linode-guix-system-configuration/linode-locke-lamora-current-config.scm

;; this is the current configuration for my linode "Guix System"

(add-to-load-path (dirname (current-filename)))

(use-modules (gnu)
             (guix modules)
             (secret nginx)
             (public-keys)
             ;;(gnucode-form)
             (endlessh-service)
             ;;(opensmtpd-records)
             (gnu services mail)
             (opensmtpd)
             ;; ((gnu services mail)
             ;;  #:hide (opensmtpd-configuration
             ;;          opensmtpd-configuration?
             ;;          opensmtpd-service-type
             ;;          %default-opensmtpd-config-file))
             )
(use-service-modules admin ; unattended-upgrades
                     certbot
                     ;; mail
                     mcron
                     messaging
                     networking
                     ssh
                     vpn ;;wireguard
                     web)
(use-package-modules admin
                     certs
                     package-management
                     ssh
                     tls)

(define %nginx-deploy-hook
  (program-file
   "nginx-deploy-hook"
   #~(let ((pid (call-with-input-file "/var/run/nginx/pid" read)))
       (kill pid SIGHUP))))

(define %user "joshua")

(operating-system
  (host-name "locke-lamora")
  (timezone "America/Chicago")
  (locale "en_US.UTF-8")
  ;; This goofy code will generate the grub.cfg
  ;; without installing the grub bootloader on disk.
  (bootloader (bootloader-configuration
               (bootloader
                (bootloader
                 (inherit grub-bootloader)
                 (installer #~(const #t))))))
  (file-systems (cons (file-system
                        (device "/dev/sda")
                        (mount-point "/")
                        (type "ext4"))
                      %base-file-systems))

  (swap-devices (list "/dev/sdb"))

  (initrd-modules (cons "virtio_scsi"    ; Needed to find the disk
                        %base-initrd-modules))

  (users (cons* (user-account
                 (name "joshua")
                 (group "users")
                 ;; Adding the account to the "wheel" group
                 ;; makes it a sudoer.
                 (supplementary-groups '("wheel"))
                 (home-directory "/home/joshua"))
;;                 (user-account
;;                  (name "vmail")
;;                  (group "vmail")
;;                  (home-directory "vmail")
;;                  (system? #t)
;;                  (comment "User that dovecot users to deliver emails
;; to /home/vmail/gnucode.me/joshua"))
                %base-user-accounts))

  ;; (groups (cons* (user-group
  ;;                 (name "vmail")
  ;;                 (system? #t))
  ;;                %base-groups))

  (sudoers-file
   (plain-file "sudoers"
               (string-append (plain-file-content %sudoers-specification)
                              (format #f "~a ALL = NOPASSWD: ALL~%"
                                      "joshua"))))

  (packages (cons* nss-certs            ;for HTTPS access
                   openssh-sans-x
                   %base-packages))
  
  (services (cons*
             (service dhcp-client-service-type)

             (service certbot-service-type
                      (certbot-configuration
                       (email "jbranso@dismail.de")
                       (webroot "/srv/www")
                       (certificates
                        (list
                         (certificate-configuration
                          (name "gnucode.me")
                          (domains '("gnucode.me" "www.gnucode.me"
                                     "imap.gnucode.me"
                                     "smtp.gnucode.me"))
                          (deploy-hook %nginx-deploy-hook))
                         (certificate-configuration
                          (name "gnu-hurd.com")
                          (domains '("gnu-hurd.com" "www.gnu-hurd.com"))
                          (deploy-hook %nginx-deploy-hook))
                         (certificate-configuration
                          (name "propernaming.org")
                          (domains '("propernaming.org" "www.propernaming.org"))
                          (deploy-hook %nginx-deploy-hook))
                         ))))

             (dovecot-service #:config
                              (dovecot-configuration
                               (mail-location "maildir:/home/%n/Maildir")
                               (protocols
                                (list
                                 (protocol-configuration
                                  (name "imap")
                                  (mail-max-userip-connections 3))
                                 ;;(protocol-configuration name "lmtp")
                                 ))

