Track system configuration

1 files changed, 391 insertions, 0 deletions

diff --git a/tw/system/lap.scm b/tw/system/lap.scm
new file mode 100644
index 00000000..9dd81d80
--- /dev/null
+++ b/tw/system/lap.scm
@@ -0,0 +1,391 @@
+;; This is an operating system configuration file for a fairly minimal
+;; "desktop" setup with i3 where the /home partition partition is
+;; encrypted with LUKS.
+;;
+;; https://guix.gnu.org/manual/en/html_node/operating_002dsystem-Reference.html
+
+(define-module (tw system lap)
+  #:use-module (gnu)
+  #:use-module (gnu bootloader grub)
+  #:use-module (gnu system locale)
+  #:use-module (gnu system nss)
+  #:use-module (guix gexp)
+  #:use-module (guix packages)
+  #:use-module ((guix utils) #:select (substitute-keyword-arguments))
+  #:use-module ((nongnu packages linux)
+                #:prefix nongnu:)   ; don't interfere with (gnu packages linux)
+  #:use-module (nongnu packages scanner)
+  #:use-module (nongnu system linux-initrd)
+  #:use-module (nonguix licenses)
+  #:use-module (tw system common))
+
+(use-package-modules android certs cups disk docker file-systems gnome
+                     kerberos linux mtools pulseaudio search shells wm xorg)
+
+(use-service-modules authentication avahi base cups dbus desktop docker
+                     kerberos linux mcron networking pm syncthing vpn xorg)
+
+(define efi-system-partition          ; /dev/nvme0n1p1
+  (uuid "E04A-DF05" 'fat))
+(define tilearch-root-partition       ; /dev/nvme0n1p2
+  (uuid "197c7f98-c780-4017-9bf7-212175967fd0" 'btrfs))
+(define guixsd-root-partition         ; /dev/nvme0n1p3
+  (uuid "2169a07b-b7b6-4e3d-8e59-bf00d0baffc4" 'btrfs))
+(define swap-partition                ; /dev/nvme0n1p4
+  (uuid "2c78d507-5cd1-48da-ba8d-d1b01d6ff8f9"))
+(define data-partition-outside-luks   ; /dev/sda1
+  (uuid "43108ff6-b25a-4a53-b3f7-6d03ff3e0022"))
+(define data-partition-inside-luks    ; /dev/mapper/data
+  (uuid "826bb1a7-1069-46a5-897a-afa19272fbb0" 'btrfs))
+
+(define backlight-udev-rules
+  ;; The naive approach of GROUP="video", MODE="0664" doesn't seem to work.
+  ;; https://github.com/haikarainen/light/blob/master/90-backlight.rules
+  ;; https://github.com/Hummer12007/brightnessctl/blob/master/90-brightnessctl.rules
+  (udev-rule "90-backlight.rules" "\
+ACTION==\"add\", SUBSYSTEM==\"backlight\", RUN+=\"/usr/bin/env chgrp video /sys/class/backlight/%k/brightness\"
+ACTION==\"add\", SUBSYSTEM==\"backlight\", RUN+=\"/usr/bin/env chmod g+w /sys/class/backlight/%k/brightness\"
+ACTION==\"add\", SUBSYSTEM==\"leds\", RUN+=\"/usr/bin/env chgrp video /sys/class/leds/%k/brightness\"
+ACTION==\"add\", SUBSYSTEM==\"leds\", RUN+=\"/usr/bin/env chmod g+w /sys/class/leds/%k/brightness\"
+"))
+
+;; This text is added verbatim to the Xorg config file.
