Compare commits
No commits in common. "27216154974bf6b199c52b30a8575cc65e1520cd" and "3def4f190807d7d928a2c8250462696f0815266c" have entirely different histories.
2721615497
...
3def4f1908
@ -1,3 +0,0 @@
|
|||||||
(channel
|
|
||||||
(name 'metznet-channel)
|
|
||||||
(url "https://git.metznet.ca/MetzNet/metznet-channel"))
|
|
||||||
@ -1,8 +0,0 @@
|
|||||||
(channel
|
|
||||||
(name 'nonguix)
|
|
||||||
(url "https://gitlab.com/nonguix/nonguix")
|
|
||||||
(introduction
|
|
||||||
(make-channel-introduction
|
|
||||||
"897c1a470da759236cc11798f4e0a5f7d4d59fbc"
|
|
||||||
(openpgp-fingerprint
|
|
||||||
"2A39 3FFF 68F4 EF7A 3D29 12AF 6F51 20A0 22FB B2D5"))))
|
|
||||||
@ -1,10 +0,0 @@
|
|||||||
(channel
|
|
||||||
(name 'guix-gaming-games)
|
|
||||||
(url "https://gitlab.com/guix-gaming-channels/games.git")
|
|
||||||
;; Enable signature verification:
|
|
||||||
(introduction
|
|
||||||
(make-channel-introduction
|
|
||||||
"c23d64f1b8cc086659f8781b27ab6c7314c5cca5"
|
|
||||||
(openpgp-fingerprint
|
|
||||||
"50F3 3E2E 5B0C 3D90 0424 ABE8 9BDC F497 A4BB CC7F"))))
|
|
||||||
|
|
||||||
@ -1,10 +0,0 @@
|
|||||||
;; channels.scm -- reads the channels.d dir to get a list of channel objects
|
|
||||||
|
|
||||||
(use-modules (gnu) ((ice-9 ftw) #:select (scandir)))
|
|
||||||
|
|
||||||
(define channel-files
|
|
||||||
(scandir "./channels.d"
|
|
||||||
(lambda (file)
|
|
||||||
(string-suffix? ".scm" file))))
|
|
||||||
|
|
||||||
(append (map (lambda (file) (load (string-append "./channels.d/" file))) channel-files) %default-channels)
|
|
||||||
@ -1,21 +0,0 @@
|
|||||||
services:
|
|
||||||
guix:
|
|
||||||
platform: linux/amd64
|
|
||||||
build:
|
|
||||||
context: docker
|
|
||||||
volumes:
|
|
||||||
- guix-store:/gnu
|
|
||||||
- guix-state:/var/guix
|
|
||||||
- guix-cache:/root/.cache
|
|
||||||
- .:/workspace
|
|
||||||
working_dir: /workspace
|
|
||||||
environment:
|
|
||||||
DOMAIN_CAPS: ${DOMAIN_CAPS:-METZNET.CA}
|
|
||||||
DOMAIN_NAME: ${DOMAIN_NAME:-metznet.ca}
|
|
||||||
tty: true
|
|
||||||
stdin_open: true
|
|
||||||
|
|
||||||
volumes:
|
|
||||||
guix-store:
|
|
||||||
guix-state:
|
|
||||||
guix-cache:
|
|
||||||
@ -1,38 +0,0 @@
|
|||||||
# Guix build environment for building `guix system docker-image` images
|
|
||||||
# from this repo on a machine (e.g. macOS) that can't run Guix natively.
|
|
||||||
#
|
|
||||||
# Guix state lives under /gnu and /var/guix, which the compose file mounts
|
|
||||||
# as named volumes so pulls/builds are cached across container runs. This
|
|
||||||
# image only bakes in the *initial* binary install; everything built via
|
|
||||||
# `guix pull` / `guix system` happens at `docker run` time against those
|
|
||||||
# volumes.
|
|
||||||
FROM debian:bookworm-slim
|
|
||||||
|
|
||||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
||||||
bash gnupg dirmngr wget ca-certificates xz-utils tar locales procps sudo netbase \
