                                          "[::]:80"
                                          "[::]:443 ssl http2"
                                          )]
                    [default-raw-content (list "add_header Strict-Transport-Security max-age=1800;")]
                    [srv-root-dir "/srv/www/html/"]
                    [letsencrypt-dir "/etc/letsencrypt/live/"]
                    [letsencrypt-acme-challenge (nginx-location-configuration ;; for certbot
                                                 (uri "/.well-known")
                                                 (body (list "root /srv/www;")))])

                ;; make a pubnix nginx-servec-configuration
                ;; I can use this-operating-system ...read more about it in the manual.
                ;; then I can do something like: for all users, make gnucode.me/~<user>/ serve
                ;; their html files.
                (service nginx-service-type
                         (nginx-configuration
                          (server-blocks
                           (list
                            (nginx-server-configuration
                             ;; perhaps make a macro for the next 6 lines:
                             ;; (letsencrypt-certs "gnucode.me")
                             ;; local.gnucode.me
                             (server-name '("gnucode.me"))
                             (listen default-listen)
                             (root (string-append srv-root-dir "gnucode.me/site/"))
                             (ssl-certificate (string-append letsencrypt-dir "gnucode.me/fullchain.pem"))
                             (ssl-certificate-key (string-append letsencrypt-dir "gnucode.me/privkey.pem"))
                             ;; tell browsers my site supports HTTPS, and tell them that it will
                             ;; at least work for 1/2 hour.  Gradually,  I will increase this number.
                             (raw-content default-raw-content)
                             (locations
                              (list
                               letsencrypt-acme-challenge ;; for certbot
                               (nginx-location-configuration
                                (uri "/form/")
                                (body '("proxy_pass http://127.0.0.1:8081;")))
                               (nginx-location-configuration ;; for certbot
                                (uri "/agenda/")
                                (body
                                 (list
                                  (string-append "root " srv-root-dir "gnucode.me/agenda/;\n")
                                        ;(string-append "auth_basic \"Yearly Agenda\";\n")
                                        ;(string-append "auth_basic_user_file " srv-root-dir "gnucode.me/agenda/htpasswd;")
                                  ))))))
                            (nginx-server-configuration
                             (server-name '("gnu-hurd.com"))
                             (listen default-listen)
                             (root (string-append srv-root-dir "gnu-hurd.com/"))
                             (ssl-certificate (string-append letsencrypt-dir "gnu-hurd.com/fullchain.pem"))
                             (ssl-certificate-key (string-append letsencrypt-dir "gnu-hurd.com/privkey.pem"))
                             ;; tell browsers my site supports HTTPS, and tell them that it will
                             ;; at least work for 1/2 hour.  Gradually,  I will increase this number.
                             (raw-content default-raw-content)
                             (locations
                              (list
                               letsencrypt-acme-challenge ;; for certbot
                               )))
                            (nginx-server-configuration
                             (server-name '("propernaming.org"))
                             (listen default-listen)
                             (root (string-append srv-root-dir "propernaming.org/site/"))
                             (ssl-certificate (string-append letsencrypt-dir "propernaming.org/fullchain.pem"))
                             (ssl-certificate-key (string-append letsencrypt-dir "propernaming.org/privkey.pem"))
                             ;; tell browsers my site supports HTTPS, and tell them that it will
                             ;; at least work for 1/2 hour.  Gradually,  I will increase this number.
                             (raw-content default-raw-content)
                             (locations
                              (list
                               letsencrypt-acme-challenge ;; for certbot
                               )))
                            )))))

              (service openssh-service-type
                       (openssh-configuration
                        (openssh openssh-sans-x)
                        (password-authentication? #f)
                        (port-number 22)
                        (authorized-keys
                         `(
                           ;; ("joshua" ,(local-file "/home/joshua/linode-guix-system-configuration/ssh-keys/joshua_id_rsa.pub"))
                           ;; ("root" ,(local-file "/home/joshua/linode-guix-system-configuration/ssh-keys/joshua_id_rsa.pub"))
                           ;; local file is simpler.  I can get rid of (use-module (secret ssh-keys))
                           ("joshua" ,(plain-file "id_rsa.pub" %joshua-ssh-key))
                           ("root" ,(plain-file "id_rsa.pub" %joshua-ssh-key))
                           ))))

              ;; I've created the prosody admin user, and I imported the cert...
              ;; but pidgin tells me that I the XMPP server at gnucode.me does not support encryption.
              (service prosody-service-type
                       (prosody-configuration
                        ;;(certificates "/etc/")
                        (admins '("jbranso@gnucode.me"))
                        (virtualhosts
                         (list
                          (virtualhost-configuration
                           (domain "gnucode.me"))))))

              ;; (service mail-aliases-service-type
              ;;          '(("webmaster" "root")
              ;;            ("postmaster" "root")
              ;;            ("abuse" "root")))

              ;; I can test send an email from my ssh machine via:
              ;; cat test-email.txt  | msmtp -- jbranso@dismail.de
              ;; (service opensmtpd-service-type
              ;;          (opensmtpd-configuration
              ;;           (config-file %smtpd.conf)))