+(define touchpad-xorg-config "\
+# see man 4 libinput
+Section \"InputClass\"
+    Identifier \"touchpad\"
+    Driver \"libinput\"
+    MatchIsTouchpad \"true\"
+
+    Option \"DisableWhileTyping\" \"true\"
+    Option \"MiddleEmulation\" \"true\"
+    Option \"NaturalScrolling\" \"true\"
+    Option \"HorizontalScrolling\" \"true\"
+    Option \"ScrollMethod\" \"twofinger\"
+    Option \"ClickMethod\" \"clickfinger\"
+    Option \"Tapping\" \"true\"
+    Option \"TappingDrag\" \"true\"
+    Option \"TappingDragLock\" \"false\"
+    Option \"TappingButtonMap\" \"lrm\"
+EndSection
+")
+
+(define custom-xorg-config
+  (xorg-configuration
+   (keyboard-layout %british-keyboard)
+   (extra-config (list touchpad-xorg-config))))
+
+(define extra-channels
+  (plain-file "channels.scm" "\
+(use-modules (guix channels))
+(cons* (channel
+         (name 'nonguix)
+         (url \"https://gitlab.com/nonguix/nonguix\")
+         ;; Enable signature verification:
+         (introduction
+           (make-channel-introduction
+            \"897c1a470da759236cc11798f4e0a5f7d4d59fbc\"
+            (openpgp-fingerprint
+             \"2A39 3FFF 68F4 EF7A 3D29  12AF 6F51 20A0 22FB B2D5\"))))
+       %default-channels)
+"))
+
+;; Nonguix substitute server's signing key.
+;; From <https://substitutes.nonguix.org/signing-key.pub>.
+(define nonguix-signing-key
+  (plain-file "nonguix-signing-key.pub" "\
+(public-key
+ (ecc
+  (curve Ed25519)
+  (q #C1FD53E5D4CE971933EC50C9F307AE2171A2D3B52C804642A7A35F84F3A4EA98#)
+  )
+ )
+"))
+
+;; TODO: Nouveau claims (in dmesg) that I have a NVIDIA GM204.  Maybe
+;; only use (select-firmware "^nvidia/gm204/").  linux-firmware only
+;; has a gr/ subdir for that, and acr/ symlinked from gm200.  No pmu/
+;; (power management), sadly.  (See WHENCE file
+;; https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/WHENCE
+;; for symlinks).
+(define nouveau-firmware
+  (package
+   (inherit nongnu:linux-firmware)
+   (name "nouveau-firmware")
+   (arguments
+    `(#:license-file-regexp "LICENSE.nvidia"
+      ,@(substitute-keyword-arguments (package-arguments nongnu:linux-firmware)
+          ((#:phases phases)
+           `(modify-phases ,phases
+              (add-after 'unpack 'select-firmware
+                ,((@@ (nongnu packages linux) select-firmware)
+                  "^nvidia/(g|tu)")))))))  ; `select-firmware' is private
+   (home-page "https://www.nvidia.com/en-us/drivers/unix/")
+   (synopsis "Nonfree firmware for NVIDIA graphics chips")
+   (description "\
+Nonfree firmware for NVIDIA graphics chips.  Required for nouveau to
+support extra features (acr, pmu, gr).")
+   (license
+    (nonfree
+     (string-append
+      "https://git.kernel.org/pub/scm/linux/kernel/git/firmware"
+      "/linux-firmware.git/plain/LICENSE.nvidia")))))
+
+(operating-system
+  (host-name "lap.twilken.net")
+  (timezone "Europe/Paris")
+  (locale "en_GB.utf8")
+  (locale-definitions
+   (list (locale-definition (name "en_GB.utf8") (source "en_GB"))
+         (locale-definition (name "en_US.utf8") (source "en_US"))
+         (locale-definition (name "fr_FR.utf8") (source "fr_FR"))))
+
+  (hosts-file %wireguard-etc-hosts)
+  ;; Allow resolution of '.local' host names with mDNS.
+  (name-service-switch %mdns-host-lookup-nss)
+
+  ;; Choose UK English X11 keyboard layout.
+  (keyboard-layout %british-keyboard)
+
+  ;; Use the UEFI variant of GRUB with the EFI System
+  ;; Partition mounted on /boot/efi.
+  (bootloader
+   (bootloader-configuration
+    (bootloader grub-efi-bootloader)
+    (targets '("/boot/efi"))
+    ;; Note: keyboard-layout is ignored by non-grub bootloaders.
+    (keyboard-layout keyboard-layout)
+    (menu-entries
+     (list
+      (menu-entry
+       (label "systemd-boot")
+       (device efi-system-partition)
+       (chain-loader "/EFI/systemd/systemd-bootx64.efi"))))))
+
+  ;; Use non-free kernel to load non-free firmware (e.g. for wifi).