|
|
||||||
&& rm -rf /var/lib/apt/lists/* \
|
|
||||||
&& sed -i '/en_US.UTF-8/s/^# //' /etc/locale.gen \
|
|
||||||
&& locale-gen
|
|
||||||
|
|
||||||
# Official installer: extracts the binary tarball to /gnu and /var/guix,
|
|
||||||
# creates the guixbuild group/users, and (since no init system is present
|
|
||||||
# in the container) prints instructions to run guix-daemon manually, which
|
|
||||||
# entrypoint.sh does. `yes ''` answers every prompt with its default,
|
|
||||||
# which includes authorizing the ci.guix.gnu.org / bordeaux substitute
|
|
||||||
# servers so builds don't compile everything from source.
|
|
||||||
RUN wget -O /tmp/guix-install.sh https://guix.gnu.org/guix-install.sh \
|
|
||||||
&& chmod +x /tmp/guix-install.sh \
|
|
||||||
&& yes '' | /tmp/guix-install.sh \
|
|
||||||
&& rm -f /tmp/guix-install.sh \
|
|
||||||
&& test -x /root/.config/guix/current/bin/guix
|
|
||||||
|
|
||||||
ENV PATH="/root/.config/guix/current/bin:/usr/local/bin:${PATH}" \
|
|
||||||
GUIX_LOCPATH="/root/.config/guix/current/lib/locale" \
|
|
||||||
LANG="en_US.UTF-8"
|
|
||||||
|
|
||||||
COPY entrypoint.sh /usr/local/bin/entrypoint.sh
|
|
||||||
RUN chmod +x /usr/local/bin/entrypoint.sh
|
|
||||||
|
|
||||||
WORKDIR /workspace
|
|
||||||
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
|
|
||||||
CMD ["bash"]
|
|
||||||
@ -1,135 +0,0 @@
|
|||||||
# Guix-in-Docker build environment
|
|
||||||
|
|
||||||
Guix has no native macOS build, so this runs a Debian container with Guix
|
|
||||||
installed (official binary tarball) as the build machine, and uses
|
|
||||||
`guix system docker-image` to turn `metznet/machines/*.scm` into Docker
|
|
||||||
images you can `docker load`/`docker run` directly in Docker Desktop. No
|
|
||||||
QEMU/KVM required, which is why it works on macOS where `scripts/qemu.sh`
|
|
||||||
(KVM-only) does not.
|
|
||||||
|
|
||||||
The builder container runs as `linux/amd64` (via Rosetta on Apple
|
|
||||||
Silicon), matching real deployment hardware — nonguix substitutes are
|
|
||||||
x86_64-focused, so building on aarch64 forces a lot of expensive
|
|
||||||
from-source builds (and occasionally hits GCC/architecture edge cases)
|
|
||||||
that just don't happen on amd64.
|
|
||||||
|
|
||||||
## Why this works without a bootloader/kernel/real disks
|
|
||||||
|
|
||||||
`guix system docker-image` (and `guix system container`) transform the
|
|
||||||
`operating-system` value before building: the real `kernel`, `bootloader`,
|
|
||||||
and `file-systems` fields are all replaced/ignored (see
|
|
||||||
`containerized-operating-system` in Guix's `gnu/system/linux-container.scm`),
|
|
||||||
along with services that make no sense in a container (`mingetty`,
|
|
||||||
`agetty`, static networking). Nothing in `metznet/machines/*.scm` needs to
|
|
||||||
change for this to work.
|
|
||||||
|
|
||||||
What *isn't* swapped out: services like `dhcpcd-service-type` and
|
|
||||||
`openvpn-client-service-type` (in `%metznet-server-services`) will still
|
|
||||||
try to run and will likely fail/hang inside a container (no real DHCP
|
|
||||||
server or VPN endpoint reachable) — that's expected. Pass `-N`/`--network`
|
|
||||||
(the `image` subcommand below always does) so a dummy `networking`
|
|
||||||
shepherd service is provided up front; other services that just
|
|
||||||
`(requirement '(networking ...))` (openssh, slapd, kdc) come up fine
|
|
||||||
regardless of whether the DHCP/VPN services themselves succeed.
|
|
||||||
|
|
||||||
## Container internals (why the Dockerfile/entrypoint look the way they do)
|
|
||||||
|
|
||||||
- `netbase` is installed explicitly: `debian:bookworm-slim` ships without
|
|
||||||
`/etc/services`, and Guile's `getaddrinfo` needs it to resolve `https`/
|
|
||||||
`http` as service names. Without it, every network fetch inside Guix
|
|
||||||
(substitutes, source downloads, even channel git clones from the *guix
|
|
||||||
pull* subprocess) fails with a cryptic `In procedure getaddrinfo:
|
|
||||||
Servname not supported for ai_socktype` — nothing to do with DNS or
|
|
||||||
certs despite how it reads.
|
|
||||||
- `entrypoint.sh` starts `guix-daemon --disable-chroot`. Sandboxed builds
|
|
||||||
normally isolate via Linux namespaces (`unshare`/`clone`), which Docker
|
|
||||||
blocks by default even for root (`clone: Operation not permitted`).
|
|
||||||
We're already isolated by the outer container, so build isolation is
|
|
||||||
traded away here rather than running the whole thing `--privileged`.
|
|
||||||
One side effect: guix-daemon's store-path grafting (security-patch
|
|
||||||
rewriting) hits a permission error creating output files under
|
|
||||||
`--disable-chroot`, so `scripts/guix-docker.sh image` always passes
|
|
||||||
`--no-grafts` (uses un-grafted originals instead — fine for testing).
