system.scm
b081473eaa08537dee157d6810de49ca71adf0e1
· 9.5 KB · 223 lines
raw
| 1 | ;; This is an operating system configuration generated |
| 2 | ;; by the graphical installer. |
| 3 | ;; |
| 4 | ;; Once installation is complete, you can learn and modify |
| 5 | ;; this file to tweak the system configuration, and pass it |
| 6 | ;; to the 'guix system reconfigure' command to effect your |
| 7 | ;; changes. |
| 8 | |
| 9 | |
| 10 | ;; Indicate which modules to import to access the variables |
| 11 | ;; used in this configuration. |
| 12 | (use-modules (gnu) (nongnu packages linux)) |
| 13 | (use-modules (gnu system setuid)) |
| 14 | (use-modules (gnu packages admin)) |
| 15 | (use-modules (guix packages)) |
| 16 | (use-modules (gnu services authentication)) |
| 17 | (use-modules (gnu packages shells)) |
| 18 | (use-modules (gnu packages perl)) |
| 19 | (use-modules (guix build-system trivial)) |
| 20 | (use-modules (guix licenses)) |
| 21 | (use-modules (srfi srfi-1)) |
| 22 | (use-package-modules security-token) |
| 23 | (use-service-modules cups desktop networking ssh xorg sound security-token docker) |
| 24 | |
| 25 | ; Define package that installs my root ca public keys |
| 26 | (define my-ca-certs |
| 27 | (package |
| 28 | (name "my-ca-certs") |
| 29 | (version "1") |
| 30 | (source (local-file "./CACerts/" |
| 31 | #:recursive? #t)) |
| 32 | (home-page "https://rschanz.org") |
| 33 | (license agpl3+) |
| 34 | (build-system trivial-build-system) |
| 35 | (arguments |
| 36 | `(#:modules |
| 37 | ((guix build utils)) |
| 38 | #:builder |
| 39 | (begin |
| 40 | (use-modules (guix build utils) |
| 41 | (srfi srfi-1) |
| 42 | (srfi srfi-26) |
| 43 | (ice-9 ftw)) |
| 44 | (let* ((ca-certificates (assoc-ref %build-inputs "source")) |
| 45 | (crt-suffix ".crt") |
| 46 | (is-certificate? (cut string-suffix? crt-suffix <>)) |
| 47 | (certificates (filter is-certificate? |
| 48 | (scandir ca-certificates))) |
| 49 | (out (assoc-ref %outputs "out")) |
| 50 | (certificate-directory (string-append out |
| 51 | "/etc/ssl/certs")) |
| 52 | (openssl (string-append (assoc-ref %build-inputs |
| 53 | "openssl") |
| 54 | "/bin/openssl"))) |
| 55 | (mkdir-p certificate-directory) |
| 56 | ;; When this package is installed into a profile, any files in the |
| 57 | ;; package output's etc/ssl/certs directory ending in ".pem" will |
| 58 | ;; also be put into a ca-certificates.crt bundle. In the case of a |
| 59 | ;; system profile, this bundle will be made available to the system |
| 60 | ;; at activation time. See the profile hooks defined in (guix |
| 61 | ;; profiles) and the etc-service-type define in (gnu services) for |
| 62 | ;; details. |
| 63 | (for-each |
| 64 | ;; Ensure the certificate is in an appropriate format. |
| 65 | (lambda (certificate) |
| 66 | (invoke |
| 67 | openssl "x509" |
| 68 | "-in" (string-append ca-certificates "/" certificate) |
| 69 | "-outform" "PEM" |
| 70 | "-out" (string-append |
| 71 | certificate-directory "/" |
| 72 | (basename certificate crt-suffix) ".pem"))) |
| 73 | certificates) |
| 74 | #t)))) |
| 75 | (inputs |
| 76 | (list openssl)) |
| 77 | (synopsis "My certificate authority certificates") |
| 78 | (description synopsis))) |
| 79 | |
| 80 | ; Re-define the base packages to remove sudo |
| 81 | (define %my-base-packages |
| 82 | (remove (lambda (package) |
| 83 | (member (package-name package) |
| 84 | (list "sudo" "nano"))) |
| 85 | %base-packages )) |
| 86 | |
| 87 | (define %backlight-udev-rule |
| 88 | (udev-rule |
| 89 | "90-backlight.rules" |
| 90 | (string-append "ACTION==\"add\", SUBSYSTEM==\"backlight\", " |
| 91 | "RUN+=\"/run/current-system/profile/bin/chgrp video /sys/class/backlight/%k/brightness\"" |
| 92 | "\n" |
| 93 | "ACTION==\"add\", SUBSYSTEM==\"backlight\", " |
| 94 | "RUN+=\"/run/current-system/profile/bin/chmod g+w /sys/class/backlight/%k/brightness\""))) |
| 95 | |
| 96 | (operating-system |
| 97 | (kernel linux) |
| 98 | (firmware (list linux-firmware)) |
| 99 | (locale "en_US.utf8") |
| 100 | (timezone "America/New_York") |
| 101 | (keyboard-layout (keyboard-layout "us")) |
| 102 | (host-name "RyanThinkpad") |
| 103 | |
| 104 | ;; The list of user accounts ('root' is implicit). |
| 105 | (users (cons* (user-account |