+  (kernel nongnu:linux-lts)
+  (kernel-arguments
+   (cons* ;;"nosplash"
+          ;;"vt.global_cursor_default=0"
+          ;;"video.use_native_backlight=1"
+          ;;"nvidia-drm.modeset=1"
+          ;;"acpi_osi=\"!Windows 2015\""
+          ;;"acpi_enforce_resources=lax"
+          %default-kernel-arguments))
+  (initrd microcode-initrd)
+  ;; TODO: nouveau complains about missing firmware (see dmesg).
+  (firmware (cons* nongnu:atheros-firmware   ; for atk10k/QCA6174/hw3.0 (wifi card)
+                   nongnu:i915-firmware      ; for Intel GPU runtime power management etc
+                   nouveau-firmware          ; for nouveau to use NVIDIA GPU
+                   %base-firmware))
+
+  ;; Specify a mapped device for the encrypted home partition.
+  ;; The UUID is that returned by 'cryptsetup luksUUID'.
+  (mapped-devices
+   (list (mapped-device
+          (source data-partition-outside-luks)
+          (target "data")
+          (type luks-device-mapping))))
+
+  (swap-devices
+   (list (swap-space
+          (target swap-partition)
+          (discard? #t))))
+
+  (file-systems
+   (cons* (file-system
+            (device guixsd-root-partition)
+            (mount-point "/")
+            (flags '(no-atime))
+            (options (alist->file-system-options
+                      '("ssd" ("compress" . "zstd"))))
+            (type "btrfs"))
+          (file-system
+            (device efi-system-partition)
+            (mount-point "/boot/efi")
+            (flags '(no-atime))
+            (type "vfat"))
+          (file-system
+            (device data-partition-inside-luks)
+            (mount-point "/home")
+            (flags '(no-atime))
+            (options (alist->file-system-options
+                      '("ssd" ("compress" . "zstd")
+                        ("subvol" . "home/guixsd"))))
+            (type "btrfs")
+            (dependencies mapped-devices))
+          %base-file-systems))
+
+  ;; Members of the wheel group are allowed to use sudo.
+  (users (cons* (user-account
+                 (name "timo")
+                 (comment "Timo Wilken")
+                 (group "users")
+                 (supplementary-groups
+                  '("wheel" "audio" "video" "docker" "adbusers"))
+                 (shell (file-append zsh "/bin/zsh")))
+                %base-user-accounts))
+
+  (sudoers-file
+   (plain-file
+    "sudoers"
+    (string-append
+     ;; We need to preserve $TERMINFO so that programs under sudo can
+     ;; find kitty's terminfo files. This is possibly unsafe; sudo
+     ;; explicitly deletes this variable by default.
+     "Defaults env_keep += \"TERMINFO\"\n"
+     (plain-file-content %sudoers-specification)
+     ;; In addition to the default rules, allow admins to power off
+     ;; the computer. They'll have to use the system binaries, not
+     ;; those from their user profile, as /etc/sudoers requires
+     ;; absolute paths to commands.
+     "%wheel ALL=(ALL) NOPASSWD: "
+     "/run/current-system/profile/sbin/halt, "
+     "/run/current-system/profile/sbin/reboot, "
+     "/run/current-system/profile/sbin/shutdown\n")))
+
+  ;; This is where we specify system-wide packages.
+  (packages
+   (cons*
+    ;; System stuff
+    cups docker mit-krb5
+    ;; File systems
+    dosfstools mtools ntfs-3g
+    ;; Printing and scanning
+    ;; SANE doesn't detect my scanner without brscan4's etc/sane.d/dll.conf.
+    brscan4
+    ;; Desktop and drivers
+    ;; FIXME: lightdm depends on python-2, but the build throws an
+    ;; error that python2 is not supported.
+    ;; TODO: Does lightdm have a service I need to enable?
+    ;;lightdm lightdm-gtk-greeter
+    pulseaudio xf86-video-intel xf86-video-nouveau
+    ;; Adds /sys/class/backlight entries for external monitors.
+    ;; Not needed for laptop display.
+    ddcci-driver-linux
+    i3-gaps  ; install i3 here so gdm can see its xsession file
+    i3lock   ; we need a system service to make i3lock setuid root
+    ;; We need to install gnome-keyring here so its PAM module is
+    ;; enabled properly (by its service; see below).
+    ;; nheko needs gnome-keyring to store secrets (kwallet doesn't do dbus).
+    gnome-keyring
+    ;; It's probably easiest to install geoclue system-wide, so it
+    ;; gets added to `%desktop-services' and redshift can access the
+    ;; location.