                               ;; I am hoping to set up LMTP, that way I can set up Sieve filtering.
                               ;; https://doc.dovecot.org/configuration_manual/sieve/configuration/
                               ;; https://doc.dovecot.org/configuration_manual/protocols/lmtp_server/#lmtp-server
                               ;; (services
                               ;;  (list
                               ;;   (service-configuration
                               ;;    (kind "imap"))))

                               ;; someone tries to login via joshua@gnucode.me
                               ;; this strips away that login username to "joshua"
                               ;; when I set up virtual users, I'll need to delete this!
                               ;; https://wiki.dovecot.org/DomainLost
                               ;; auth_username_format = %Ln
                               ;; lowercases the username but also
                               ;; drops the domain. Use
                               ;; auth_username_format = %Lu instead.
                               ;; (auth-username-format "%Ln")
                               ;; for now just use the defaults...
                               ;; (services
                               ;;  (list
                               ;;   (service-configuration
                               ;;    (kind "imap")
                               ;;    (client-limit 2))
                               ;;   (service-configuration
                               ;;    (kind "imap-login")
                               ;;    (clint-limit 2))
                               ;;   (service-configuration
                               ;;    (kind "auth")
                               ;;    (client-limit 2))
                               ;;   (service-configuration
                               ;;    (kind "auth-worker")
                               ;;    (client-limit 2))
                               ;;   (service-configuration
                               ;;    (kind "dict")
                               ;;    (client-limit 2)))
                               ;;  )

                               ;; perhaps I DO NOT need to use letsencrypt certs...
                               ;; because guix creates these certs for me by default in
                               ;; /etc/dovecot/
                               ;; I guess that I do need/want these certs.  Otherwise dovecot
                               ;; tries to connect to my server insecurely.
                               ;; which means that I probably need to change my user joshua password
                               ;; since I have been sending it insecurely!
                               (ssl-cert  "</etc/letsencrypt/live/gnucode.me/fullchain.pem")
                               (ssl-key "</etc/letsencrypt/live/gnucode.me/privkey.pem")
                               ))

             (service endlessh-service-type)

             ;;(service gnucode -form-service-type)

             (service mcron-service-type
                      (mcron-configuration
                       (jobs (list
                              ;; run endlessh every 5 minutes
                              #~(job "*/1 0 * * *"
                                     (string-append #$endlessh "/bin/endlessh -p 22")
                                     #:user "root")))))

             (let ([default-listen (list "80" "443 ssl http2"
                                                   "[::]:80"
                                                   "[::]:443 ssl http2")]
                   [default-raw-content (list "add_header Strict-Transport-Security max-age=1800;")]
                   [srv-root-dir "/srv/www/html/"]
                   [letsencrypt-dir "/etc/letsencrypt/live/"]
                   [letsencrypt-acme-challenge (nginx-location-configuration ;; for certbot
                                                (uri "/.well-known")
                                                (body (list "root /srv/www;")))])

