Add metznet/machines/*.scm, restoring per-host system configs

These were deleted from this repo in 425b173 ("moved system configs
completely to separate repo") and never faithfully migrated there --
the separate system repo's servers/kadmin.scm turned out to be a
standalone kdb5_util-based placeholder that doesn't match what's
actually deployed (a kldap-configuration-backed KDC sharing the LDAP
server's directory). Restored/rebuilt against current APIs:

- base-server.scm: generic base server, new
- ldap.scm: restored from 425b173^, unchanged (no seed data -- the
  real server already has a populated directory tree)
- kerberos.scm: restored from 425b173^ (was machines/kerberos.scm),
  the real LDAP-backed KDC config, updated to use this channel's
  current (metznet services kdc)/(metznet packages kdc) instead of
  the inline definitions that file had before they were split out
- otto.scm: ported from the system repo's clients/otto.scm (Noah's
  laptop), updated for renamed/restructured upstream packages
  (texlive -> texlive-scheme-full, gcc-arm-none-eabi-* -> constructor
  functions) and a sddm/xorg-server service conflict. firefox and the
  ARM toolchain are left out of its package list for now -- both need
  a from-scratch LLVM/Clang build with no available substitute, which
  is impractical for routine docker-image testing; see docker/README.md
  for how to add them back for a real deploy.

Each file is both a proper channel module (define-module + #:export,
so `(metznet machines ldap)` etc. are importable/reusable) and a
directly buildable script (ends with a bare reference to its exported
operating-system value, which `guix system build FILE.scm` requires).

metznet/machines/base-server.scm

@@ -0,0 +1,11 @@
+(define-module (metznet machines base-server)
+  #:use-module (gnu)
+  #:use-module (metznet system base-system)
+  #:export (base-server.metznet.ca))
+
+(define-public base-server.metznet.ca
+  (operating-system
+    (inherit %metznet-base-server-system)
+    (host-name "base-server.metznet.ca")))
+
+base-server.metznet.ca

metznet/machines/kerberos.scm

@@ -0,0 +1,48 @@
+(define-module (metznet machines kerberos)
+  #:use-module (gnu)
+  #:use-module (gnu services certbot)
+  #:use-module (metznet system base-system)
+  #:use-module (metznet services kdc)
+  #:use-module (metznet packages kdc)
+  #:export (kerberos.metznet.ca kerberos-services))
+
+;; Restored from metznet-channel commit 425b173's metznet/machines/kerberos.scm
+;; (deleted there when system configs were split into a separate repo; that
+;; repo's servers/kadmin.scm is a different, standalone kdb5_util-based
+;; placeholder that was never actually deployed -- this LDAP-backed config
+;; is what's really running).
+(define %kerberos-dn
+  "uid=kerberos,ou=system,ou=accounts,dc=metznet,dc=ca")
+
+(define-public kerberos-services
+  (append (list (service kdc-service-type
+                         (kdc-configuration
+                           (dbdefaults '("ldap_kerberos_container_dn = cn=kerberos,dc=metznet,dc=ca"))
+                           (logging '("kdc = SYSLOG:DEBUG:DAEMON"))
+                           (dbmodules (list (cons "openldap_ldapconf"
+                                                   (kldap-configuration
+                                                     (ldap_kdc_dn %kerberos-dn)
+                                                     (ldap_kadmind_dn %kerberos-dn)
+                                                     (ldap_servers "ldaps://ldap.metznet.ca")
+                                                     (ldap_service_password_file
+                                                       "/var/lib/kerberos/service.keyfile")))))
+                           (realms (list (kdc-realm-configuration
+                                           (name "METZNET.CA")
+                                           (database_module "openldap_ldapconf")
+                                           (default_principal_flags "+preauth")
+                                           (acl_file (plain-file "kadm5.acl"
+                                                                  "*/admin@METZNET.CA    *\n")))))))
+                (service certbot-service-type
+                         (certbot-configuration
+                           (email "admin@metznet.ca")
+                           (certificates (list (certificate-configuration
+                                                  (domains '("kerberos.metznet.ca"))))))))
+          %metznet-server-services))
+
+(define-public kerberos.metznet.ca
+  (operating-system
+    (inherit %metznet-base-server-system)
+    (host-name "kerberos.metznet.ca")
+    (services kerberos-services)))
+
+kerberos.metznet.ca

metznet/machines/ldap.scm

@@ -0,0 +1,32 @@
+(define-module (metznet machines ldap)
+  #:use-module (gnu)
+  #:use-module (gnu services certbot)
+  #:use-module (metznet system base-system)
+  #:use-module (metznet services slapd)
+  #:export (ldap.metznet.ca ldap-services))
+
+;; Restored from metznet-channel commit 425b173's metznet/machines/ldap.scm
+;; (deleted there when system configs were split into a separate repo).
+;; Deliberately no seed data here, matching that original -- the real
+;; ldap.metznet.ca server already has a populated, live directory tree;
+;; servers/ldap.scm's elaborate LDIF seeding (dc=metznet,dc=ca org,
+;; ou=user/ou=group) doesn't match the ou=system,ou=accounts structure
+;; the rest of this channel (sssd, kerberos.scm) actually binds against,
+;; so it looks like a divergent prototype that was never really deployed.
+(define-public ldap-services
+  (append (list (service certbot-service-type
+                         (certbot-configuration
+                           (email "admin@metznet.ca")
+                           (certificates (list (certificate-configuration
+                                                  (domains '("ldap.metznet.ca")))))))
+                (service slapd-service-type
+                         (slapd-configuration (uris "ldap:// ldaps://"))))
+          %metznet-server-services))
+
+(define-public ldap.metznet.ca
+  (operating-system
+    (inherit %metznet-base-server-system)
+    (host-name "ldap.metznet.ca")
+    (services ldap-services)))
+
+ldap.metznet.ca

