radix/buer.scm

#|Modules|#
(use-modules
 #|GNU  |# (gnu)
           (gnu artwork)
           (gnu services)
 #|Guix |# (guix gexp)
 #|Misc |# (ice-9 match)
 #|Radix|# (radix packages linux)
           (radix services linux)
           (radix system setuid)
           (radix secrets)
           (radix utils)
           ((radix files doas)     #:prefix file:doas-)
           ((radix files thinkfan) #:prefix file:thinkfan-))

(use-system-modules
 #|N|# nss)

(use-service-modules
 #|A|# admin
 #|D|# desktop
 #|M|# mcron
 #|N|# networking
 #|S|# sound sysctl)

(use-package-modules
 #|A|# admin
 #|B|# base
 #|C|# certs compression curl
 #|F|# file
 #|G|# gawk glib guile guile-xyz
 #|L|# less linux
 #|M|# man maths
 #|P|# pulseaudio
 #|S|# shells
 #|T|# texinfo text-editors tmux
 #|V|# vpn)

#|Operating system definition|#
(operating-system
 (host-name "buer")
 (timezone "America/Sao_Paulo")
 (locale "en_US.utf8")

 (keyboard-layout
  (keyboard-layout "us,br"
                   #:options '("grp:menu_switch"
                               "parens:swap_brackets"
                               "caps:swapescape")))

 (bootloader
  (bootloader-configuration
   (bootloader grub-bootloader)
    (targets '("/dev/sda"))
    (theme (grub-theme
            (image (file-append %artwork-repository
                                "/backgrounds/guix-silver-checkered-16-9.svg"))
            (resolution '(1280 . 720))
            (gfxmode '("1280x720x32"))))))

 (kernel-arguments
  (list "modprobe.blacklist=usbmouse,usbkbd"
        "thinkpad_acpi.fan_control=1"
        "loglevel=5"
        "quiet"))

 (file-systems
  (cons* (file-system
          (device (file-system-label "guix-root"))
          (mount-point "/")
          (type "ext4"))
         (file-system
          (device (file-system-label "home"))
          (mount-point "/home")
          (type "ext4"))
         %base-file-systems))

 (swap-devices
  (list (swap-space
         (target (file-system-label "swap")))))

 (users
  (cons* (user-account
          (name "radio")
          (password %radio-password)
          (home-directory "/home/radio")
          (shell (file-append dash "/bin/dash"))
          (uid 1000)
          (group "users")
          (supplementary-groups `("audio" "input" "video" "wheel")))
         (user-account
          (name "root")
          (password %root-password)
          (system? #t)
          (home-directory "/root")
          (uid 0)
          (group "root")
          (shell (file-append dash "/bin/dash")))
         %base-user-accounts))

 #|System level packages|#
 (packages
  (list #|admin       |# htop inetutils isc-dhcp opendoas shadow
        #|base        |# coreutils diffutils findutils grep patch sed tar which
        #|certs       |# nss-certs
        #|compression |# bzip2 gzip lzip unzip xz zstd
        #|curl        |# curl
        #|gawk        |# gawk
        #|guile       |# guile-3.0-latest guile-colorized guile-readline
        #|less        |# less
        #|linux       |# alsa-lib alsa-plugins alsa-utils e2fsprogs eudev fuse
                         inotify-tools iproute kbd kmod lm-sensors procps psmisc
                         thinkfan-next util-linux
        #|man         |# man-db mandoc man-pages
        #|math        |# libqalculate
        #|pulseaudio  |# pulseaudio
        #|shells      |# dash
        #|texinfo     |# info-reader
        #|text-editors|# kakoune
        #|tmux        |# tmux
        #|vpn         |# wireguard-tools))

 #|Do not generate a sudoers file|#
 (sudoers-file #f)

 #|Run some programs from each package with file owner privileges|#
 (setuid-programs
  (map-setuid-programs
   (shadow     '("passwd" "chfn" "sg" "su" "newgrp" "newuidmap" "newgidmap"))
   (inetutils  '("ping" "ping6"))
   (opendoas   '("doas"))
   (fuse       '("fusermount"))
   (util-linux '("mount" "umount"))))
 
 #|Allow resolution of '.local' host names with mDNS|#
 (name-service-switch %mdns-host-lookup-nss)

 #|System services|#
 (services
  (list #|TTY services|#
        (service virtual-terminal-service-type)
        (service console-font-service-type
                 (associate-right
                  (%default-console-font '("tty1" "tty2"))))
        (service agetty-service-type
                 (agetty-configuration
                  (extra-options '("-L"))
                  (term "vt100")
                  (tty #f)))
        (service mingetty-service-type
                 (mingetty-configuration (tty "tty1")))
        (service mingetty-service-type
                 (mingetty-configuration (tty "tty2")))

        #|Login services|#
        (service login-service-type)
        (service elogind-service-type)

        #|Log services|#
        (service rottlog-service-type)
        (service syslog-service-type
                 (syslog-configuration
                  (syslogd (file-append inetutils "/libexec/syslogd"))
                  (config-file %default-syslog.conf)))
        (service log-cleanup-service-type
                 (log-cleanup-configuration
                  (directory "/var/log/guix/drvs")
                  (expiry (* 3 30 24 3600))))

        #|Guix services|#
        (service guix-service-type
                 (guix-configuration
                  (build-accounts 16)
                  (extra-options '("--max-jobs=8" "--cores=4"))))

        #|Mcron service|#
        (simple-service 'mcron-jobs mcron-service-type
                        (list #~(job "5 0 * * *"
                                     "guix gc --optimize -F 5G")))

        #|Device management services|#
        (service udev-service-type
                 (udev-configuration
                  (udev eudev)
                  (rules (list lvm2 fuse alsa-utils crda))))

        #|Sound services|#
        (service alsa-service-type)

        #|Network services|#
        (service static-networking-service-type
                 (list (static-networking
                        (addresses
                         (list (network-address
                                (device "lo")
                                (value "127.0.0.1/8"))))
                        (provision '(loopback)))))
        (service wpa-supplicant-service-type
                 (wpa-supplicant-configuration
                  (config-file "/etc/wpa_supplicant.conf")
                  (interface "wlp2s0")
                  (extra-options '("-B"))))
        (service dhcp-client-service-type
                 (dhcp-client-configuration
                  (interfaces 'all)))

        #|Thinkfan services|#
        (simple-service 'thinkfan-config etc-service-type
                        `(("modprobe.d/thinkfan.conf" ,file:thinkfan-modprobe-config)
                          ("thinkfan.conf"            ,file:thinkfan-config)))
        (service thinkfan-service-type
                 (thinkfan-configuration
                  (config-file file:thinkfan-config)
                  (respawn? #f)))

        #|Doas config service|#
        (simple-service 'doas-config etc-service-type
                        `(("doas.conf" ,file:doas-config)))

        #|Special file services|#
        (service special-files-service-type
                 `(("/bin/sh"      ,(file-append dash      "/bin/dash"))
                   ("/usr/bin/env" ,(file-append coreutils "/bin/env"))))

        #|Miscellaneous services|#
        (service urandom-seed-service-type)
        (service nscd-service-type)
        (service sysctl-service-type
                 (sysctl-configuration
                  (sysctl (file-append procps "/sbin/sysctl"))
                  (settings '(("fs.protected_hardlinks" . "1")
                              ("fs.protected_symlinks"  . "1"))))))))