metznet-channel/metznet/system/base-system.scm

(define-module (metznet system base-system)
  #:use-module (guix gexp)

  #:use-module (gnu bootloader)
  #:use-module (gnu bootloader grub)
  #:use-module (gnu system accounts)
  #:use-module (gnu system shadow)
  #:use-module (gnu system setuid)
  #:use-module (gnu services configuration)
  #:use-module (gnu system file-systems)
  #:use-module (gnu system)
  #:use-module (gnu system nss)
  #:use-module (gnu services kerberos)
  #:use-module (gnu services sssd)
  #:use-module (gnu services base)
  #:use-module (gnu services)
  #:use-module (gnu services desktop)
  #:use-module (gnu services networking)
  #:use-module (gnu services ssh)
  #:use-module (gnu services vpn)
  #:use-module (gnu system pam)
  #:use-module (gnu services dbus)
  #:use-module (gnu system keyboard)
  #:use-module (gnu packages admin)

  #:use-module (gnu packages slapd)
  #:use-module (gnu packages linux)

  #:use-module (gnu packages shells)
  #:use-module (gnu packages gnome)
  #:use-module (gnu packages ssh)
  #:use-module (gnu packages dns)
  #:use-module (gnu packages version-control)
  #:use-module (gnu packages vim)
  #:use-module (gnu packages certs)
  #:use-module (gnu packages kerberos)
  #:use-module (gnu packages vpn)
  #:use-module (gnu packages wm)
  #:use-module (gnu packages suckless)
  #:use-module (gnu packages terminals)
  #:use-module (gnu packages gnuzilla)

  #:export (%metznet-base-user-accounts)
  #:export (%metznet-base-groups)

  #:export (%metznet-desktop-packages)
  #:export (%metznet-base-packages)

  #:export (%kvm-udev-rule)
  #:export (%usb-udev-rule)
  #:export (%tun-udev-rule)

  #:export (%metznet-desktop-services)
  #:export (%metznet-server-services)

  #:export (metznet-service-type)
  #:export (metznet-system-configuration)

  #:export (%metznet-base-server-system)
  #:export (%metznet-base-desktop-system))

(define %domain-realm
  "METZNET.CA")

(define %domain-name
  "metznet.ca")

(define %domain-kadmin
  (string-append "kerberos." %domain-name))

(define %domain-kdc
  (string-append "kerberos." %domain-name))

(define %metznet-base-user-accounts
  (append (list (user-account
                  (name "root")
                  (group "root")
                  (uid 0)
                  (password (crypt (or (getenv "GUIX_ROOT_PW") "root")
                                   "$6$salt"))
                  (shell (file-append zsh "/bin/zsh")))) %base-user-accounts))

(define %metznet-base-groups
  (append (list (user-group
                  (system? #t)
                  (name "realtime"))
                (user-group
                  (system? #t)
                  (name "usb"))) %base-groups))

(define %metznet-base-packages
  (append (list openssh

                openldap-slapd
                strace

                git
                neovim
                zsh
                le-certs
                nss-certs
                mit-krb5) %base-packages))

(define %metznet-desktop-packages
  (append (list i3-wm i3status dmenu kitty icecat) %metznet-base-packages))

(define %desktop-setuid-programs
  (append (list (setuid-program
                  (program #~(string-append #$openvpn "/sbin/openvpn")))
                (setuid-program
                  (program #~(string-append #$openresolv "/sbin/resolvconf"))))
          %setuid-programs))

(define %metznet-krb5-config
  (krb5-configuration (default-realm %domain-realm)
                      (allow-weak-crypto? #t)
                      (rdns? #f)
                      (realms (list (krb5-realm (name %domain-realm)
                                                (admin-server %domain-kadmin)
                                                (kdc %domain-kdc))))))

(define %default-keyboard-layout
  (keyboard-layout "us"))

(define %kvm-udev-rule
  (udev-rule "65-kvm.rules"
             "KERNEL==\"KVM\", GROUP=\"libvirt\", MODE=\"0660\""))

(define %usb-udev-rule
  (udev-rule "51-usb.rules"
             (string-append "SUBSYSTEM==\"usb\", GROUP=\"usb\"\n"
                            "SUBSYSTEM==\"usbmisc\", GROUP=\"usb\"")))

(define %tun-udev-rule
  (udev-rule "90-tun.rules"
   "KERNEL==\"tun\", GROUP=\"netdev\", MODE=\"0660\", OPTIONS+=\"static_node=net/tun\""))

(define %backlight-udev-rule
  (udev-rule "55-backlight.rules"
   "RUN+=\"/bin/chgrp video /sys/class/backlight/intel_backlight/brightness\""))

(define %metznet-name-service-switch
  (let ((services (list (name-service (name "sss"))
                        (name-service (name "files")))))
    (name-service-switch (password services)
                         (shadow services)
                         (group services))))

(define list-of-strings?
  (list-of string?))

(define-maybe/no-serialization string)

(define (file-like-pair? val)
  (let ((name (car val))
        (file (cdr val)))
    (and (string? name)
         (file-like? file))))

(define alist-of-file-like?
  (list-of file-like-pair?))

