modules/ryan-config/base-system.scm
7f01041b1889962b65f761b68b13e60f680cf7bf
· 12.9 KB · 300 lines
raw
| 1 | (define-module (ryan-config base-system) |
| 2 | #:use-module (gnu) |
| 3 | #:use-module (nongnu packages linux) |
| 4 | #:use-module (gnu system setuid) |
| 5 | #:use-module (gnu packages admin) |
| 6 | #:use-module (gnu packages avahi) |
| 7 | #:use-module (gnu packages gnome) |
| 8 | #:use-module (gnu packages wm) |
| 9 | #:use-module (guix packages) |
| 10 | #:use-module (gnu packages shells) |
| 11 | #:use-module (guix build-system trivial) |
| 12 | #:use-module (guix licenses) |
| 13 | #:use-module (gnu packages tls) |
| 14 | #:use-module (gnu packages spice) |
| 15 | #:use-module (srfi srfi-1) |
| 16 | #:use-module (ryan-packages freedesktop) |
| 17 | ;#:use-module (ryan-packages hyprland) |
| 18 | #:use-module (ryan-packages wm) |
| 19 | #:use-module (ryan-packages virtualization) |
| 20 | #:use-module (ryan-packages linux) |
| 21 | #:use-module (ryan-packages networking) |
| 22 | #:use-module (ryan-packages package-management) |
| 23 | #:use-module (rosenthal services networking) |
| 24 | #:use-module (gnu packages security-token) |
| 25 | #:use-module (gnu services security-token) |
| 26 | #:use-module (gnu services cups) |
| 27 | #:use-module (gnu services desktop) |
| 28 | #:use-module (gnu services networking) |
| 29 | #:use-module (gnu services xorg) |
| 30 | #:use-module (gnu services ssh) |
| 31 | #:use-module (ryan-services nix) |
| 32 | #:use-module (ryan-services networking) |
| 33 | #:use-module (gnu services sound) |
| 34 | #:use-module (gnu services docker) |
| 35 | #:use-module (gnu services avahi) |
| 36 | #:use-module (gnu services dbus) |
| 37 | #:use-module (gnu services virtualization)) |
| 38 | |
| 39 | ; Define package that installs my root ca public keys |
| 40 | (define my-ca-certs |
| 41 | (package |
| 42 | (name "my-ca-certs") |
| 43 | (version "1") |
| 44 | (source (local-file "./CACerts" |
| 45 | #:recursive? #t)) |
| 46 | (build-system trivial-build-system) |
| 47 | (license mpl2.0) |
| 48 | (home-page "https://rschanz.org") |
| 49 | (arguments |
| 50 | `(#:modules |
| 51 | ((guix build utils)) |
| 52 | #:builder |
| 53 | (begin |
| 54 | (use-modules (guix build utils) |
| 55 | (srfi srfi-1) |
| 56 | (srfi srfi-26) |
| 57 | (ice-9 ftw)) |
| 58 | (let* ((ca-certificates (assoc-ref %build-inputs "source")) |
| 59 | (crt-suffix ".crt") |
| 60 | (is-certificate? (cut string-suffix? crt-suffix <>)) |
| 61 | (certificates (filter is-certificate? |
| 62 | (scandir ca-certificates))) |
| 63 | (out (assoc-ref %outputs "out")) |
| 64 | (certificate-directory (string-append out "/etc/ssl/certs")) |
| 65 | (openssl (string-append (assoc-ref %build-inputs "openssl") "/bin/openssl"))) |
| 66 | (mkdir-p certificate-directory) |
| 67 | (for-each |
| 68 | (lambda (cert) |
| 69 | (invoke |
| 70 | openssl "x509" |
| 71 | "-in" (string-append ca-certificates "/" cert) |
| 72 | "-outform" "PEM" |
| 73 | "-out" (string-append certificate-directory "/" cert ".pem"))) |
| 74 | certificates) |
| 75 | #t)))) |
| 76 | (native-inputs |
| 77 | (list openssl)) |
| 78 | (synopsis "My CA Certs") |
| 79 | (description synopsis))) |
| 80 | |
| 81 | ; Re-define the base packages to remove sudo |
| 82 | (define %my-base-packages |
| 83 | (remove (lambda (package) |
| 84 | (member (package-name package) |
| 85 | (list "sudo" "nano"))) |
| 86 | %base-packages )) |
| 87 | |
| 88 | (define %backlight-udev-rule |
| 89 | (udev-rule |
| 90 | "90-backlight.rules" |
| 91 | (string-append "ACTION==\"add\", SUBSYSTEM==\"backlight\", " |
| 92 | "RUN+=\"/run/current-system/profile/bin/chgrp video /sys/class/backlight/%k/brightness\"" |
| 93 | "\n" |
| 94 | "ACTION==\"add\", SUBSYSTEM==\"backlight\", " |
| 95 | "RUN+=\"/run/current-system/profile/bin/chmod g+w /sys/class/backlight/%k/brightness\""))) |
| 96 | |
| 97 | (define %flipper-udev-rule |
| 98 | (udev-rule |
