path: root/tw/system/lud.scm

(define-module (tw system lud)
  #:use-module (gnu)
  #:use-module (gnu bootloader grub)
  #:use-module (gnu system locale)
  #:use-module (gnu system nss)
  #:use-module (guix gexp)
  #:use-module (tw packages php)
  #:use-module (tw services dns)
  #:use-module (tw services nextcloud)
  #:use-module (tw services matrix)
  #:use-module (tw services media)
  #:use-module (tw services restic)
  #:use-module (tw services secrets)
  #:use-module (tw services web)
  #:use-module (tw system))

(use-package-modules acl admin bash certs databases linux man php python rsync
                     shells tls tor video)
(use-service-modules certbot cgit databases file-sharing mcron monitoring
                     networking pm ssh syncthing version-control vpn web)

(define efi-system-partition          ; /dev/sda1
  (uuid "51F3-FB71" 'fat32))
(define guixsd-root-partition         ; /dev/sda2
  (uuid "c63af3e6-3c2b-43d2-b1e6-944f09a10e0f" 'btrfs))
(define backups-partition             ; /dev/sdb1
  (uuid "c6ac4033-cce6-4365-abcc-483b79c4ca36" 'btrfs))
(define data-partition                ; /dev/sdc1
  (uuid "4715ae0e-5cef-48f2-a59e-025321153888" 'btrfs))

(define-public %lud-system
  (operating-system
    (host-name "lud.twilken.net")
    (timezone "Europe/Berlin")
    (locale "en_GB.utf8")
    (locale-definitions
     (list (locale-definition (name "en_GB.utf8") (source "en_GB"))
           (locale-definition (name "de_DE.utf8") (source "de_DE"))
           (locale-definition (name "fr_FR.utf8") (source "fr_FR"))
           (locale-definition (name "pt_BR.utf8") (source "pt_BR"))
           (locale-definition (name "en_US.utf8") (source "en_US"))))

    ;; Allow resolution of '.local' host names with mDNS.
    (name-service-switch %mdns-host-lookup-nss)

    ;; Choose UK English console keyboard layout.
    (keyboard-layout %british-keyboard)

    ;; Packages installed system-wide.  Users can also install packages
    ;; under their own account: use 'guix search KEYWORD' to search
    ;; for packages and 'guix install PACKAGE' to install a package.
    (packages
     (cons*
      ffmpeg tor   ; for video downloader
      ;; For Nextcloud. PHP modules must be installed in system
      ;; profile, as that's referred to in Nextcloud's php.ini.
      php php-apcu php-imagick openssl   ; curl is in `%base-system-packages'
      %base-system-packages))

    ;; Below is the list of system services.  To search for available
    ;; services, run 'guix system search KEYWORD' in a terminal.
    (services
     (append
      (list (simple-service 'extra-access openssh-service-type
              `(("ira"   ; for Duplicity backups
                 ,(local-file "files/kitchen-pc.pub")
                 ,(local-file "files/wilken-laptop.pub"))
                ("git"
                 ,(local-file "files/timo.pub")
                 ,(local-file "files/timo-phone-gpg.pub")
                 ,(local-file "files/timo-phone-password-store.pub"))))

            (service tor-service-type)

            (service thermald-service-type
              (thermald-configuration
               (adaptive? #t)))

            (service mythic-dynamic-dns-service-type
              (mythic-dynamic-dns-configuration
               (host-name host-name)
               (ipv6? #f)))   ; currently broken

            ;; Allow anonymous git access via Wireguard, e.g. to this channel's git repo.
            ;; Repos are only published if they contain a `git-daemon-export-ok' file.
            (service git-daemon-service-type
              (git-daemon-configuration
               (listen (list (server-wireguard-address host-name #:ipv6? #t)
                             (server-wireguard-address host-name)))
               ;; git://lud.wg/~user/repo.git => /home/user/src/repo.git
               (user-path "src")))

