(define-module (tw system lud)
  #:use-module (gnu)
  #:use-module (gnu bootloader grub)
  #:use-module (gnu system locale)
  #:use-module (gnu system nss)
  #:use-module (guix gexp)
  #:use-module (tw packages php)
  #:use-module (tw services dns)
  #:use-module (tw services nextcloud)
  #:use-module (tw services matrix)
  #:use-module (tw services media)
  #:use-module (tw services secrets)
  #:use-module (tw system))

(use-package-modules admin bash certs databases linux man php python rsync
                     shells tls tor video)
(use-service-modules certbot databases file-sharing mcron monitoring
                     networking pm ssh syncthing version-control vpn web)

(define efi-system-partition          ; /dev/sda1
  (uuid "51F3-FB71" 'fat32))
(define guixsd-root-partition         ; /dev/sda2
  (uuid "c63af3e6-3c2b-43d2-b1e6-944f09a10e0f" 'btrfs))
(define backups-partition             ; /dev/sdb1
  (uuid "c6ac4033-cce6-4365-abcc-483b79c4ca36" 'btrfs))
(define data-partition                ; /dev/sdc1
  (uuid "4715ae0e-5cef-48f2-a59e-025321153888" 'btrfs))

(define httpd-intermediate-ssl-config "\
# SSL configuration.
# https://ssl-config.mozilla.org/#server=apache&version=2.4.53&config=intermediate&openssl=1.1.1n&ocsp=false&guideline=5.6
SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder     Off
SSLSessionTickets       Off
SSLUseStapling          On
SSLStaplingCache        \"shmcb:logs/ssl_stapling(32768)\"
SSLSessionCache         \"shmcb:logs/ssl_scache(65535)\"
# 20 minutes -- default is 5 minutes, which is not long, and the cache
# size is limited anyway above.
SSLSessionCacheTimeout  1200
")

(define-public %lud-system
  (operating-system
    (host-name "lud.twilken.net")
    (timezone "Europe/Berlin")
    (locale "en_GB.utf8")
    (locale-definitions
     (list (locale-definition (name "en_GB.utf8") (source "en_GB"))
           (locale-definition (name "de_DE.utf8") (source "de_DE"))
           (locale-definition (name "fr_FR.utf8") (source "fr_FR"))
           (locale-definition (name "pt_BR.utf8") (source "pt_BR"))
           (locale-definition (name "en_US.utf8") (source "en_US"))))

    ;; Allow resolution of '.local' host names with mDNS.
    (name-service-switch %mdns-host-lookup-nss)

    ;; Choose UK English console keyboard layout.
    (keyboard-layout %british-keyboard)

    ;; Packages installed system-wide.  Users can also install packages
    ;; under their own account: use 'guix search KEYWORD' to search
    ;; for packages and 'guix install PACKAGE' to install a package.
    (packages
     (cons*
      ffmpeg tor   ; for video downloader
      ;; For Nextcloud. PHP modules must be installed in system
      ;; profile, as that's referred to in Nextcloud's php.ini.
      php php-apcu php-imagick openssl   ; curl is in `%base-system-packages'
      %base-system-packages))

    ;; Below is the list of system services.  To search for available
    ;; services, run 'guix system search KEYWORD' in a terminal.
    (services
     (append
      (list (simple-service 'extra-access openssh-service-type
              `(("ira"   ; for Duplicity backups
                 ,(local-file "files/kitchen-pc.pub")
                 ,(local-file "files/wilken-laptop.pub"))
                ("timo"
                 ,(local-file "files/timo-phone-password-store.pub"))))

            (service tor-service-type)

            (service thermald-service-type
              (thermald-configuration
               (adaptive? #t)))

            (service mythic-dynamic-dns-service-type
              (mythic-dynamic-dns-configuration
               (host-name host-name)
               (ipv6? #f)))   ; currently broken

            ;; Allow anonymous git access via Wireguard, e.g. to this channel's git repo.
            ;; Repos are only published if they contain a `git-daemon-export-ok' file.
            (service git-daemon-service-type
              (git-daemon-configuration
               (listen (list (server-wireguard-address host-name #:ipv6? #t)
                             (server-wireguard-address host-name)))
               ;; git://lud.wg/~user/repo.git => /home/user/src/repo.git
               (user-path "src")))

            ;; Transmission (torrents)
            (service transmission-daemon-service-type
              (transmission-daemon-configuration
               (download-dir "/var/data/bt")
               (incomplete-dir "/var/data/bt/incomplete")
               (incomplete-dir-enabled? #t)
               (speed-limit-up-enabled? #t)
               (speed-limit-up 512)  ; KiB/s
               (encryption 'require-encrypted-connections)
               ;; Don't try to configure port forwarding automatically.
               (port-forwarding-enabled? #f)
               ;; Make RPC interface only accessible via WireGuard.
               (rpc-bind-address (server-wireguard-address host-name))
               (rpc-whitelist-enabled? #t)
               (rpc-whitelist '("127.0.0.1" "::1"
                                "10.0.0.*" "fc00::*"))
               (rpc-host-whitelist-enabled? #t)
               (rpc-host-whitelist '("lud.wg"))))

            ;; TODO: Streama

            ;; Syncthing
            (service syncthing-service-type
              (syncthing-configuration
               (user "syncthing")
               (group "syncthing")))

            (service yt-dlp-service-type
              (yt-dlp-configuration
               (yt-dlp #f)   ; use yt-dlp from media-directory
               (media-directory "/var/data/syncthing/Videos")
               (user "syncthing")))