| 106 | (name "ryan") |
| 107 | (comment "Ryan") |
| 108 | (group "users") |
| 109 | ;(shell (file-append zsh "/bin/zsh")) |
| 110 | (home-directory "/home/ryan") |
| 111 | (supplementary-groups '("wheel" "netdev" "audio" "video" "lp" "plugdev" "docker"))) |
| 112 | %base-user-accounts)) |
| 113 | |
| 114 | ;; Packages installed system-wide. Users can also install packages |
| 115 | ;; under their own account: use 'guix search KEYWORD' to search |
| 116 | ;; for packages and 'guix install PACKAGE' to install a package. |
| 117 | (packages (append (map specification->package (list "sway" |
| 118 | "swaybg" |
| 119 | "swayidle" |
| 120 | "swaylock-effects" |
| 121 | "fuzzel" |
| 122 | "alacritty" |
| 123 | "pinentry-qt" |
| 124 | "adwaita-icon-theme" |
| 125 | "hicolor-icon-theme" |
| 126 | "git" |
| 127 | "nss-certs" |
| 128 | "waybar" |
| 129 | "gnupg" |
| 130 | "light" |
| 131 | "mako" |
| 132 | "grim" |
| 133 | "slurp" |
| 134 | "wl-clipboard" |
| 135 | "bluez" |
| 136 | "blueman" |
| 137 | "opendoas" |
| 138 | "xdg-desktop-portal-wlr" |
| 139 | "xdg-desktop-portal" |
| 140 | "pipewire" |
| 141 | "fprintd" |
| 142 | "docker" |
| 143 | "wireplumber" |
| 144 | "zsh")) |
| 145 | (list my-ca-certs) |
| 146 | %my-base-packages )) |
| 147 | |
| 148 | ;; Below is the list of system services. To search for available |
| 149 | ;; services, run 'guix system search KEYWORD' in a terminal. |
| 150 | (services |
| 151 | (append (list |
| 152 | |
| 153 | ;; To configure OpenSSH, pass an 'openssh-configuration' |
| 154 | ;; record as a second argument to 'service' below. |
| 155 | (service openssh-service-type) |
| 156 | (service pcscd-service-type) |
| 157 | (service fprintd-service-type) |
| 158 | (service docker-service-type) |
| 159 | (service bluetooth-service-type) |
| 160 | (udev-rules-service 'fido2 libfido2 #:groups '("plugdev")) |
| 161 | (set-xorg-configuration |
| 162 | (xorg-configuration (keyboard-layout keyboard-layout)))) |
| 163 | |
| 164 | ;; This is the default list of services we |
| 165 | ;; are appending to. |
| 166 | (modify-services %desktop-services |
| 167 | (guix-service-type config => |
| 168 | (guix-configuration |
| 169 | (inherit config) |
| 170 | (substitute-urls |
| 171 | (append (list "https://substitutes.nonguix.org") |
| 172 | %default-substitute-urls)) |
| 173 | (authorized-keys |
| 174 | (cons* (plain-file "non-guix.pub" |
| 175 | "(public-key |
| 176 | (ecc |
| 177 | (curve Ed25519) |
| 178 | (q #C1FD53E5D4CE971933EC50C9F307AE2171A2D3B52C804642A7A35F84F3A4EA98#) |
| 179 | ) |
| 180 | )" ) %default-authorized-guix-keys)))) |
| 181 | (udev-service-type config => |
| 182 | (udev-configuration |
| 183 | (inherit config) |
| 184 | (rules (cons %backlight-udev-rule |
| 185 | (udev-configuration-rules config))))) |
| 186 | (delete pulseaudio-service-type) |
| 187 | (delete gdm-service-type) ))) |
| 188 | (setuid-programs |
| 189 | (append (list (file-like->setuid-program |
| 190 | (file-append |
| 191 | (specification->package "swaylock-effects") |
| 192 | "/bin/swaylock")) |
| 193 | (file-like->setuid-program |
| 194 | (file-append |
| 195 | (specification->package "opendoas") |
| 196 | "/bin/doas"))) |
| 197 | (delete sudo %setuid-programs))) |
| 198 | (bootloader (bootloader-configuration |
| 199 | (bootloader grub-efi-bootloader) |
| 200 | (targets (list "/boot/efi")) |
| 201 | (keyboard-layout keyboard-layout))) |
| 202 | (mapped-devices (list (mapped-device |
| 203 | (source (uuid |
| 204 | "adcaf322-7ee5-48ec-abf6-4a9b10643878")) |
| 205 | (target "sysroot") |
| 206 | (type luks-device-mapping)))) |
| 207 | |
| 208 | ;; The list of file systems that get "mounted". The unique |
| 209 | ;; file system identifiers there ("UUIDs") can be obtained |
| 210 | ;; by running 'blkid' in a terminal. |
| 211 | (file-systems (cons* (file-system |
| 212 | (mount-point "/") |
| 213 | (device "/dev/mapper/sysroot") |
| 214 | (type "ext4") |
| 215 | (dependencies mapped-devices)) |
| 216 | (file-system |
| 217 | (mount-point "/boot/efi") |
| 218 | (device (uuid "DFE8-32EF" |
| 219 | 'fat32)) |
| 220 | (type "vfat")) %base-file-systems)) |
| 221 | (swap-devices |
| 222 | (list |
| 223 | (swap-space (target (uuid "7e1bb7c5-da2a-4509-8263-f707fc752993"))) ))) |