|
|
||||||
- It also always kills and restarts `guix-daemon` rather than checking
|
|
||||||
if its socket already exists: `/var/guix` is a persistent volume, so a
|
|
||||||
*stale* socket file from a previous (already-exited) container can
|
|
||||||
still be sitting there even though nothing is listening on it.
|
|
||||||
- `ps` (and possibly other procps tools) crash reliably under Rosetta
|
|
||||||
with `assertion failed [true_path_length_self >= 0]` — a Rosetta bug,
|
|
||||||
not a Guix issue. Doesn't affect the actual build; just don't rely on
|
|
||||||
`docker exec <container> ps` to check progress. `du -sh /gnu/store` or
|
|
||||||
watching the log works fine.
|
|
||||||
|
|
||||||
## One-time setup
|
|
||||||
|
|
||||||
```
|
|
||||||
scripts/guix-docker.sh build # builds the builder image (~1-2 min)
|
|
||||||
scripts/guix-docker.sh pull # guix pull -C channels.scm
|
|
||||||
```
|
|
||||||
|
|
||||||
`pull` needs network access to gitlab.com (nonguix, nonguix-games),
|
|
||||||
git.metznet.ca, and Savannah/git.guix.gnu.org. Re-run it whenever
|
|
||||||
`channels.scm`/`channels.d/*.scm` change. The main `guix` channel alone
|
|
||||||
is ~14.8k commits to authenticate the first time, which is genuinely slow
|
|
||||||
(several minutes of CPU) — after that it's cached (see below) and
|
|
||||||
re-pulls are fast.
|
|
||||||
|
|
||||||
Guix's store (`/gnu`), daemon state (`/var/guix`), and git-checkout/
|
|
||||||
authentication cache (`/root/.cache`, notably `~/.cache/guix/checkouts`
|
|
||||||
and `~/.cache/guix/authentication`) all live in named Docker volumes, so
|
|
||||||
none of that expensive work repeats across runs. `docker compose down -v`
|
|
||||||
wipes everything if you ever want a clean slate (necessary if you ever
|
|
||||||
switch the `platform:` in `docker-compose.yml` — a store built for one
|
|
||||||
architecture isn't usable from another).
|
|
||||||
|
|
||||||
## Building a system as a docker image
|
|
||||||
|
|
||||||
```
|
|
||||||
scripts/guix-docker.sh image metznet/machines/ldap.scm
|
|
||||||
docker load < build/ldap.tar.gz
|
|
||||||
docker run --rm -it <image-id-or-name> /run/current-system/profile/bin/bash --login
|
|
||||||
```
|
|
||||||
|
|
||||||
or do build+load+run in one step:
|
|
||||||
|
|
||||||
```
|
|
||||||
scripts/guix-docker.sh load-run metznet/machines/ldap.scm
|
|
||||||
```
|
|
||||||
|
|
||||||
`image`/`load-run` pass `-L /workspace` (this checkout, bind-mounted
|
|
||||||
live), so uncommitted local edits to any `metznet/**` module are picked
|
|
||||||
up directly — no commit/pull round-trip needed, unlike a real `guix
|
|
||||||
pull` on a deployed machine.
|
|
||||||
|
|
||||||
`DOMAIN_CAPS`/`DOMAIN_NAME` default to `METZNET.CA`/`metznet.ca` in
|
|
||||||
`docker-compose.yml`, matching `scripts/qemu.sh`; override by exporting
|
|
||||||
them before calling `guix-docker.sh`, or in a `.env` file next to
|
|
||||||
`docker-compose.yml`.
|
|
||||||
|
|
||||||
Once running, `herd status` inside the container shows shepherd service
|
|
||||||
state — useful for checking whether e.g. `slapd` actually came up.
|
|
||||||
|
|
||||||
## Known gotchas
|
|
||||||
|
|
||||||
- `channels.d/metznet.scm` has no `introduction`, so `guix pull` doesn't
|
|
||||||
authenticate it (unlike nonguix/games, which do).
|
|
||||||
- `metznet/machines/otto.scm` (Noah's laptop) has `firefox` and the ARM
|
|
||||||
embedded toolchain (`make-arm-none-eabi-toolchain-7-2018-q2-update`)
|
|
||||||
removed from its package list — both require building an entire
|
|
||||||
LLVM/Clang toolchain from scratch (no substitute currently available,
|
|
||||||
even on x86_64), which is impractical for routine testing. Add them
|
|
||||||
back with `(make-arm-none-eabi-toolchain-7-2018-q2-update)` (a
|
|
||||||
zero-arg constructor from `(gnu packages embedded)`, not a bare
|
|
||||||
package name — that changed upstream) and `firefox` (from `(nongnu
|
|
||||||
packages mozilla)`) if you need them for a real build/deploy.
