(define-module (operating-systems buer)
  #|GNU|#
  #:use-module (gnu)
  #:use-module ((gnu system) #:select (operating-system)
                             #:prefix gnu:)

  #|GNU packages|#
  #|A|# #:use-module (gnu packages admin)
        #:use-module (gnu packages android)
  #|B|# #:use-module (gnu packages base)
  #|C|# #:use-module (gnu packages certs)
        #:use-module (gnu packages compression)
  #|G|# #:use-module (gnu packages gawk)
        #:use-module (gnu packages guile)
        #:use-module (gnu packages guile-xyz)
  #|L|# #:use-module (gnu packages less)
        #:use-module (gnu packages linux)
  #|M|# #:use-module (gnu packages man)
  #|T|# #:use-module (gnu packages texinfo)
        #:use-module (gnu packages text-editors)
  #|V|# #:use-module (gnu packages vpn)

  #|GNU services|#
  #|A|# #:use-module (gnu services admin)
        #:use-module (gnu services avahi)
  #|D|# #:use-module (gnu services dbus)
        #:use-module (gnu services desktop)
  #|M|# #:use-module (gnu services mcron)
  #|N|# #:use-module (gnu services linux)
        #:use-module (gnu services networking)
  #|P|# #:use-module (gnu services pm)
  #|S|# #:use-module (gnu services sound)
        #:use-module (gnu services sysctl)

  #|Guix|#
  #:use-module (guix)

  #|Radix|#
  #:use-module (radix artwork)
  #:use-module (radix secrets)
  #:use-module (radix utils)

  #|Radix packages|#
  #|A|# #:use-module (radix packages admin)
  #|L|# #:use-module (radix packages linux)
  #|S|# #:use-module (radix packages shells)

  #|Radix services|#
  #|A|# #:use-module (radix services admin)
  #|P|# #:use-module (radix services pm)

  #|Radix system|#
  #|S|# #:use-module (radix system security)
        #:use-module (radix system setuid)

  #|M|# #:use-module (radix system monitoring)

  #|Buer files|#
  #|S|# #:use-module ((buer files substitute-keys) #:prefix public-key:)
  #|T|# #:use-module ((buer files thinkfan)        #:prefix file:thinkfan-)

  #|SRFI's|#
  #:use-module (srfi srfi-1)

  #:export (operating-system))

(define operating-system
  (gnu:operating-system
   (host-name "buer")
   (timezone "America/Sao_Paulo")
   (locale "en_US.utf8")

   (keyboard-layout
    (keyboard-layout "us,br"
                     #:options `("grp:menu_switch"
                                 "parens:swap_brackets"
                                 "caps:swapescape")))

   (bootloader
    (bootloader-configuration
     (bootloader grub-bootloader)
     (targets `("/dev/sda"))
     (timeout 1)
     (theme (grub-theme
             (image (file-append %artwork-repository
                                 "/backgrounds/guix-silver-16-9.svg"))
             (gfxmode `("1280x720x32"))))))

   (kernel linux-libre-6.7)
   (kernel-arguments
    (cons* "modprobe.blacklist=usbmouse,usbkbd,pcspkr"
           "thinkpad_acpi.fan_control=1"
           (kicksecure-delete "debugfs"
                              %kicksecure-kernel-arguments)))

   (file-systems
    (cons* (file-system
            (device (file-system-label "guix-root"))
            (mount-point "/")
            (type "ext4"))
           (file-system
            (device (file-system-label "home"))
            (mount-point "/home")
            (type "ext4"))
           %base-file-systems))

   (users
    (cons* (user-account
            (name "radio")
            (password %radio-password)
            (home-directory "/home/radio")
            (shell (file-append dash-next "/bin/dash"))
            (uid 1000)
            (group "users")
            (supplementary-groups `("audio" "adbusers" "video" "wheel")))
           (user-account
            (name "root")
            (password %root-password)
            (system? #t)
            (home-directory "/root")
            (uid 0)
            (group "root")
            (shell (file-append dash-next "/bin/dash")))
           %base-user-accounts))