(define-maybe file-like)

(define-configuration/no-serialization metznet-system-configuration
                                       (certs (file-like le-certs)
                                              "certificate package")
                                       (user-shells (alist-of-file-like (list (cons
                                                                               "/bin/zsh"
                                                                               zsh)))
                                                    "user shells to link")
                                       (pam-services (list-of-strings (list
                                                                       "su"
                                                                       "gdm-password"
                                                                       "login"
                                                                       "sshd"
                                                                       "passwd"))
                                        "list of pam services to configure"))

(define (pam-mkhomedir-service configuration)
  (lambda (pam)
    (if (member (pam-service-name pam)
                (metznet-system-configuration-pam-services configuration))
        (let ((required (pam-entry (control "required")
                                   (module "pam_mkhomedir.so"))))
          (pam-service (inherit pam)
                       (session (cons required
                                      (pam-service-account pam))))) pam)))

(define (pam-mkhomedir-services configuration)
  (list (pam-mkhomedir-service configuration)))

(define (shell-paths configuration)
  (map car
       (metznet-system-configuration-user-shells configuration)))

(define (shell-packages configuration)
  (map cdr
       (metznet-system-configuration-user-shells configuration)))

(define (metznet-activation configuration)
  #~(begin
      (let ((root (getpw "root")))
        (mkdir-p/perms "/var/lib/openvpn" root 448))
      (for-each (lambda (path package)
                  (unless (access? path F_OK)
                    (symlink (string-append package path) path)))
                (list #$@(shell-paths configuration))
                (list #$@(shell-packages configuration)))))

(define-public metznet-service-type
  (service-type (name 'metznet-service)
                (description "MetzNet Services")
                (extensions (list (service-extension activation-service-type
                                                     metznet-activation)
                                  (service-extension profile-service-type
                                                     (compose list
                                                      metznet-system-configuration-certs))
                                  (service-extension pam-root-service-type
                                                     pam-mkhomedir-services)))
                (default-value (metznet-system-configuration))))

(define %metznet-services
  (list (service openssh-service-type
                 (openssh-configuration (extra-content
                                         "KerberosAuthentication yes")))
        (service krb5-service-type %metznet-krb5-config)
        (service pam-krb5-service-type
                 (pam-krb5-configuration (pam-krb5 pam-krb5)
                                         (minimum-uid 1000)))
        (service sssd-service-type)
        (service metznet-service-type)))

(define %metznet-nscd-configuration
  (nscd-configuration (caches (append (list (nscd-cache (database 'passwd)
                                                        (positive-time-to-live
                                                         (* 3600 12))
                                                        (negative-time-to-live
                                                         20)
                                                        (persistent? #t))
                                            (nscd-cache (database 'group)
                                                        (positive-time-to-live
                                                         (* 3600 12))
                                                        (negative-time-to-live
                                                         20)
                                                        (persistent? #t)))
                                      %nscd-default-caches))))

(define %metznet-desktop-services
  (append %metznet-services
          (modify-services %desktop-services
            (nscd-service-type config => %metznet-nscd-configuration)
            (udev-service-type config =>
                               (udev-configuration (inherit config)
                                                   (rules (append (list
                                                                   %tun-udev-rule
                                                                   %backlight-udev-rule)
                                                                  (udev-configuration-rules
                                                                   config)))))
            (network-manager-service-type config =>
                                          (network-manager-configuration (inherit
                                                                          config)
                                                                         (vpn-plugins
                                                                          (list
                                                                           network-manager-openvpn)))))))

(define %base-services-nscd
  (modify-services %base-services
    (nscd-service-type config => %metznet-nscd-configuration)))

(define %server-services
  (append %metznet-services
          (list (service dbus-root-service-type)
                (service dhcp-client-service-type)
                (service openvpn-client-service-type
                         (openvpn-client-configuration (ca
                                                        "/var/lib/openvpn/ca.crt")
                                                       (cert
                                                        "/var/lib/openvpn/client.crt")
                                                       (key
                                                        "/var/lib/openvpn/client.key")
                                                       (tls-auth
                                                        "/var/lib/openvpn/ta.key")
                                                       (persist-key? #f)
                                                       (remote (list (openvpn-remote-configuration
                                                                      (name
                                                                       "vpn.metznet.ca")))))))))

(define %metznet-server-services
  (append %server-services %base-services-nscd))

(define %metznet-base-server-system
  (operating-system
    (host-name "metznet-base-server")
    (timezone "America/Edmonton")
    (locale "en_CA.utf8")
    (keyboard-layout %default-keyboard-layout)
    (name-service-switch %metznet-name-service-switch)
    (kernel-arguments (append '("console=ttyS0") %default-kernel-arguments))
    (bootloader (bootloader-configuration
                  (bootloader grub-efi-bootloader)
                  (targets '("/boot/efi"))
                  (keyboard-layout keyboard-layout)))
    (file-systems (cons* (file-system
                           (mount-point "/")
                           (device (file-system-label "guix-data"))
                           (type "ext4")
                           (check? #f))
                         (file-system
                           (mount-point "/boot/efi")
                           (device (file-system-label "guix-boot"))
                           (type "fat32")
                           (check? #f)) %base-file-systems))
    (users %metznet-base-user-accounts)
    (groups %metznet-base-groups)
    (packages %metznet-base-packages)
    (services
     %metznet-server-services)))

(define %metznet-base-desktop-system
  (operating-system
    (inherit %metznet-base-server-system)
    (host-name "metznet-base-desktop")
    (setuid-programs %desktop-setuid-programs)
    (packages %metznet-desktop-packages)
    (services
     %metznet-desktop-services)))