| 99 | "42-flipperzero.rules" |
| 100 | (string-append "SUBSYSTEMS==\"usb\", ATTRS{idVendor}==\"0483\", ATTRS{idProduct}==\"5740\", ATTRS{manufacturer}==\"Flipper Devices Inc.\", TAG+=\"uaccess\"" |
| 101 | "\n" |
| 102 | "SUBSYSTEMS==\"usb\", ATTRS{idVendor}==\"0483\", ATTRS{idProduct}==\"df11\", ATTRS{manufacturer}==\"STMicroelectronics\", TAG+=\"uaccess\"" |
| 103 | "\n" |
| 104 | "SUBSYSTEMS==\"usb\", ATTRS{idVendor}==\"303a\", ATTRS{idProduct}==\"40??\", ATTRS{manufacturer}==\"Flipper Devices Inc.\", TAG+=\"uaccess\""))) |
| 105 | |
| 106 | (define-public base-operating-system |
| 107 | (operating-system |
| 108 | (kernel linux) |
| 109 | (firmware (list linux-firmware)) |
| 110 | (locale "en_US.utf8") |
| 111 | (timezone "America/New_York") |
| 112 | (keyboard-layout (keyboard-layout "us")) |
| 113 | (host-name "ThisWillChange") |
| 114 | |
| 115 | ;; The list of user accounts ('root' is implicit). |
| 116 | (users (cons* (user-account |
| 117 | (name "ryan") |
| 118 | (comment "Ryan") |
| 119 | (group "users") |
| 120 | ;(shell (file-append zsh "/bin/zsh")) |
| 121 | (home-directory "/home/ryan") |
| 122 | (supplementary-groups '("wheel" "netdev" "audio" "video" "lp" "plugdev" "docker" "libvirt" "kvm" "dialout"))) |
| 123 | %base-user-accounts)) |
| 124 | |
| 125 | ;; Packages installed system-wide. Users can also install packages |
| 126 | ;; under their own account: use 'guix search KEYWORD' to search |
| 127 | ;; for packages and 'guix install PACKAGE' to install a package. |
| 128 | (packages (append (map specification->package (list "sway" |
| 129 | ;"hyprland" |
| 130 | "swaybg" |
| 131 | ;"swayidle" |
| 132 | ;"swaylock-effects" |
| 133 | "fuzzel" |
| 134 | "foot" |
| 135 | "linux-pam" ; installed directly to get libs in profile directly |
| 136 | "pinentry-qt" |
| 137 | "adwaita-icon-theme" |
| 138 | "hicolor-icon-theme" |
| 139 | "git" |
| 140 | "waybar-experimental" |
| 141 | "gnupg" |
| 142 | "light" |
| 143 | "avahi" |
| 144 | "mako" |
| 145 | "grim" |
| 146 | "grimblast" |
| 147 | "slurp" |
| 148 | "wl-clipboard" |
| 149 | ;"bluez" |
| 150 | ;"blueman" |
| 151 | "ldacbt" |
| 152 | "libfreeaptx" |
| 153 | "libfdk" |
| 154 | "opendoas" |
| 155 | ;"xdg-desktop-portal-wlr" |
| 156 | ;"xdg-desktop-portal" |
| 157 | ;"xdg-desktop-portal-gtk" |
| 158 | "v4l2loopback-linux-module" |
| 159 | "pipewire" |
| 160 | "docker" |
| 161 | ;"libvirt" ;New version inherited from service |
| 162 | ;"virt-manager" |
| 163 | "dconf" |
| 164 | "wireplumber" |
| 165 | "wireshark" |
| 166 | ;"openconnect" |
| 167 | ;"openconnect-sso" |
| 168 | "webkitgtk-with-libsoup2" ; Needed for Go wails development |
| 169 | "zsh")) |
| 170 | (list my-ca-certs virt-manager-ovmf bluez-ryan netbird-bin neovim-ryan) |
| 171 | %my-base-packages )) |
| 172 | |
| 173 | ;; Below is the list of system services. To search for available |
| 174 | ;; services, run 'guix system search KEYWORD' in a terminal. |
| 175 | (services |
| 176 | (append (list |
| 177 | |
| 178 | ;; To configure OpenSSH, pass an 'openssh-configuration' |
| 179 | ;; record as a second argument to 'service' below. |
| 180 | (service openssh-service-type) |
| 181 | (service pcscd-service-type) |
| 182 | (service cups-service-type |
| 183 | (cups-configuration |
| 184 | (web-interface? #t))) |
| 185 | ;; Avahi is only present for CUPS to support "automagic" printing |
| 186 | (service avahi-service-type |
| 187 | (avahi-configuration |
| 188 | (publish? #f) ;; do not advertise this machine |
| 189 | (publish-workstation? #f))) ;; do not advertise, I want this to be as silent as possible |
| 190 | (service docker-service-type) |
| 191 | ; Tailscale daemon from rosenthal |
| 192 | (service tailscale-service-type |
| 193 | (tailscale-configuration |
| 194 | (socket "/var/run/tailscale/tailscaled.sock"))) |
| 195 | (service netbird-service-type) |
| 196 | (service containerd-service-type) |
| 197 | (service nix-service-type |