|
|
||||||
- Package-level quirks fixed in this channel to build at all against
|
|
||||||
current Guix (all in `metznet/packages/`, not upstream Guix changes):
|
|
||||||
`metznet-sssd` disables tests (one fails only under Docker's emulated
|
|
||||||
filesystem/Rosetta, not a real regression) and strips the
|
|
||||||
`--install-layout=deb` flag setuptools no longer accepts;
|
|
||||||
`metznet-kitty` disables tests for the same reason (`O_TMPFILE`
|
|
||||||
atomicity isn't honored by Docker Desktop's virtualized filesystem on
|
|
||||||
macOS); `openldap-slapd` forces `-std=gnu17` plus several `-Wno-*`
|
|
||||||
flags because GCC 14 turned some of its 25-year-old autoconf checks
|
|
||||||
into hard errors, and adds `libxcrypt` as an input since glibc dropped
|
|
||||||
`crypt()`.
|
|
||||||
@ -1,24 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
socket=/var/guix/daemon-socket/socket
|
|
||||||
|
|
||||||
# /var/guix is a persistent volume, so a stale socket from a previous
|
|
||||||
# (now-dead) container can still be sitting there; always start a fresh
|
|
||||||
# daemon, which unlinks and rebinds the socket itself, rather than
|
|
||||||
# skipping startup just because the path exists.
|
|
||||||
# --disable-chroot: sandboxed builds normally isolate via Linux namespaces
|
|
||||||
# (unshare/clone), which Docker blocks by default even for root ("clone:
|
|
||||||
# Operation not permitted") and which also seems to cut off DNS for the
|
|
||||||
# substituter subprocess. We're already isolated by the outer container,
|
|
||||||
# so skip guix-daemon's own sandboxing rather than granting --privileged.
|
|
||||||
rm -f "$socket"
|
|
||||||
guix-daemon --build-users-group=guixbuild --disable-chroot &
|
|
||||||
|
|
||||||
for _ in $(seq 1 30); do
|
|
||||||
[ -S "$socket" ] && break
|
|
||||||
sleep 1
|
|
||||||
done
|
|
||||||
[ -S "$socket" ] || { echo "guix-daemon did not come up" >&2; exit 1; }
|
|
||||||
|
|
||||||
exec "$@"
|
|
||||||
@ -1,11 +0,0 @@
|
|||||||
(define-module (metznet machines base-server)
|
|
||||||
#:use-module (gnu)
|
|
||||||
#:use-module (metznet system base-system)
|
|
||||||
#:export (base-server.metznet.ca))
|
|
||||||
|
|
||||||
(define-public base-server.metznet.ca
|
|
||||||
(operating-system
|
|
||||||
(inherit %metznet-base-server-system)
|
|
||||||
(host-name "base-server.metznet.ca")))
|
|
||||||
|
|
||||||
base-server.metznet.ca
|
|
||||||
@ -1,48 +0,0 @@
|
|||||||
(define-module (metznet machines kerberos)
|
|
||||||
#:use-module (gnu)
|
|
||||||
#:use-module (gnu services certbot)
|
|
||||||
#:use-module (metznet system base-system)
|
|
||||||
#:use-module (metznet services kdc)
|
|
||||||
#:use-module (metznet packages kdc)
|
|
||||||
#:export (kerberos.metznet.ca kerberos-services))
|
|
||||||
|
|
||||||
;; Restored from metznet-channel commit 425b173's metznet/machines/kerberos.scm
|
|
||||||
;; (deleted there when system configs were split into a separate repo; that
|
|
||||||
;; repo's servers/kadmin.scm is a different, standalone kdb5_util-based
|
|
||||||
;; placeholder that was never actually deployed -- this LDAP-backed config
|
|
||||||
;; is what's really running).
