linode-guix-system-configuration/linode-locke-lamora-current-config.scm

;; this is the current configuration for my linode "Guix System"

(add-to-load-path (dirname (current-filename)))

(use-modules (gnu)
             (guix modules)
             (secret nginx)
             (secret public-keys)
             ;;(gnucode-form)
             (endlessh-service)
             (mail)
             )
(use-service-modules admin ; unattended-upgrades
                     certbot
                     mail
                     mcron
                     messaging
                     networking
                     ssh
                     web)
(use-package-modules admin
                     certs
                     package-management
                     ssh
                     tls)

(define %nginx-deploy-hook
  (program-file
   "nginx-deploy-hook"
   #~(let ((pid (call-with-input-file "/var/run/nginx/pid" read)))
       (kill pid SIGHUP))))

(define %user "joshua")

(operating-system
  (host-name "locke-lamora")
  (timezone "America/Chicago")
  (locale "en_US.UTF-8")
  ;; This goofy code will generate the grub.cfg
  ;; without installing the grub bootloader on disk.
  (bootloader (bootloader-configuration
               (bootloader
                (bootloader
                 (inherit grub-bootloader)
                 (installer #~(const #t))))))
  (file-systems (cons (file-system
                        (device "/dev/sda")
                        (mount-point "/")
                        (type "ext4"))
                      %base-file-systems))

  (swap-devices (list "/dev/sdb"))

  (initrd-modules (cons "virtio_scsi"    ; Needed to find the disk
                        %base-initrd-modules))

  (users (cons* (user-account
                 (name "joshua")
                 (group "users")
                 ;; Adding the account to the "wheel" group
                 ;; makes it a sudoer.
                 (supplementary-groups '("wheel"))
                 (home-directory "/home/joshua"))
                (user-account
                 (name "andrew")
                 (group "users")
                 (supplementary-groups '("wheel"))
                 (home-directory "/home/andrew"))
                %base-user-accounts))

  (sudoers-file
   (plain-file "sudoers"
               (string-append (plain-file-content %sudoers-specification)
                              (format #f "~a ALL = NOPASSWD: ALL~%"
                                      "joshua"))))

  (packages (cons* nss-certs            ;for HTTPS access
                   openssh-sans-x
                   %base-packages))
  
  (services (cons*
             (service dhcp-client-service-type)

             (service certbot-service-type
                      (certbot-configuration
                       (email "jbranso@dismail.de")
                       (webroot "/srv/www")
                       (certificates
                        (list
                         (certificate-configuration
                          (name "gnucode.me")
                          (domains '("gnucode.me" "www.gnucode.me" "mail.gnucode.me" "imap.gnucode.me" "smtp.gnucode.me"))
                          (deploy-hook %nginx-deploy-hook))
                         (certificate-configuration
                          (name "gnu-hurd.com")
                          (domains '("gnu-hurd.com" "www.gnu-hurd.com"))
                          (deploy-hook %nginx-deploy-hook))
                         (certificate-configuration
                          (name "propernaming.org")
                          (domains '("propernaming.org" "www.propernaming.org"))
                          (deploy-hook %nginx-deploy-hook))
                         ))))

             (dovecot-service #:config
                              (dovecot-configuration
                               (protocols
                                (list
                                 (protocol-configuration
                                  (name "imap")
                                  (mail-max-userip-connections 3))))
                               (services
                                (list
                                 (service-configuration
                                  (kind "imap"))
                                 (service-configuration
                                  (kind "imap-login"))
                                 (service-configuration
                                  (kind "auth"))
                                 (service-configuration
                                  (kind "auth-worker"))
                                 (service-configuration
                                  (kind "dict"))))
                               (ssl-cert  "/etc/letsencrypt/live/gnucode.me/fullchain.pem")
                               (ssl-key "/etc/letsencrypt/live/gnucode.me/privkey.pem")
                               ))

             (service endlessh-service-type)

             ;;(service gnucode -form-service-type)

             (service mcron-service-type
                      (mcron-configuration
                       (jobs (list
                              ;; run endlessh every 5 minutes
                              #~(job "*/1 0 * * *"
                                     (string-append #$endlessh "/bin/endlessh -p 22")
                                     #:user "root")))))