| 198 | (nix-configuration |
| 199 | (package nix-ryan))) |
| 200 | (simple-service 'hyprlock-pam pam-root-service-type |
| 201 | (list |
| 202 | (pam-service |
| 203 | (name "hyprlock") |
| 204 | (auth |
| 205 | (list |
| 206 | (pam-entry (control "include") |
| 207 | (module "login"))))))) |
| 208 | (service libvirt-service-type |
| 209 | (libvirt-configuration |
| 210 | (libvirt libvirt-ovmf) |
| 211 | (unix-sock-group "libvirt"))) |
| 212 | (service virtlog-service-type) |
| 213 | ;(service screen-locker-service-type |
| 214 | ; (screen-locker-configuration |
| 215 | ; (name "hyprlock") |
| 216 | ; (program (file-append swaylock "/bin/swaylock")) |
| 217 | ; (using-pam? #t))) |
| 218 | (simple-service 'spice-polkit polkit-service-type (list spice-gtk)) |
| 219 | (simple-service 'hwdb-creation etc-service-type (list `("udev-here-oneoneone" ,(plain-file "issue" "test\n")))) |
| 220 | (service bluetooth-service-type |
| 221 | (bluetooth-configuration |
| 222 | (bluez bluez-ryan) |
| 223 | (experimental #t) |
| 224 | (fast-connectable? #t))) |
| 225 | (udev-rules-service 'fido2 libfido2 #:groups '("plugdev"))) |
| 226 | |
| 227 | ;; This is the default list of services we |
| 228 | ;; are appending to. |
| 229 | (modify-services %desktop-services |
| 230 | (guix-service-type config => |
| 231 | (guix-configuration |
| 232 | (inherit config) |
| 233 | (substitute-urls |
| 234 | (append (list "https://nonguix-proxy.ditigal.xyz/") |
| 235 | %default-substitute-urls)) |
| 236 | (authorized-keys |
| 237 | (cons* (plain-file "non-guix.pub" |
| 238 | "(public-key |
| 239 | (ecc |
| 240 | (curve Ed25519) |
| 241 | (q #C1FD53E5D4CE971933EC50C9F307AE2171A2D3B52C804642A7A35F84F3A4EA98#) |
| 242 | ) |
| 243 | )" ) %default-authorized-guix-keys)))) |
| 244 | (udev-service-type config => |
| 245 | (udev-configuration |
| 246 | (inherit config) |
| 247 | (rules (cons* %backlight-udev-rule |
| 248 | %flipper-udev-rule |
| 249 | (udev-configuration-rules config))))) |
| 250 | (elogind-service-type config => |
| 251 | (elogind-configuration |
| 252 | (inherit config) |
| 253 | (handle-power-key `ignore) |
| 254 | (handle-suspend-key `ignore) |
| 255 | (handle-hibernate-key 'ignore) |
| 256 | (handle-lid-switch `ignore) |
| 257 | (handle-lid-switch-docked 'ignore) |
| 258 | (handle-lid-switch-external-power 'ignore) |
| 259 | (kill-user-processes? #t))) |
| 260 | (network-manager-service-type config => |
| 261 | (network-manager-configuration |
| 262 | (inherit config) |
| 263 | (vpn-plugins |
| 264 | (list network-manager-openconnect)))) |
| 265 | (delete pulseaudio-service-type) |
| 266 | (delete gdm-service-type) |
| 267 | (delete avahi-service-type) |
| 268 | ;(delete xorg-server-service-type) |
| 269 | (delete alsa-service-type) ))) |
| 270 | (name-service-switch %mdns-host-lookup-nss) ;; Enable .local lookup |
| 271 | (setuid-programs |
| 272 | (append (list ;(file-like->setuid-program |
| 273 | ;(file-append |
| 274 | ;(specification->package "swaylock-effects") |
| 275 | ; swaylock-effects-new |
| 276 | ; "/bin/swaylock")) |
| 277 | (file-like->setuid-program |
| 278 | (file-append |
| 279 | (specification->package "wireshark") |
| 280 | "/bin/dumpcap")) |
| 281 | (file-like->setuid-program |
| 282 | (file-append |
| 283 | (specification->package "spice-gtk") |
| 284 | "/libexec/spice-client-glib-usb-acl-helper")) |
| 285 | (file-like->setuid-program |
| 286 | (file-append |
| 287 | (specification->package "opendoas") |
| 288 | "/bin/doas"))) |
| 289 | (delete sudo %setuid-programs))) |
| 290 | (file-systems (cons* |
| 291 | (file-system |
| 292 | (mount-point "/tmp") |
| 293 | (device "none") |
| 294 | (type "tmpfs") |
| 295 | (check? #f)) |
| 296 | %base-file-systems)) |
| 297 | (bootloader (bootloader-configuration |
| 298 | (bootloader grub-efi-bootloader) |
| 299 | (targets (list "/boot/efi")) |
| 300 | (keyboard-layout keyboard-layout))))) |