|
|
||||||
(define %kerberos-dn
|
|
||||||
"uid=kerberos,ou=system,ou=accounts,dc=metznet,dc=ca")
|
|
||||||
|
|
||||||
(define-public kerberos-services
|
|
||||||
(append (list (service kdc-service-type
|
|
||||||
(kdc-configuration
|
|
||||||
(dbdefaults '("ldap_kerberos_container_dn = cn=kerberos,dc=metznet,dc=ca"))
|
|
||||||
(logging '("kdc = SYSLOG:DEBUG:DAEMON"))
|
|
||||||
(dbmodules (list (cons "openldap_ldapconf"
|
|
||||||
(kldap-configuration
|
|
||||||
(ldap_kdc_dn %kerberos-dn)
|
|
||||||
(ldap_kadmind_dn %kerberos-dn)
|
|
||||||
(ldap_servers "ldaps://ldap.metznet.ca")
|
|
||||||
(ldap_service_password_file
|
|
||||||
"/var/lib/kerberos/service.keyfile")))))
|
|
||||||
(realms (list (kdc-realm-configuration
|
|
||||||
(name "METZNET.CA")
|
|
||||||
(database_module "openldap_ldapconf")
|
|
||||||
(default_principal_flags "+preauth")
|
|
||||||
(acl_file (plain-file "kadm5.acl"
|
|
||||||
"*/admin@METZNET.CA *\n")))))))
|
|
||||||
(service certbot-service-type
|
|
||||||
(certbot-configuration
|
|
||||||
(email "admin@metznet.ca")
|
|
||||||
(certificates (list (certificate-configuration
|
|
||||||
(domains '("kerberos.metznet.ca"))))))))
|
|
||||||
%metznet-server-services))
|
|
||||||
|
|
||||||
(define-public kerberos.metznet.ca
|
|
||||||
(operating-system
|
|
||||||
(inherit %metznet-base-server-system)
|
|
||||||
(host-name "kerberos.metznet.ca")
|
|
||||||
(services kerberos-services)))
|
|
||||||
|
|
||||||
kerberos.metznet.ca
|
|
||||||
@ -1,32 +0,0 @@
|
|||||||
(define-module (metznet machines ldap)
|
|
||||||
#:use-module (gnu)
|
|
||||||
#:use-module (gnu services certbot)
|
|
||||||
#:use-module (metznet system base-system)
|
|
||||||
#:use-module (metznet services slapd)
|
|
||||||
#:export (ldap.metznet.ca ldap-services))
|
|
||||||
|
|
||||||
;; Restored from metznet-channel commit 425b173's metznet/machines/ldap.scm
|
|
||||||
;; (deleted there when system configs were split into a separate repo).
|
|
||||||
;; Deliberately no seed data here, matching that original -- the real
|
|
||||||
;; ldap.metznet.ca server already has a populated, live directory tree;
|
|
||||||
;; servers/ldap.scm's elaborate LDIF seeding (dc=metznet,dc=ca org,
|
|
||||||
;; ou=user/ou=group) doesn't match the ou=system,ou=accounts structure
|
|
||||||
;; the rest of this channel (sssd, kerberos.scm) actually binds against,
|
|
||||||
;; so it looks like a divergent prototype that was never really deployed.
|
|
||||||
(define-public ldap-services
|
|
||||||
(append (list (service certbot-service-type
|
|
||||||
(certbot-configuration
|
|
||||||
(email "admin@metznet.ca")
|
|
||||||
(certificates (list (certificate-configuration
|
|
||||||
(domains '("ldap.metznet.ca")))))))
|
|
||||||
(service slapd-service-type
|
|
||||||
(slapd-configuration (uris "ldap:// ldaps://"))))
|
|
||||||
%metznet-server-services))
|
|
||||||
|
|
||||||
(define-public ldap.metznet.ca
|
|
||||||
(operating-system
|
|
||||||
(inherit %metznet-base-server-system)
|
|
||||||
(host-name "ldap.metznet.ca")
|
|
||||||
(services ldap-services)))
|
|
||||||
|
|
||||||
ldap.metznet.ca
|
|
||||||
@ -1,100 +0,0 @@
|
|||||||
(define-module (metznet machines otto)
|
|
||||||
#:use-module (gnu)
|
|
||||||
#:use-module (metznet system base-system)
|
|
||||||
#:use-module (gnu packages tex)
|
|
||||||
#:use-module (nongnu packages mozilla)
|
|
||||||
#:use-module (gnu packages networking)
|
|
||||||
#:use-module (gnu packages shells)
|
|
||||||
#:use-module (gnu packages pulseaudio)
|
|
||||||
#:use-module (gnu packages virtualization)
|
|
||||||
#:use-module (gnu packages spice)
|
|
||||||
#:use-module (gnu packages vulkan)
|
|
||||||
#:use-module (gnu packages pdf)
|
|
||||||
#:use-module (gnu packages commencement)
|
|
||||||
#:use-module (gnu packages base)
|
|
||||||
#:use-module (gnu packages embedded)
|
|
||||||
#:use-module (gnu services cups)
|
|
||||||
#:use-module (gnu services virtualization)
|
|
||||||
#:use-module (gnu services xorg)
|
|
||||||
#:use-module (gnu services desktop)
|
|
||||||
#:use-module (gnu services sddm)