             (service nginx-service-type
                      (nginx-configuration
                       (server-blocks
                        (list
                         (nginx-server-configuration
                          (server-name '("gnucode.me"))
                          (listen '("80" "443 ssl"))
                          (root "/srv/www/html/gnucode.me/site/")
                          ;; tell browsers my site supports HTTPS, and tell them that it will
                          ;; at least work for 1/2 hour.  Gradually,  I will increase this number.
                          (raw-content (list "add_header Strict-Transport-Security max-age=1800;"))
                          (ssl-certificate "/etc/letsencrypt/live/gnucode.me/fullchain.pem")
                          (ssl-certificate-key "/etc/letsencrypt/live/gnucode.me/privkey.pem")
                          (locations
                           (list
                            (nginx-location-configuration          ;certbot
                             (uri "/.well-known")
                             (body (list "root /srv/www;")))
                            (nginx-location-configuration
                             (uri "/form/")
                             (body '("proxy_pass http://127.0.0.1:8081;")))
                            %gnucode-location 
                            )))
                         (nginx-server-configuration
                          (server-name '("gnu-hurd.com"))
                          (listen '("80" "443 ssl"))
                          (root "/srv/www/html/gnu-hurd.com/")
                          (ssl-certificate "/etc/letsencrypt/live/gnu-hurd.com/fullchain.pem")
                          (ssl-certificate-key "/etc/letsencrypt/live/gnu-hurd.com/privkey.pem")
                          ;; tell browsers my site supports HTTPS, and tell them that it will
                          ;; at least work for 1/2 hour.  Gradually,  I will increase this number.
                          (raw-content (list "add_header Strict-Transport-Security max-age=1800;"))
                          (locations
                           (list
                            (nginx-location-configuration          ;certbot
                             (uri "/.well-known")
                             (body (list "root /srv/www;"))))))
                         (nginx-server-configuration
                          (server-name '("propernaming.org"))
                          (listen '("80" "443 ssl"))
                          (root "/srv/www/html/propernaming.org/site/")
                          (ssl-certificate "/etc/letsencrypt/live/propernaming.org/fullchain.pem")
                          (ssl-certificate-key "/etc/letsencrypt/live/propernaming.org/privkey.pem")
                          ;; tell browsers my site supports HTTPS, and tell them that it will
                          ;; at least work for 1/2 hour.  Gradually,  I will increase this number.
                          (raw-content (list "add_header Strict-Transport-Security max-age=1800;"))
                          (locations
                           (list
                            (nginx-location-configuration          ;certbot
                             (uri "/.well-known")
                             (body (list "root /srv/www;"))))))
                         ))))
             (service openssh-service-type
                      (openssh-configuration
                       (openssh openssh-sans-x)
                       (password-authentication? #f)
                       (port-number 63355)
                       (authorized-keys
                        `(
                          ;;("joshua" ,(local-file "/home/joshua/linode-guix-system-configuration/id_rsa.pub"))
                          ("joshua" ,(plain-file "id_rsa.pub" %joshua-ssh-key))
                          ;;("root" ,(local-file "/home/joshua/linode-guix-system-configuration/id_rsa.pub"))
                          ("root" ,(plain-file "id_rsa.pub" %joshua-ssh-key))
                          ("andrew" ,(plain-file "andrew_rsa.pub" %andrew-ssh-key))
                          ))))

             ;; I've created the prosody admin user, and I imported the cert...
             ;; but pidgin tells me that I the XMPP server at gnucode.me does not support encryption.
             (service prosody-service-type
                      (prosody-configuration
                       (admins '("jbranso@dismail.de"))
                       (virtualhosts
                        (list
                         (virtualhost-configuration
                          (domain "gnucode.me"))))))

             (service mail-aliases-service-type
                      '(("webmaster" "root")
                        ("postmaster" "root")
                        ("abuse" "root")))

             ;; I can test send an email from my ssh machine via:
             ;; cat test-email.txt  | msmtp -- jbranso@dismail.de
             (service opensmtpd-service-type
                      (opensmtpd-configuration
                       (config-file %smtpd.conf)))
             (service unattended-upgrade-service-type)
             %base-services)))