               ;; make a pubnix nginx-servec-configuration
               ;; I can use this-operating-system ...read more about it in the manual.
               ;; then I can do something like: for all users, make gnucode.me/~<user>/ serve
               ;; their html files.
               (service nginx-service-type
                        (nginx-configuration
                         (server-blocks
                          (list
                           (nginx-server-configuration
                            ;; perhaps make a macro for the next 6 lines:
                            ;; (letsencrypt-certs "gnucode.me")
                            ;; local.gnucode.me
                            (server-name '("gnucode.me"))
                            (listen default-listen)
                            (root (string-append srv-root-dir "gnucode.me/site/"))
                            (ssl-certificate (string-append letsencrypt-dir "gnucode.me/fullchain.pem"))
                            (ssl-certificate-key (string-append letsencrypt-dir "gnucode.me/privkey.pem"))
                            ;; tell browsers my site supports HTTPS, and tell them that it will
                            ;; at least work for 1/2 hour.  Gradually,  I will increase this number.
                            (raw-content default-raw-content)
                            (locations
                             (list
                              letsencrypt-acme-challenge ;; for certbot
                              (nginx-location-configuration
                               (uri "/form/")
                               (body '("proxy_pass http://127.0.0.1:8081;")))
                              %secret-nginx-location
                              )))
                           (nginx-server-configuration
                            (server-name '("gnu-hurd.com"))
                            (listen default-listen)
                            (root (string-append srv-root-dir "gnu-hurd.com/"))
                            (ssl-certificate (string-append letsencrypt-dir "gnu-hurd.com/fullchain.pem"))
                            (ssl-certificate-key (string-append letsencrypt-dir "gnu-hurd.com/privkey.pem"))
                            ;; tell browsers my site supports HTTPS, and tell them that it will
                            ;; at least work for 1/2 hour.  Gradually,  I will increase this number.
                            (raw-content default-raw-content)
                            (locations
                             (list
                              letsencrypt-acme-challenge ;; for certbot
                              )))
                           (nginx-server-configuration
                            (server-name '("propernaming.org"))
                            (listen default-listen)
                            (root (string-append srv-root-dir "propernaming.org/site/"))
                            (ssl-certificate (string-append letsencrypt-dir "propernaming.org/fullchain.pem"))
                            (ssl-certificate-key (string-append letsencrypt-dir "propernaming.org/privkey.pem"))
                            ;; tell browsers my site supports HTTPS, and tell them that it will
                            ;; at least work for 1/2 hour.  Gradually,  I will increase this number.
                            (raw-content default-raw-content)
                            (locations
                             (list
                              letsencrypt-acme-challenge ;; for certbot
                              )))
                           )))))

             (service openssh-service-type
                      (openssh-configuration
                       (openssh openssh-sans-x)
                       (password-authentication? #f)
                       (port-number 63355)
                       (authorized-keys
                        `(
                          ;; ("joshua" ,(local-file "/home/joshua/linode-guix-system-configuration/ssh-keys/joshua_id_rsa.pub"))
                          ;; ("root" ,(local-file "/home/joshua/linode-guix-system-configuration/ssh-keys/joshua_id_rsa.pub"))
                          ;; local file is simpler.  I can get rid of (use-module (secret ssh-keys))
                          ("joshua" ,(plain-file "id_rsa.pub" %joshua-ssh-key))
                          ("root" ,(plain-file "id_rsa.pub" %joshua-ssh-key))
                          ))))

             ;; I've created the prosody admin user, and I imported the cert...
             ;; but pidgin tells me that I the XMPP server at gnucode.me does not support encryption.
             (service prosody-service-type
                      (prosody-configuration
                       ;;(certificates "/etc/")
                       (admins '("jbranso@gnucode.me"))
                       (virtualhosts
                        (list
                         (virtualhost-configuration
                          (domain "gnucode.me"))))))

             (service mail-aliases-service-type
                      '(("webmaster" "root")
                        ("postmaster" "root")
                        ("abuse" "root")))

             ;; I can test send an email from my ssh machine via:
             ;; cat test-email.txt  | msmtp -- jbranso@dismail.de
             (service opensmtpd-service-type
                      (opensmtpd-configuration
                       (config-file %smtpd.conf)))