|
|
||||||
#:use-module (gnu services linux)
|
|
||||||
#:use-module (gnu packages cups)
|
|
||||||
#:use-module (gnu packages xorg)
|
|
||||||
#:use-module (gnu packages scanner)
|
|
||||||
#:use-module (gnu packages dns)
|
|
||||||
#:use-module (gnu services shepherd)
|
|
||||||
#:use-module (gnu services base)
|
|
||||||
#:export (otto))
|
|
||||||
|
|
||||||
;; (define (nvidia-insmod-shepherd-service config)
|
|
||||||
;; (list (shepherd-service
|
|
||||||
;; (provision '(nvidia-insmod))
|
|
||||||
;; (requirement '())
|
|
||||||
;; (start #~(lambda _ (and
|
|
||||||
;; (zero? (system* (string-append #$nvidia-driver "/bin/nvidia-insmod"))))))
|
|
||||||
;; (one-shot? #t)
|
|
||||||
;; (auto-start? #t)
|
|
||||||
;; (respawn? #f))))
|
|
||||||
;;
|
|
||||||
;; (define nvidia-insmod-service-type
|
|
||||||
;; (service-type
|
|
||||||
;; (name 'nvidia-insmod-name)
|
|
||||||
;; (extensions
|
|
||||||
;; (list (service-extension shepherd-root-service-type nvidia-insmod-shepherd-service)))
|
|
||||||
;; (default-value '())))
|
|
||||||
|
|
||||||
(define-public otto
|
|
||||||
(operating-system
|
|
||||||
(inherit %metznet-base-desktop-system)
|
|
||||||
(host-name "otto")
|
|
||||||
(hosts-file
|
|
||||||
(plain-file "hosts"
|
|
||||||
(string-append (local-host-aliases host-name)
|
|
||||||
"# LAN geofff.homelab ip
|
|
||||||
192.168.86.2 geofff.homelab\n")))
|
|
||||||
(kernel-arguments '("modprobe.blacklist=nouveau"))
|
|
||||||
;; (kernel-loadable-modules (list nvidia-driver))
|
|
||||||
(packages (append (list qemu texlive-scheme-full pavucontrol mupdf gcc-toolchain gnu-make sane-backends-minimal xsane cups xf86-video-nv xf86-input-libinput vulkan-loader vulkan-tools (list isc-bind "utils")) %metznet-desktop-packages))
|
|
||||||
(services (append (list
|
|
||||||
;; (service kernel-module-loader-service-type
|
|
||||||
;; '("nvidia" "nvidia-modeset" "nvidia-uvm" "nvidia-drm"))
|
|
||||||
;; (simple-service 'custom-udev-rules udev-service-type (list nvidia-driver))
|
|
||||||
(service sane-service-type)
|
|
||||||
(service cups-service-type
|
|
||||||
(cups-configuration
|
|
||||||
(web-interface? #t))))
|
|
||||||
(modify-services %metznet-desktop-services
|
|
||||||
(sddm-service-type config =>
|
|
||||||
(sddm-configuration (inherit config)
|
|
||||||
(xorg-configuration
|
|
||||||
(xorg-configuration
|
|
||||||
(keyboard-layout (keyboard-layout "us"))))))
|
|
||||||
(udev-service-type config =>
|
|
||||||
(udev-configuration (inherit config)
|
|
||||||
(rules (append (list
|
|
||||||
%usb-udev-rule)
|
|
||||||
(udev-configuration-rules config))))))))
|
|
||||||
(users (cons* (user-account
|
|
||||||
(name "nmetz")
|
|
||||||
(comment "Noah Metz")
|
|
||||||
(group "users")
|
|
||||||
(home-directory "/home/nmetz")
|
|
||||||
(shell (file-append zsh "/bin/zsh"))
|
|
||||||
(supplementary-groups
|
|
||||||
`("wheel" "netdev" "audio" "video" "usb" "kvm")))
|
|
||||||
%metznet-base-user-accounts))
|
|
||||||
(file-systems
|
|
||||||
(cons* (file-system
|
|
||||||
(mount-point "/boot/efi")
|
|
||||||
(device (uuid "6E88-FE62" 'fat32))
|
|
||||||
(type "vfat"))
|
|
||||||
(file-system
|
|
||||||
(mount-point "/")
|
|
||||||
(device
|
|
||||||
(uuid "ba93a043-9e58-466f-b90f-bf2a6bbf91fe"
|
|
||||||
'ext4))
|
|
||||||
(type "ext4"))
|
|
||||||
%base-file-systems))))
|
|
||||||
|
|
||||||
otto
|
|
||||||
@ -1,18 +0,0 @@
|
|||||||
(define-module (metznet packages kitty)
|
|
||||||
#:use-module (guix packages)
|
|
||||||
#:use-module (guix utils)
|
|
||||||
#:use-module (gnu packages terminals)
|
|
||||||
#:export (metznet-kitty))
|
|
||||||
|
|
||||||
;; kitty's test suite includes TestCreateAnonymousTempfile, which checks
|
|
||||||
;; that O_TMPFILE creates files atomically -- a Linux filesystem feature
|
|
||||||
;; not properly supported by Docker Desktop's virtualized filesystem on
|
|
||||||
;; macOS. This is a test-environment limitation, not a real regression
|
|
||||||
;; (kitty's actual runtime behavior is unaffected); disabling tests only
|
|
||||||
;; skips this build-time check.
