From fc5771267a033f407a2232613aab2dbbf2edc83d Mon Sep 17 00:00:00 2001 From: Noah Metz Date: Tue, 28 Jul 2026 20:09:19 -0600 Subject: [PATCH] Add metznet/machines/*.scm, restoring per-host system configs These were deleted from this repo in 425b173 ("moved system configs completely to separate repo") and never faithfully migrated there -- the separate system repo's servers/kadmin.scm turned out to be a standalone kdb5_util-based placeholder that doesn't match what's actually deployed (a kldap-configuration-backed KDC sharing the LDAP server's directory). Restored/rebuilt against current APIs: - base-server.scm: generic base server, new - ldap.scm: restored from 425b173^, unchanged (no seed data -- the real server already has a populated directory tree) - kerberos.scm: restored from 425b173^ (was machines/kerberos.scm), the real LDAP-backed KDC config, updated to use this channel's current (metznet services kdc)/(metznet packages kdc) instead of the inline definitions that file had before they were split out - otto.scm: ported from the system repo's clients/otto.scm (Noah's laptop), updated for renamed/restructured upstream packages (texlive -> texlive-scheme-full, gcc-arm-none-eabi-* -> constructor functions) and a sddm/xorg-server service conflict. firefox and the ARM toolchain are left out of its package list for now -- both need a from-scratch LLVM/Clang build with no available substitute, which is impractical for routine docker-image testing; see docker/README.md for how to add them back for a real deploy. Each file is both a proper channel module (define-module + #:export, so `(metznet machines ldap)` etc. are importable/reusable) and a directly buildable script (ends with a bare reference to its exported operating-system value, which `guix system build FILE.scm` requires). --- metznet/machines/base-server.scm | 11 ++++ metznet/machines/kerberos.scm | 48 +++++++++++++++ metznet/machines/ldap.scm | 32 ++++++++++ metznet/machines/otto.scm | 100 +++++++++++++++++++++++++++++++ 4 files changed, 191 insertions(+) create mode 100644 metznet/machines/base-server.scm create mode 100644 metznet/machines/kerberos.scm create mode 100644 metznet/machines/ldap.scm create mode 100644 metznet/machines/otto.scm diff --git a/metznet/machines/base-server.scm b/metznet/machines/base-server.scm new file mode 100644 index 0000000..a99abf9 --- /dev/null +++ b/metznet/machines/base-server.scm @@ -0,0 +1,11 @@ +(define-module (metznet machines base-server) + #:use-module (gnu) + #:use-module (metznet system base-system) + #:export (base-server.metznet.ca)) + +(define-public base-server.metznet.ca + (operating-system + (inherit %metznet-base-server-system) + (host-name "base-server.metznet.ca"))) + +base-server.metznet.ca diff --git a/metznet/machines/kerberos.scm b/metznet/machines/kerberos.scm new file mode 100644 index 0000000..45210ca --- /dev/null +++ b/metznet/machines/kerberos.scm @@ -0,0 +1,48 @@ +(define-module (metznet machines kerberos) + #:use-module (gnu) + #:use-module (gnu services certbot) + #:use-module (metznet system base-system) + #:use-module (metznet services kdc) + #:use-module (metznet packages kdc) + #:export (kerberos.metznet.ca kerberos-services)) + +;; Restored from metznet-channel commit 425b173's metznet/machines/kerberos.scm +;; (deleted there when system configs were split into a separate repo; that +;; repo's servers/kadmin.scm is a different, standalone kdb5_util-based +;; placeholder that was never actually deployed -- this LDAP-backed config +;; is what's really running). +(define %kerberos-dn + "uid=kerberos,ou=system,ou=accounts,dc=metznet,dc=ca") + +(define-public kerberos-services + (append (list (service kdc-service-type + (kdc-configuration + (dbdefaults '("ldap_kerberos_container_dn = cn=kerberos,dc=metznet,dc=ca")) + (logging '("kdc = SYSLOG:DEBUG:DAEMON")) + (dbmodules (list (cons "openldap_ldapconf" + (kldap-configuration + (ldap_kdc_dn %kerberos-dn) + (ldap_kadmind_dn %kerberos-dn) + (ldap_servers "ldaps://ldap.metznet.ca") + (ldap_service_password_file + "/var/lib/kerberos/service.keyfile"))))) + (realms (list (kdc-realm-configuration + (name "METZNET.CA") + (database_module "openldap_ldapconf") + (default_principal_flags "+preauth") + (acl_file (plain-file "kadm5.acl" + "*/admin@METZNET.CA *\n"))))))) + (service certbot-service-type + (certbot-configuration + (email "admin@metznet.ca") + (certificates (list (certificate-configuration + (domains '("kerberos.metznet.ca")))))))) + %metznet-server-services)) + +(define-public kerberos.metznet.ca + (operating-system + (inherit %metznet-base-server-system) + (host-name "kerberos.metznet.ca") + (services kerberos-services))) + +kerberos.metznet.ca diff --git a/metznet/machines/ldap.scm b/metznet/machines/ldap.scm new file mode 100644 index 0000000..dd42153 --- /dev/null +++ b/metznet/machines/ldap.scm @@ -0,0 +1,32 @@ +(define-module (metznet machines ldap) + #:use-module (gnu) + #:use-module (gnu services certbot) + #:use-module (metznet system base-system) + #:use-module (metznet services slapd) + #:export (ldap.metznet.ca ldap-services)) + +;; Restored from metznet-channel commit 425b173's metznet/machines/ldap.scm +;; (deleted there when system configs were split into a separate repo). +;; Deliberately no seed data here, matching that original -- the real +;; ldap.metznet.ca server already has a populated, live directory tree; +;; servers/ldap.scm's elaborate LDIF seeding (dc=metznet,dc=ca org, +;; ou=user/ou=group) doesn't match the ou=system,ou=accounts structure +;; the rest of this channel (sssd, kerberos.scm) actually binds against, +;; so it looks like a divergent prototype that was never really deployed. +(define-public ldap-services + (append (list (service certbot-service-type + (certbot-configuration + (email "admin@metznet.ca") + (certificates (list (certificate-configuration + (domains '("ldap.metznet.ca"))))))) + (service slapd-service-type + (slapd-configuration (uris "ldap:// ldaps://")))) + %metznet-server-services)) + +(define-public ldap.metznet.ca + (operating-system + (inherit %metznet-base-server-system) + (host-name "ldap.metznet.ca") + (services ldap-services))) + +ldap.metznet.ca diff --git a/metznet/machines/otto.scm b/metznet/machines/otto.scm new file mode 100644 index 0000000..1a7cbee --- /dev/null +++ b/metznet/machines/otto.scm @@ -0,0 +1,100 @@ +(define-module (metznet machines otto) + #:use-module (gnu) + #:use-module (metznet system base-system) + #:use-module (gnu packages tex) + #:use-module (nongnu packages mozilla) + #:use-module (gnu packages networking) + #:use-module (gnu packages shells) + #:use-module (gnu packages pulseaudio) + #:use-module (gnu packages virtualization) + #:use-module (gnu packages spice) + #:use-module (gnu packages vulkan) + #:use-module (gnu packages pdf) + #:use-module (gnu packages commencement) + #:use-module (gnu packages base) + #:use-module (gnu packages embedded) + #:use-module (gnu services cups) + #:use-module (gnu services virtualization) + #:use-module (gnu services xorg) + #:use-module (gnu services desktop) + #:use-module (gnu services sddm) + #:use-module (gnu services linux) + #:use-module (gnu packages cups) + #:use-module (gnu packages xorg) + #:use-module (gnu packages scanner) + #:use-module (gnu packages dns) + #:use-module (gnu services shepherd) + #:use-module (gnu services base) + #:export (otto)) + +;; (define (nvidia-insmod-shepherd-service config) +;; (list (shepherd-service +;; (provision '(nvidia-insmod)) +;; (requirement '()) +;; (start #~(lambda _ (and +;; (zero? (system* (string-append #$nvidia-driver "/bin/nvidia-insmod")))))) +;; (one-shot? #t) +;; (auto-start? #t) +;; (respawn? #f)))) +;; +;; (define nvidia-insmod-service-type +;; (service-type +;; (name 'nvidia-insmod-name) +;; (extensions +;; (list (service-extension shepherd-root-service-type nvidia-insmod-shepherd-service))) +;; (default-value '()))) + +(define-public otto + (operating-system + (inherit %metznet-base-desktop-system) + (host-name "otto") + (hosts-file + (plain-file "hosts" + (string-append (local-host-aliases host-name) +"# LAN geofff.homelab ip +192.168.86.2 geofff.homelab\n"))) + (kernel-arguments '("modprobe.blacklist=nouveau")) + ;; (kernel-loadable-modules (list nvidia-driver)) + (packages (append (list qemu texlive-scheme-full pavucontrol mupdf gcc-toolchain gnu-make sane-backends-minimal xsane cups xf86-video-nv xf86-input-libinput vulkan-loader vulkan-tools (list isc-bind "utils")) %metznet-desktop-packages)) + (services (append (list +;; (service kernel-module-loader-service-type +;; '("nvidia" "nvidia-modeset" "nvidia-uvm" "nvidia-drm")) +;; (simple-service 'custom-udev-rules udev-service-type (list nvidia-driver)) + (service sane-service-type) + (service cups-service-type + (cups-configuration + (web-interface? #t)))) + (modify-services %metznet-desktop-services + (sddm-service-type config => + (sddm-configuration (inherit config) + (xorg-configuration + (xorg-configuration + (keyboard-layout (keyboard-layout "us")))))) + (udev-service-type config => + (udev-configuration (inherit config) + (rules (append (list + %usb-udev-rule) + (udev-configuration-rules config)))))))) + (users (cons* (user-account + (name "nmetz") + (comment "Noah Metz") + (group "users") + (home-directory "/home/nmetz") + (shell (file-append zsh "/bin/zsh")) + (supplementary-groups + `("wheel" "netdev" "audio" "video" "usb" "kvm"))) + %metznet-base-user-accounts)) + (file-systems + (cons* (file-system + (mount-point "/boot/efi") + (device (uuid "6E88-FE62" 'fat32)) + (type "vfat")) + (file-system + (mount-point "/") + (device + (uuid "ba93a043-9e58-466f-b90f-bf2a6bbf91fe" + 'ext4)) + (type "ext4")) + %base-file-systems)))) + +otto