   (groups
    (cons* (user-group
             (name "adbusers"))
           %base-groups))

   #|System level packages|#
   (packages
    (list #|admin       |# btop inetutils isc-dhcp opendoas shadow zzz
          #|base        |# coreutils diffutils findutils grep patch sed tar which
          #|certs       |# nss-certs
          #|compression |# bzip2 gzip lzip unzip xz zstd
          #|gawk        |# gawk
          #|guile       |# guile-next guile-colorized guile-readline
          #|less        |# less
          #|linux       |# e2fsprogs eudev iproute kmod procps psmisc util-linux
          #|man         |# man-db mandoc man-pages
          #|shells      |# dash-next
          #|texinfo     |# info-reader
          #|text-editors|# kakoune
          #|vpn         |# wireguard-tools))

   #|Do not generate a sudoers file|#
   (sudoers-file #f)

   #|Run some programs from each package with file owner privileges|#
   (setuid-programs
    (map-setuid-programs
      (shadow     `("passwd" "chfn" "sg" "su" "newgrp" "newuidmap" "newgidmap"))
      (inetutils  `("ping" "ping6"))
      (opendoas   `("doas"))
      (fuse-2     `("fusermount"))
      (fuse       `("fusermount3"))
      (util-linux `("mount" "umount"))))

   #|Allow resolution of '.local' host names with mDNS|#
   (name-service-switch %mdns-host-lookup-nss)

   #|System services|#
   (services
    (list #|TTY services|#
          (service virtual-terminal-service-type)
          (service console-font-service-type
                   (associate-right
                    (%default-console-font `("tty1" "tty2"))))
          (service agetty-service-type
                   (agetty-configuration
                    (extra-options `("-L"))
                    (term "vt100")
                    (tty #f)))
          (service mingetty-service-type
                   (mingetty-configuration (tty "tty1")))
          (service mingetty-service-type
                   (mingetty-configuration (tty "tty2")))

          #|Login services|#
          (service login-service-type)
          (service elogind-service-type)

          #|Log services|#
          (service rottlog-service-type)
          (service syslog-service-type
                   (syslog-configuration
                    (syslogd (file-append inetutils "/libexec/syslogd"))
                    (config-file %default-syslog.conf)))
          (service log-cleanup-service-type
                   (log-cleanup-configuration
                    (directory "/var/log/guix/drvs")
                    (expiry (* 3 30 24 3600))))

          #|IPC services|#
          (service dbus-root-service-type)

          #|Avahi service|#
          (service avahi-service-type
                   (avahi-configuration
                    (wide-area? #t)))

          #|Guix services|#
          (service guix-service-type
                   (guix-configuration
                    (discover? #t)
                    (build-accounts 16)
                    (authorized-keys
                     (cons* public-key:yuria
                            %default-authorized-guix-keys))
                    (extra-options `("--max-jobs=8" "--cores=4"))))
          (service guix-publish-service-type
                   (guix-publish-configuration
                    (port 8080)
                    (host "0.0.0.0")
                    (advertise? #t)
                    (compression `(("zstd" 3)))))

          #|Mcron service|#
          (service mcron-service-type
                   (mcron-configuration
                    (jobs (list #~(job "5 0 * * *"
                                       "guix gc --optimize --free-space=5G")))))

          #|Device management services|#
          (service udev-service-type
                   (udev-configuration
                    (udev eudev)
                    (rules (list alsa-utils
                                 android-udev-rules
                                 crda
                                 fuse
                                 lvm2))))

          #|Network services|#
          (service static-networking-service-type
                   (list (static-networking
                          (addresses
                           (list (network-address
                                  (device "lo")
                                  (value "127.0.0.1/8"))))
                          (provision '(loopback)))))
          (service ntp-service-type)
          (service wpa-supplicant-service-type
                   (wpa-supplicant-configuration
                    (config-file "/etc/wpa_supplicant.conf")
                    (interface "wlp2s0")
                    (extra-options `("-B"))))
          (service dhcp-client-service-type
                   (dhcp-client-configuration
                    (interfaces 'all)))
          (service tor-service-type)