+    geoclue
+    ;; Base packages
+    (append %common-system-packages %base-packages)))
+
+  ;; Use the "desktop" services, which include the X11
+  ;; log-in service, networking with NetworkManager, and more.
+  ;; See info '(guix)Services' for useful services.
+  (services
+   (cons*
+    (service syncthing-service-type
+             (syncthing-configuration
+              (user "timo")))
+
+    (service cups-service-type
+             (cups-configuration
+              (web-interface? #t)
+              (default-shared? #f)
+              ;; See info '(guix)Printing Services' for more extensions.
+              (extensions
+               (list cups-filters foomatic-filters brlaser))))
+
+    (bluetooth-service)
+
+    (wireguard-service 'lap)
+
+    (service docker-service-type
+             (docker-configuration))
+
+    (service krb5-service-type
+             (krb5-configuration
+              (default-realm "CERN.CH")
+              (rdns? #f)
+              (realms (list (krb5-realm
+                             (name "CERN.CH")
+                             (default-domain "cern.ch")
+                             (kdc "cerndc.cern.ch"))))))
+
+    (service tlp-service-type
+             (tlp-configuration))   ; TODO: configure properly
+
+    (service thermald-service-type
+             (thermald-configuration
+              (adaptive? #t)))
+
+    (service earlyoom-service-type
+             (earlyoom-configuration))  ; TODO: configure at least `avoid-regexp'
+
+    ;; Disabled as it doesn't work with my hardware.
+    ;; It always says "logging in with fingerprint failed" and blocks password login in gdm.
+    ;; (service fprintd-service-type)
+
+    ;; Install i3lock as a setuid binary, so it can talk to PAM.
+    (screen-locker-service i3lock "i3lock")
+
+    ;; gnome-keyring is not in `%desktop-services' by default,
+    ;; but needs to be there to add itself to /etc/pam.d/.
+    ;; If using a DM other than GDM, add it to `pam-services' in
+    ;; `gnome-keyring-configuration' (see its docs).
+    (service gnome-keyring-service-type
+             (gnome-keyring-configuration))
+
+    ;; Allow anyone in the "video" group to set the display's brightness.
+    ;; Run `udevadm info -q all /sys/class/backlight/intel_backlight'
+    ;; to see properties.
+    (udev-rules-service 'backlight backlight-udev-rules #:groups '("video"))
+    ;; According to "info '(guix) Base Services'", the above should
+    ;; have a `#:groups '("video")', but that group is already
+    ;; declared as a supplementary group for my user and guix warns
+    ;; that it's declared twice.
+
+    (udev-rules-service 'android android-udev-rules #:groups '("adbusers"))
+
+    (set-xorg-configuration custom-xorg-config)
+
+    (simple-service
+     'cronjobs mcron-service-type
+     ;; I don't think jobs run on boot if they would have run when the
+     ;; computer was turned off, so choose a time when the computer is
+     ;; probably turned on.
+     (list #~(job "0 21 * * *" "guix gc -d 2w -F 25G")
+           #~(job "0 22 * * *"  ; after guix gc
+                  (string-append #$(file-append util-linux "/sbin/fstrim")
+                                 " --fstab --verbose"))))
+
+    ;; The nonguix channel is added to channels.scm as an `extra-special-file'.
+    ;; The gaming channel (https://gitlab.com/guix-gaming-channels) is per-user only.
+    (simple-service
+     'nonguix guix-service-type
+     (guix-extension
+      (authorized-keys (list nonguix-signing-key))
+      (substitute-urls '("https://substitutes.nonguix.org"))))
+
+    (extra-special-file "/etc/guix/channels.scm" extra-channels)
+
+    (modify-services %desktop-services
+      (gdm-service-type
+       config =>
+       (gdm-configuration
+        (inherit config)
+        (auto-login? #f)
+        (default-user "timo")
+        (xorg-configuration custom-xorg-config)))
+
+      (geoclue-service-type
+       config =>
+       (geoclue-configuration
+        (inherit config)
+        (applications
+         (cons* (geoclue-application "redshift" #:system? #f)
+                %standard-geoclue-applications))))
+
+      (login-service-type
+       config =>
+       (login-configuration
+        (inherit config)
+        (motd (plain-file "no-motd" ""))
+        (allow-empty-passwords? #f)))))))