              ;; TODO my nftables for a server ARE NOT working.
              ;; (service nftables-service-type
              ;;          (nftables-configuration
              ;;           (ruleset
              ;;            (plain-file "nftables.conf" %gnucode-nftables-ruleset))))

              (service opensmtpd-service-type
                       (let ([action-receive (opensmtpd-local-delivery
                                              (name "receive")
                                              (method (opensmtpd-maildir
                                                       (pathname "/home/%{rcpt.user}/Maildir")
                                                       (junk #t)))
                                              (virtual (opensmtpd-table
                                                        (name "vusers")
                                                        (data '(("joshua@gnucode.me"  . "joshua")
                                                                ("jbranso@gnucode.me" . "joshua")
                                                                ("postmaster@gnucode.me" .  "joshua"))))))]
                             [pki-gnucode (opensmtpd-pki
                                           (domain "smtp.gnucode.me")
                                           (cert "/etc/letsencrypt/live/gnucode.me/fullchain.pem")
                                           (key "/etc/letsencrypt/live/gnucode.me/privkey.pem"))]
                             [filter-dkimsign (opensmtpd-filter
                                               (name "dkimsign")
                                               (exec #t)
                                               (proc (list (file-append opensmtpd-filter-dkimsign "/libexec/opensmtpd/filter-dkimsign")
                                                           " -d gnucode.me -s 2023-02-28 -c relaxed/relaxed -k "
                                                           "/etc/opensmtpd/dkimsign/02-28-2023-rsa1024-gnucode.me-private.key "
                                                           "user nobody group nogroup")))]
                             [table-creds (opensmtpd-table
                                           (name "creds")
                                           (data
                                            (list
                                             (cons "joshua"
                                                   "$6$Ec4m8FgKjT2F/03Y$k66ABdse9TzCX6qaALB3WBL9GC1rmAWJmaoSjFMpbhzat7DOpFqpnOwpbZ34wwsQYIK8RQlqwM1I/v6vsRq86."))))])
                         (opensmtpd-configuration
                          (interfaces
                           (list
                            ;; this forum help suggests that I listen on 0.0.0.0 and NOT eth0
                            ;; https://serverfault.com/questions/726795/opensmtpd-wont-work-at-reboot
                            ;; this listens for email from the outside world
                            (opensmtpd-interface
                             (interface "eth0")
                             (port 25)
                             (secure-connection "tls")
                             (pki pki-gnucode))
                            ;; this lets local users logged into the system via ssh send email
                            (opensmtpd-interface
                             (interface "lo")
                             (port 25)
                             (secure-connection "tls")
                             (pki pki-gnucode))
                            (opensmtpd-interface
                             (interface "eth0")
                             (port 465)
                             (secure-connection "smtps")
                             (pki pki-gnucode)
                             (auth table-creds)
                             (filters (list filter-dkimsign)))
                            (opensmtpd-interface
                             (interface "eth0")
                             (port 587)
                             (secure-connection "tls-require")
                             (pki pki-gnucode)
                             (auth table-creds)
                             (filters (list filter-dkimsign)))))
                          (matches (list
                                    (opensmtpd-match
                                     (action (opensmtpd-relay
                                              (name "relay")))
                                     (options
                                      (list
                                       (opensmtpd-option
                                        (option "for any"))
                                       (opensmtpd-option
                                        (option "from any"))
                                       (opensmtpd-option
                                        (option "auth")))))
                                    (opensmtpd-match
                                     (action action-receive)
                                     (options
                                      (list
                                       (opensmtpd-option
                                        (option "from any"))
                                       (opensmtpd-option
                                        (option "for domain")
                                        (data (opensmtpd-table
                                               (name "vdoms")
                                               (data (list "gnucode.me"
                                                           "gnu-hurd.com"))))))))
                                    (opensmtpd-match
                                     (action action-receive)
                                     (options
                                      (list
                                       (opensmtpd-option
                                        (option "for local"))))))))))

              (service unattended-upgrade-service-type)

              ;; (service wireguard-service-type
              ;;          (wireguard-configuration
              ;;           (private-key "/home/joshua/linode-guix-system-configuration/wireguard-keys/server.private.key")
              ;;           (peers
              ;;            (list
              ;;             (wireguard-peer
              ;;              (name "my servers peer for my laptop")
              ;;              (public-key "/home/joshua/linode-guix-system-configuration/wireguard-keys/laptop.pub"))))))
              %my-base-services))))

(list (machine
       (operating-system %system)
       (environment managed-host-environment-type)
       (configuration (machine-ssh-configuration
                       (host-name "45.56.66.20")
                       (system "x86_64-linux")
                       (user "joshua")
                       (identity "~/.ssh/id_rsa")
                       (host-key "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJgL0hBTWmCVGGvNJYa+YS+fEXs89v0GbdkQ+M+LdZlf root@(none)")
                       (port 22)))))