          #|Power management services|#
          (service tlp-service-type
                   (tlp-configuration
                    (cpu-scaling-governor-on-ac  `("performance"))
                    (cpu-scaling-governor-on-bat `("powersave"))
                    (cpu-scaling-min-freq-on-ac  1500000)
                    (cpu-scaling-max-freq-on-ac  3500000)
                    (cpu-scaling-min-freq-on-bat 1000000)
                    (cpu-scaling-max-freq-on-bat 3000000)
                    (cpu-min-perf-on-ac    0)
                    (cpu-max-perf-on-ac  100)
                    (cpu-min-perf-on-bat   0)
                    (cpu-max-perf-on-bat  40)
                    (cpu-boost-on-ac?  #t)
                    (cpu-boost-on-bat? #f)
                    (nmi-watchdog? #t)
                    (start-charge-thresh-bat0 70)
                    (stop-charge-thresh-bat0  90)))
          (service thinkfan-service-type
                   (thinkfan-configuration
                    (thinkfan thinkfan-next)
                    (config-file file:thinkfan-config)))
          (service thermald-service-type)

          #|Memory management services|#
          (service zram-device-service-type
                   (zram-device-configuration
                    (size (round/ (ram-total) 4))
                    (compression-algorithm 'lz4)))

          #|Doas configuration services|#
          (simple-service 'miscellaneous-permissions doas-service-type
                          (list (permit (identity ":wheel")
                                        (setenv `(("GUILE_LOAD_PATH" . #t))))
                                (permit (identity ":wheel")
                                        (nopass? #t)
                                        (command "guix")
                                        (args `("pull")))))
          (simple-service 'text-editors-permissions doas-service-type
                          (map (lambda (cmd)
                                 (permit (identity ":wheel")
                                         (keepenv? #t)
                                         (command cmd)))
                               `("kak" "emacsclient")))
          (simple-service 'power-management-permissions doas-service-type
                          (map (lambda (cmd)
                                 (permit (identity ":wheel")
                                         (nopass? #t)
                                         (command cmd)
                                         (args '())))
                               `("zzz" "halt" "reboot")))
          (simple-service 'shepherd-status-permissions doas-service-type
                          (map (lambda (action)
                                 (permit (identity ":wheel")
                                         (nopass? #t)
                                         (command "herd")
                                         (args (list action))))
                               `("status" "detailed-status")))
          (simple-service 'service-management-permissions doas-service-type
                          (flat-map (lambda (service action)
                                      (permit (identity ":wheel")
                                              (nopass? #t)
                                              (command "herd")
                                              (args (map symbol->string
                                                         (list action service)))))
                                    '(tor networking wpa-supplicant)
                                    '(doc stop start enable status restart disable)))
          #|Special file services|#
          (service special-files-service-type
                   `(("/bin/sh"      ,(file-append dash-next "/bin/dash"))
                     ("/usr/bin/env" ,(file-append coreutils "/bin/env"))))

          (simple-service 'extra-sysctl-settings sysctl-service-type
                          `(("vm.swappiness" . "180")
                            ("vm.watermark_boost_factor" . "0")
                            ("vm.watermark_scale_factor" . "125")
                            ("vm.page-cluster" . "0")))

          #|Miscellaneous services|#
          (service urandom-seed-service-type)
          (service nscd-service-type)
          (service sysctl-service-type
                   (sysctl-configuration
                    (sysctl (file-append procps "/sbin/sysctl"))
                      (settings (fold kicksecure-delete
                                      %kicksecure-sysctl-rules
                                      '("net.core.bpf_jit_harden"
                                        "kernel.unprivileged_bpf_disabled")))))))))

operating-system