            (service get-iplayer-service-type
              (get-iplayer-configuration
               (config-directory "/var/data/syncthing/Audiobooks/.get_iplayer")
               (user "syncthing")))

            ;; certbot for Synapse + Apache/Nextcloud
            ;; This also installs a nginx server on port 80, redirecting to port 443.
            (service certbot-service-type
              (certbot-configuration
               (email "letsencrypt@twilken.net")))

            (service httpd-service-type
              (httpd-configuration
               (config
                (httpd-config-file
                 (listen '("443"))  ; leave port 80 free for certbot/nginx
                 (modules
                  (cons* (httpd-module (name "ssl_module") (file "modules/mod_ssl.so"))
                         (httpd-module (name "proxy_module") (file "modules/mod_proxy.so"))
                         (httpd-module (name "rewrite_module") (file "modules/mod_rewrite.so"))
                         (httpd-module (name "alias_module") (file "modules/mod_alias.so"))
                         (httpd-module (name "socache_shmcb_module")  ; for SSLStaplingCache
                                       (file "modules/mod_socache_shmcb.so"))
                         (httpd-module (name "proxy_fcgi_module")   ; for PHP/FastCGI
                                       (file "modules/mod_proxy_fcgi.so"))
                         %default-httpd-modules))
                 ;; Preserve default value for `extra-config'.
                 (extra-config
                  (list "TypesConfig etc/httpd/mime.types\n"
                        "ServerAdmin webmaster@twilken.net\n"
                        httpd-intermediate-ssl-config))))))

            ;; For Nextcloud (and Streama)
            (service mysql-service-type
              (mysql-configuration
               (extra-content "\
[mysqld]
character-set-server = utf8mb4
collation-server = utf8mb4_general_ci
# https://wiki.archlinux.org/title/Nextcloud
skip_networking
transaction_isolation = READ-COMMITTED
# https://docs.nextcloud.com/server/stable/admin_manual/installation/server_tuning.html#using-mariadb-mysql-instead-of-sqlite
innodb_buffer_pool_size = 1G
innodb_io_capacity = 4000
")))

            ;; TODO: JSON exporter (Nextcloud)
            ;; TODO: Syncthing exporter
            ;; TODO: Transmission exporter

            (service secrets-service-type
              (secrets-configuration
               (secrets
                (list
                 (secret
                  (encrypted-file (local-file "files/mythic-dns.scm.enc"))
                  (destination "/etc/mythic-dns.scm"))
                 (secret
                  (encrypted-file (local-file "files/nextcloud-database-password.enc"))
                  (destination "/etc/nextcloud-database-password.enc"))
                 (secret
                  (encrypted-file (local-file "files/restic/lud-nextcloud.enc"))
                  (destination "/etc/restic/lud-nextcloud"))
                 (secret
                  (encrypted-file (local-file "files/wireguard/lud.key.enc"))
                  (destination "/etc/wireguard/private.key"))
                 (secret
                  (encrypted-file (local-file "files/wireguard/lud-fp4.psk.enc"))
                  (destination "/etc/wireguard/fp4.psk"))
                 (secret
                  (encrypted-file (local-file "files/wireguard/lud-lap.psk.enc"))
                  (destination "/etc/wireguard/lap.psk"))
                 (secret
                  (encrypted-file (local-file "files/wireguard/lud-pi3.psk.enc"))
                  (destination "/etc/wireguard/pi3.psk"))
                 (secret
                  (encrypted-file (local-file "files/wireguard/lud-vin.psk.enc"))
                  (destination "/etc/wireguard/vin.psk"))))))

            ;; Only this server has SSDs, not vin.
            (simple-service 'fstrim mcron-service-type
              (list #~(job "0 4 * * *"  ; after guix gc
                           (string-append #$(file-append util-linux "/sbin/fstrim")
                                          " --fstab --verbose")))))

      %nextcloud-services
      %matrix-services
      (server-base-services host-name)))

    ;; The list of user accounts ('root' is implicit).
    (users
     (cons* (user-account
             (name "ira")
             (comment "Ira Wilken")
             (group "users")
             (home-directory "/home/ira"))
            (user-account
             (system? #t)
             (name "syncthing")
             (comment "Syncthing service")
             (group "syncthing")
             (home-directory "/var/data/syncthing"))
            %server-base-user-accounts))

    (groups
     (cons* (user-group  ; This is NOT implict from the "syncthing" user.
             (system? #t)
             (name "syncthing"))
            %base-groups))

    ;; Use the UEFI variant of GRUB with the EFI System Partition mounted
    ;; on /boot/efi.
    (bootloader
     (bootloader-configuration
      (bootloader grub-efi-bootloader)
      (targets '("/boot/efi"))
      (keyboard-layout keyboard-layout)))

    ;; The list of file systems that get "mounted".  The unique
    ;; file system identifiers there ("UUIDs") can be obtained
    ;; by running 'blkid' in a terminal.
    (file-systems
     (cons* (file-system
              (mount-point "/")
              (device guixsd-root-partition)
              (flags '(no-atime))
              (options (alist->file-system-options
                        '("ssd" ("compress" . "zstd"))))
              (type "btrfs"))
            (file-system
              (mount-point "/boot/efi")
              (device efi-system-partition)
              (flags '(no-atime))
              (type "vfat"))
            (file-system
              (mount-point "/var/backups")
              (create-mount-point? #t)
              (device backups-partition)
              (flags '(no-atime))
              (type "btrfs"))
            (file-system
              (mount-point "/var/data")
              (create-mount-point? #t)
              (device data-partition)
              (flags '(no-atime))
              (type "btrfs"))
            %base-file-systems))))

%lud-system