|
|
||||||
(define-public metznet-kitty
|
|
||||||
(package
|
|
||||||
(inherit kitty)
|
|
||||||
(arguments
|
|
||||||
(substitute-keyword-arguments (package-arguments kitty)
|
|
||||||
((#:tests? tests? #t) #f)))))
|
|
||||||
@ -1,26 +0,0 @@
|
|||||||
(define-module (metznet packages sssd)
|
|
||||||
#:use-module (guix packages)
|
|
||||||
#:use-module (guix utils)
|
|
||||||
#:use-module (guix gexp)
|
|
||||||
#:use-module (gnu packages sssd)
|
|
||||||
#:export (metznet-sssd))
|
|
||||||
|
|
||||||
;; Upstream sssd's Makefile.am has `DISTSETUPOPTS += --install-layout=deb`,
|
|
||||||
;; which the setuptools version currently pulled in Guix no longer
|
|
||||||
;; supports (that flag was removed along with distutils), breaking the
|
|
||||||
;; `src/config` install step. Force DISTSETUPOPTS empty via a make
|
|
||||||
;; command-line override, which takes precedence over the Makefile's `+=`
|
|
||||||
;; regardless of autoreconf/Makefile.in regeneration timing.
|
|
||||||
;;
|
|
||||||
;; Tests are also disabled: src/tests/cmocka/test_iobuf.c fails under
|
|
||||||
;; Docker's emulated-x86_64 (Rosetta) build environment -- a test
|
|
||||||
;; environment artifact, not a real regression (sssd's actual runtime
|
|
||||||
;; behavior is unaffected; disabling only skips this build-time check).
|
|
||||||
(define-public metznet-sssd
|
|
||||||
(package
|
|
||||||
(inherit sssd)
|
|
||||||
(arguments
|
|
||||||
(substitute-keyword-arguments (package-arguments sssd)
|
|
||||||
((#:make-flags flags)
|
|
||||||
#~(cons "DISTSETUPOPTS=" #$flags))
|
|
||||||
((#:tests? tests? #t) #f)))))
|
|
||||||
@ -1,76 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
# Drive the dockerized Guix build environment (see docker/) to build the
|
|
||||||
# operating-system definitions in this repo as `guix system docker-image`
|
|
||||||
# tarballs, loadable straight into Docker Desktop.
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
cd "$(dirname "$0")/.."
|
|
||||||
|
|
||||||
compose() {
|
|
||||||
docker compose run --rm guix "$@"
|
|
||||||
}
|
|
||||||
|
|
||||||
usage() {
|
|
||||||
cat <<EOF
|
|
||||||
usage: $0 <command> [args]
|
|
||||||
|
|
||||||
commands:
|
|
||||||
build build/rebuild the guix builder image
|
|
||||||
pull guix pull -C channels.scm (do this first, and
|
|
||||||
again whenever channels.scm/channels.d/*.scm
|
|
||||||
change)
|
|
||||||
shell interactive shell inside the builder container
|
|
||||||
image FILE.scm [NAME] build FILE.scm (e.g. metznet/machines/ldap.scm)
|
|
||||||
as a docker image, writing build/NAME.tar.gz
|
|
||||||
(NAME defaults to FILE's basename). -L points
|
|
||||||
at /workspace (this checkout), so uncommitted
|
|
||||||
local edits are picked up directly -- no
|
|
||||||
commit/pull round-trip needed. Load with:
|
|
||||||
docker load < build/NAME.tar.gz
|
|
||||||
load-run FILE.scm build FILE.scm, docker load it into the host
|
|
||||||
Docker, and drop into a shell in a container
|
|
||||||
started from it
|
|
||||||
EOF
|
|
||||||
}
|
|
||||||
|
|
||||||
cmd="${1:-}"
|
|
||||||
[ -n "$cmd" ] && shift || true
|
|
||||||
|
|
||||||
case "$cmd" in
|
|
||||||
build)
|
|
||||||
docker compose build
|
|
||||||
;;
|
|
||||||
pull)
|
|
||||||
compose guix pull -C channels.scm
|
|
||||||
;;
|
|
||||||
shell)
|
|
||||||
compose bash
|
|
||||||
;;
|
|
||||||
image)
|
|
||||||
scm="${1:?usage: $0 image FILE.scm [NAME]}"
|
|
||||||
name="${2:-$(basename "$scm" .scm)}"
|
|
||||||
compose bash -c "
|
|
||||||
set -e
|
|
||||||
# --no-grafts: with --disable-chroot (see docker/entrypoint.sh),
|
|
||||||
# guix-daemon's store-path grafting (security-patch rewriting) hits
|
|
||||||
# a permission error creating output files -- skipping grafts
|
|
||||||
# avoids it entirely and just uses the un-grafted originals.
|
|
||||||
out=\$(guix system docker-image -N --no-grafts -L /workspace '$scm')
|
|
||||||
mkdir -p /workspace/build
|
|
||||||
cp \"\$out\" '/workspace/build/$name.tar.gz'
|
|
||||||
echo \"wrote build/$name.tar.gz\"
|
|
||||||
"
|
|
||||||
;;
|
|
||||||
load-run)
|
|
||||||
scm="${1:?usage: $0 load-run FILE.scm}"
|
|
||||||
name="$(basename "$scm" .scm)"
|
|
||||||
"$0" image "$scm" "$name"
|
|
||||||
image_id="$(docker load -q -i "build/$name.tar.gz" | sed 's/^Loaded image: //')"
|
|
||||||
echo "loaded $image_id, starting container..."