            ;; Serve public-access git repos over HTTPS and private ones over SSH only.
            (service cgit-service-type
              (cgit-configuration
               (branch-sort "age")
               (root-title "Timo Wilken's Git repositories")
               (root-desc "Projects written by me, contributed to by me, or \
that I just want to host somewhere.")
               ;; (root-readme "")  ; TODO
               (repository-directory "/srv/git")
               (strict-export "git-daemon-export-ok")  ; require presence of this file to show repo
               (remove-suffix? #t)  ; remove trailing .git in name and URL
               (clone-prefix '("https://git.twilken.net"
                               "ssh://git@git.twilken.net:22022/~"))
               (enable-http-clone? #t)   ; avoid having to run git-daemon as well
               (noplainemail? #t)   ; hide email addresses in web interface
               (nginx
                (list (nginx-server-configuration
                       (inherit %cgit-configuration-nginx)
                       (server-name '("git.twilken.net"))
                       (listen '("443 ssl http2"))
                       (ssl-certificate "/etc/letsencrypt/live/git.twilken.net/fullchain.pem")
                       (ssl-certificate-key "/etc/letsencrypt/live/git.twilken.net/privkey.pem"))))))

            (simple-service 'cgit-repo-access activation-service-type
              #~(system* #$(file-append acl "/bin/setfacl") "-m" "u:fcgiwrap:rx" "/srv/git"))

            (simple-service 'cgit-certificate certbot-service-type
              (list (certificate-configuration
                     (domains '("git.twilken.net"))
                     (deploy-hook %nginx-cert-deploy-hook))))

            (simple-service 'git-backups restic-backup-service-type
              (list (restic-scheduled-backup
                     (schedule #~"0 3 * * *")
                     (paths '("/srv/git"))
                     (repo (restic-local-repository
                            (path "/var/backups/git")))
                     (password (restic-password-source
                                (type 'file)
                                (name "/etc/restic/lud-git"))))))

            (simple-service 'git-backups-cleanup restic-cleanup-service-type
              (list (restic-scheduled-cleanup
                     (schedule #~"0 4 * * *")
                     (repo (restic-local-repository
                            (path "/var/backups/git")))
                     (password (restic-password-source
                                (type 'file)
                                (name "/etc/restic/lud-git")))
                     (keep-daily 30)
                     (keep-monthly -1))))

            (simple-service 'git-secrets secrets-service-type
              (list (secret
                     (encrypted-file (local-file "files/restic/lud-git.enc"))
                     (destination "/etc/restic/lud-git"))))

            ;; Transmission (torrents)
            (service transmission-daemon-service-type
              (transmission-daemon-configuration
               (download-dir "/var/data/bt")
               (incomplete-dir "/var/data/bt/incomplete")
               (incomplete-dir-enabled? #t)
               (speed-limit-up-enabled? #t)
               (speed-limit-up 512)  ; KiB/s
               (encryption 'require-encrypted-connections)
               ;; Don't try to configure port forwarding automatically.
               (port-forwarding-enabled? #f)
               ;; Make RPC interface only accessible via WireGuard.
               (rpc-bind-address (server-wireguard-address host-name))
               (rpc-whitelist-enabled? #t)
               (rpc-whitelist '("127.0.0.1" "::1"
                                "10.0.0.*" "fc00::*"))
               (rpc-host-whitelist-enabled? #t)
               (rpc-host-whitelist '("lud.wg"))))

            ;; TODO: Streama

            ;; Syncthing
            (service syncthing-service-type
              (syncthing-configuration
               (user "syncthing")
               (group "syncthing")))

            (service yt-dlp-service-type
              (yt-dlp-configuration
               (yt-dlp #f)   ; use yt-dlp from media-directory
               (media-directory "/var/data/syncthing/Videos")
               (user "syncthing")))