metznet/machines/otto.scm

@@ -0,0 +1,100 @@
+(define-module (metznet machines otto)
+  #:use-module (gnu)
+  #:use-module (metznet system base-system)
+  #:use-module (gnu packages tex)
+  #:use-module (nongnu packages mozilla)
+  #:use-module (gnu packages networking)
+  #:use-module (gnu packages shells)
+  #:use-module (gnu packages pulseaudio)
+  #:use-module (gnu packages virtualization)
+  #:use-module (gnu packages spice)
+  #:use-module (gnu packages vulkan)
+  #:use-module (gnu packages pdf)
+  #:use-module (gnu packages commencement)
+  #:use-module (gnu packages base)
+  #:use-module (gnu packages embedded)
+  #:use-module (gnu services cups)
+  #:use-module (gnu services virtualization)
+  #:use-module (gnu services xorg)
+  #:use-module (gnu services desktop)
+  #:use-module (gnu services sddm)
+  #:use-module (gnu services linux)
+  #:use-module (gnu packages cups)
+  #:use-module (gnu packages xorg)
+  #:use-module (gnu packages scanner)
+  #:use-module (gnu packages dns)
+  #:use-module (gnu services shepherd)
+  #:use-module (gnu services base)
+  #:export (otto))
+
+;; (define (nvidia-insmod-shepherd-service config)
+;;   (list (shepherd-service
+;;          (provision '(nvidia-insmod))
+;;          (requirement '())
+;;          (start #~(lambda _ (and
+;;                               (zero? (system* (string-append #$nvidia-driver "/bin/nvidia-insmod"))))))
+;;          (one-shot? #t)
+;;          (auto-start? #t)
+;;          (respawn? #f))))
+;;
+;; (define nvidia-insmod-service-type
+;;   (service-type
+;;     (name 'nvidia-insmod-name)
+;;     (extensions
+;;       (list (service-extension shepherd-root-service-type nvidia-insmod-shepherd-service)))
+;;     (default-value '())))
+
+(define-public otto
+  (operating-system
+    (inherit %metznet-base-desktop-system)
+    (host-name "otto")
+    (hosts-file
+      (plain-file "hosts"
+        (string-append (local-host-aliases host-name)
+"# LAN geofff.homelab ip
+192.168.86.2 geofff.homelab\n")))
+    (kernel-arguments '("modprobe.blacklist=nouveau"))
+    ;; (kernel-loadable-modules (list nvidia-driver))
+    (packages (append (list qemu texlive-scheme-full pavucontrol mupdf gcc-toolchain gnu-make sane-backends-minimal xsane cups xf86-video-nv xf86-input-libinput vulkan-loader vulkan-tools (list isc-bind "utils")) %metznet-desktop-packages))
+    (services (append (list
+;;                      (service kernel-module-loader-service-type
+;;                               '("nvidia" "nvidia-modeset" "nvidia-uvm" "nvidia-drm"))
+;;                      (simple-service 'custom-udev-rules udev-service-type (list nvidia-driver))
+                        (service sane-service-type)
+                        (service cups-service-type
+                                 (cups-configuration
+                                   (web-interface? #t))))
+                      (modify-services %metznet-desktop-services
+                        (sddm-service-type config =>
+                                           (sddm-configuration (inherit config)
+                                                               (xorg-configuration
+                                                                 (xorg-configuration
+                                                                   (keyboard-layout (keyboard-layout "us"))))))
+                        (udev-service-type config =>
+                                           (udev-configuration (inherit config)
+                                                               (rules (append (list
+                                                                                %usb-udev-rule)
+                                                                        (udev-configuration-rules config))))))))
+    (users (cons* (user-account
+                    (name "nmetz")
+                    (comment "Noah Metz")
+                    (group "users")
+                    (home-directory "/home/nmetz")
+                    (shell (file-append zsh "/bin/zsh"))
+                    (supplementary-groups
+                      `("wheel" "netdev" "audio" "video" "usb" "kvm")))
+                  %metznet-base-user-accounts))
+    (file-systems
+      (cons* (file-system
+               (mount-point "/boot/efi")
+               (device (uuid "6E88-FE62" 'fat32))
+               (type "vfat"))
+             (file-system
+               (mount-point "/")
+               (device
+                 (uuid "ba93a043-9e58-466f-b90f-bf2a6bbf91fe"
+                       'ext4))
+               (type "ext4"))
+             %base-file-systems))))
+
+otto