             ;; (service opensmtpd-service-type
             ;;          (opensmtpd-configuration
             ;;           (pkis (list
             ;;                  (opensmtpd-pki
             ;;                   (domain "smtp.gnucode.me")
             ;;                   (cert "/etc/letsencrypt/live/gnucode.me/fullchain.pem")
             ;;                   (key "/etc/letsencrypt/live/gnucode.me/privkey.pem"))))
             ;;           (tables (list
             ;;                    (opensmtpd-table
             ;;                     (name "aliases")
             ;;                     (values
             ;;                      (list
             ;;                       (cons "webmaster" "root")
             ;;                       (cons "postmaster" "root")
             ;;                       (cons "abuse" "root"))))
             ;;                    (opensmtpd-table
             ;;                     (name "creds")
             ;;                     (values
             ;;                      (list
             ;;                       (cons "joshua"
             ;;                             "$6$Ec4m8FgKjT2F/03Y$k66ABdse9TzCX6qaALB3WBL9GC1rmAWJmaoSjFMpbhzat7DOpFqpnOwpbZ34wwsQYIK8RQlqwM1I/v6vsRq86."))))
             ;;                    (opensmtpd-table
             ;;                     (name "vdoms")
             ;;                     (values (list "gnucode.me"
             ;;                                   "gnu-hurd.com")))
             ;;                    (opensmtpd-table
             ;;                     (name "vusers")
             ;;                     (values (list (cons "joshua@gnucode.me" "joshua")
             ;;                                   (cons "jbranso@gnucode.me" "joshua")
             ;;                                   (cons "postmaster@gnucode.me" "joshua"))))))
             ;;           (listen-ons
             ;;            (list
             ;;             ;; this forum help suggests that I listen on 0.0.0.0 and NOT eth0
             ;;             ;; https://serverfault.com/questions/726795/opensmtpd-wont-work-at-reboot
             ;;             ;; this listens for email from the outside world
             ;;             (opensmtpd-listen-on
             ;;              (interface "eth0")
             ;;              (port 25)
             ;;              (secure-connection "tls")
             ;;              (pki "smtp.gnucode.me"))
             ;;             ;; this lets local users logged into the system via ssh send email
             ;;             (opensmtpd-listen-on
             ;;              (interface "lo")
             ;;              (port 25)
             ;;              (secure-connection "tls")
             ;;              (pki "smtp.gnucode.me"))
             ;;             (opensmtpd-listen-on
             ;;              (interface "eth0")
             ;;              (port 465)
             ;;              (secure-connection "smtps")
             ;;              (pki "smtp.gnucode.me")
             ;;              (auth "creds")
             ;;              (filter "dkimsign"))
             ;;             (opensmtpd-listen-on
             ;;              (interface "eth0")
             ;;              (port 587)
             ;;              (secure-connection "tls-require")
             ;;              (pki "smtp.gnucode.me")
             ;;              (auth "creds")
             ;;              (filter "dkimsign"))))
             ;;           (actions
             ;;            (list
             ;;             (opensmtpd-action
             ;;              (name "receive")
             ;;              (method 
             ;;               (opensmtpd-local-delivery-configuration
             ;;                (method (opensmtpd-maildir-configuration
             ;;                         (pathname "/home/%{rcpt.user}/Maildir")
             ;;                         (junk #t)))
             ;;                (virtual "vusers"))))
             ;;             (opensmtpd-action
             ;;              (name "send")
             ;;              (method (opensmtpd-relay-configuration)))))
             ;;           (matches (list
             ;;                     (opensmtpd-match
             ;;                      (name "send")
             ;;                      (for "for any")
             ;;                      (from "from any")
             ;;                      (auth #t))
             ;;                     (opensmtpd-match
             ;;                      (name "receive")
             ;;                      (from "from any")
             ;;                      (for "for domain <vdoms>"))
             ;;                     (opensmtpd-match
             ;;                      (name "receive")
             ;;                      (for "for local"))))))
             
             (service unattended-upgrade-service-type)
             
             ;; (service wireguard-service-type
             ;;          (wireguard-configuration
             ;;           (private-key "/home/joshua/linode-guix-system-configuration/wireguard-keys/server.private.key")
             ;;           (peers
             ;;            (list
             ;;             (wireguard-peer
             ;;              (name "my servers peer for my laptop")
             ;;              (public-key "/home/joshua/linode-guix-system-configuration/wireguard-keys/laptop.pub"))))))
             %base-services)))