            (service get-iplayer-service-type
              (get-iplayer-configuration
               (config-directory "/var/data/syncthing/Audiobooks/.get_iplayer")
               (user "syncthing")))

            ;; certbot for Synapse + Apache/Nextcloud
            ;; This also installs a nginx server on port 80, redirecting to port 443.
            (service certbot-service-type
              (certbot-configuration
               (email "letsencrypt@twilken.net")))

            ;; For Nextcloud (and Streama)
            (service mysql-service-type
              (mysql-configuration
               (extra-content "\
[mysqld]
character-set-server = utf8mb4
collation-server = utf8mb4_general_ci
# https://wiki.archlinux.org/title/Nextcloud
skip_networking
transaction_isolation = READ-COMMITTED
# https://docs.nextcloud.com/server/stable/admin_manual/installation/server_tuning.html#using-mariadb-mysql-instead-of-sqlite
innodb_buffer_pool_size = 1G
innodb_io_capacity = 4000
")))

            ;; TODO: JSON exporter (Nextcloud)
            ;; TODO: Syncthing exporter
            ;; TODO: Transmission exporter

            (service secrets-service-type
              (secrets-configuration
               (secrets
                (list
                 (secret
                  (encrypted-file (local-file "files/mythic-dns.scm.enc"))
                  (destination "/etc/mythic-dns.scm"))
                 (secret
                  (encrypted-file (local-file "files/nextcloud-database-password.enc"))
                  (destination "/etc/nextcloud-database-password.enc"))
                 (secret
                  (encrypted-file (local-file "files/restic/lud-nextcloud.enc"))
                  (destination "/etc/restic/lud-nextcloud"))))))

            ;; Only this server has SSDs, not vin.
            (simple-service 'fstrim mcron-service-type
              (list #~(job "0 4 * * *"  ; after guix gc
                           (string-append #$(file-append util-linux "/sbin/fstrim")
                                          " --fstab --verbose")))))

      %nextcloud-services
      %matrix-services
      (server-base-services host-name)))

    ;; The list of user accounts ('root' is implicit).
    (users
     (cons* (user-account
             (name "ira")
             (comment "Ira Wilken")
             (group "users")
             (home-directory "/home/ira"))
            (user-account
             (system? #t)
             (name "syncthing")
             (comment "Syncthing service")
             (group "syncthing")
             (home-directory "/var/data/syncthing"))
            (user-account
             (system? #t)
             (name "git")
             (comment "Git hosting service")
             (group "git")
             (home-directory "/srv/git"))
            %server-base-user-accounts))

    ;; Groups are NOT implict from the user-accounts that mention them.
    (groups
     (cons* (user-group (system? #t) (name "syncthing"))
            (user-group (system? #t) (name "git"))
            %base-groups))

    ;; Use the UEFI variant of GRUB with the EFI System Partition mounted
    ;; on /boot/efi.
    (bootloader
     (bootloader-configuration
      (bootloader grub-efi-bootloader)
      (targets '("/boot/efi"))
      (keyboard-layout keyboard-layout)))

    ;; The list of file systems that get "mounted".  The unique
    ;; file system identifiers there ("UUIDs") can be obtained
    ;; by running 'blkid' in a terminal.
    (file-systems
     (cons* (file-system
              (mount-point "/")
              (device guixsd-root-partition)
              (flags '(no-atime))
              (options (alist->file-system-options
                        '("ssd" ("compress" . "zstd"))))
              (type "btrfs"))
            (file-system
              (mount-point "/boot/efi")
              (device efi-system-partition)
              (flags '(no-atime))
              (type "vfat"))
            (file-system
              (mount-point "/var/backups")
              (create-mount-point? #t)
              (device backups-partition)
              (flags '(no-atime))
              (type "btrfs"))
            (file-system
              (mount-point "/var/data")
              (create-mount-point? #t)
              (device data-partition)
              (flags '(no-atime))
              (type "btrfs"))
            %base-file-systems))))

%lud-system