|
|
||||||
docker run --rm -it "$image_id" /run/current-system/profile/bin/bash --login
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
usage
|
|
||||||
exit 1
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
@ -1,62 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
|
|
||||||
setup_bridge() {
|
|
||||||
if [[ $# -lt 1 ]]; then
|
|
||||||
echo "usage: start_bridge internet_interface"
|
|
||||||
else
|
|
||||||
echo "Setting up bridge with internet adapter $1"
|
|
||||||
fi
|
|
||||||
ip link add name virbr0 type bridge
|
|
||||||
ip link set virbr0 up
|
|
||||||
ip addr add 192.168.100.0/24 dev virbr0
|
|
||||||
|
|
||||||
sysctl -w net.ipv4.ip_forward=1
|
|
||||||
nft add table inet nat
|
|
||||||
nft add chain inet nat postrouting '{ type nat hook postrouting priority 100 ; }'
|
|
||||||
nft add rule inet nat postrouting oifname $1 masquerade
|
|
||||||
}
|
|
||||||
|
|
||||||
del_bridge() {
|
|
||||||
echo "Deleting virtual bridge"
|
|
||||||
ip link del virbr0
|
|
||||||
nft delete table inet nat
|
|
||||||
}
|
|
||||||
|
|
||||||
add_interface() {
|
|
||||||
echo "Adding interface $1"
|
|
||||||
ip tuntap add $1 mode tap
|
|
||||||
ip link set $1 master virbr0
|
|
||||||
ip link set $1 up
|
|
||||||
}
|
|
||||||
|
|
||||||
del_interface() {
|
|
||||||
echo "Deleteing inteface $1"
|
|
||||||
ip link set $1 down
|
|
||||||
ip link set $1 nomaster
|
|
||||||
ip tuntap del $1 mode tap
|
|
||||||
}
|
|
||||||
|
|
||||||
if [[ $UID -ne 0 ]]; then
|
|
||||||
echo "Networking script must be run as root user"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
CASE=$1
|
|
||||||
shift
|
|
||||||
case $CASE in
|
|
||||||
start_bridge)
|
|
||||||
setup_bridge $@
|
|
||||||
;;
|
|
||||||
stop_bridge)
|
|
||||||
del_bridge $@
|
|
||||||
;;
|
|
||||||
add_tap)
|
|
||||||
add_interface $@
|
|
||||||
;;
|
|
||||||
del_tap)
|
|
||||||
del_interface $@
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
echo "usage:" $0 "[start_bridge|stop_bridge|add_tap|del_tap] [options]"
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
@ -1,44 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
|
|
||||||
start(){
|
|
||||||
if [[ $# -lt 3 ]]; then
|
|
||||||
echo "usage: start [system].scm [netdev] [macaddr]"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
echo "building $1"
|
|
||||||
export DOMAIN_CAPS=METZNET.CA
|
|
||||||
export DOMAIN_NAME=metznet.ca
|
|
||||||
ro_image=$(guix system image --image-type=qcow2 -L `pwd` $1)
|
|
||||||
if [[ -z ${ro_image} ]]; then
|
|
||||||
echo "failed to build $1..."
|
|
||||||
exit 1
|
|
||||||
else
|
|
||||||
echo "built ${ro_image}"
|
|
||||||
fi
|
|
||||||
image="${1%.*}.qcow2"
|
|
||||||
echo "copying ${ro_image} to ${image} and adding 5G to VM"
|
|
||||||
cp $ro_image $image
|
|
||||||
chmod +w $image
|
|
||||||
qemu-img resize $image +5G
|
|
||||||
echo "starting vm..."
|
|
||||||
qemu-system-x86_64 -enable-kvm -nographic -serial mon:stdio -hda $image -m 1000 -bios $(guix build ovmf)/share/firmware/ovmf_x64.bin -nic tap,ifname=$2,script=no,downscript=no,mac=$3
|
|
||||||
}
|
|
||||||
|
|
||||||
stop(){
|
|
||||||
echo unimplemented
|
|
||||||
}
|
|
||||||
|
|
||||||
case $1 in
|
|
||||||
start)
|
|
||||||
shift
|
|
||||||
start $@
|
|
||||||
;;
|
|
||||||
stop)
|
|
||||||
shift
|
|
||||||
stop $@
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
echo $0 "[start|stop] [system].scm"
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
Loading…
Reference in New Issue