zero/operating-systems/buer.scm

(define-module (operating-systems buer)
  #|GNU bootloader|#
  #|•|# #:use-module (gnu bootloader)
  #|G|# #:use-module (gnu bootloader grub)

  #|GNU packages|#
  #|A|# #:use-module (gnu packages admin)
  #|B|# #:use-module (gnu packages base)
  #|C|# #:use-module (gnu packages certs)
        #:use-module (gnu packages compression)
  #|G|# #:use-module (gnu packages gawk)
        #:use-module (gnu packages guile)
        #:use-module (gnu packages guile-xyz)
  #|L|# #:use-module (gnu packages less)
        #:use-module (gnu packages linux)
  #|M|# #:use-module (gnu packages man)
  #|P|# #:use-module (gnu packages package-management)
        #:use-module (gnu packages pciutils)
  #|S|# #:use-module (gnu packages shells)
  #|T|# #:use-module (gnu packages texinfo)
  #|V|# #:use-module (gnu packages vpn)

  #|GNU services|#
  #|•|# #:use-module (gnu services)
  #|A|# #:use-module (gnu services admin)
        #:use-module (gnu services avahi)
  #|B|# #:use-module (gnu services base)
  #|D|# #:use-module (gnu services dbus)
        #:use-module (gnu services desktop)
  #|G|# #:use-module (gnu services guix)
  #|M|# #:use-module (gnu services mcron)
  #|L|# #:use-module (gnu services linux)
  #|N|# #:use-module (gnu services networking)
  #|P|# #:use-module (gnu services pm)
  #|S|# #:use-module (gnu services sysctl)

  #|GNU system|#
  #|•|# #:use-module ((gnu system)
                      #:select (operating-system)
                      #:prefix gnu:)
  #|A|# #:use-module (gnu system accounts)
  #|F|# #:use-module (gnu system file-systems)
  #|K|# #:use-module (gnu system keyboard)
  #|N|# #:use-module (gnu system nss)
  #|S|# #:use-module (gnu system shadow)

  #|Guix|#
  #|G|# #:use-module (guix gexp)

  #|Home environments|#
  #|R|# #:use-module ((home-environments radio)
                      #:select (home-environment)
                      #:renamer (const 'home-environment:radio))

  #|Radix|#
  #|A|# #:use-module (radix artwork)
  #|C|# #:use-module (radix combinators)
  #|U|# #:use-module (radix utils)

  #|Radix packages|#
  #|A|# #:use-module (radix packages admin)
  #|L|# #:use-module (radix packages linux)
  #|S|# #:use-module (radix packages shells)
  #|T|# #:use-module (radix packages text-editors)

  #|Radix services|#
  #|A|# #:use-module (radix services admin)
  #|P|# #:use-module (radix services pm)

  #|Radix system|#
  #|S|# #:use-module (radix system security)
        #:use-module (radix system setuid)
  #|M|# #:use-module (radix system monitoring)

  #|Buer|#
  #|B|# #:use-module ((buer build-machines)
                      #:prefix build-machine:)
  #|C|# #:use-module ((buer channels)
                      #:prefix channel:)
  #|P|# #:use-module ((buer privilege)
                      #:prefix privileged-programs:)
  #|U|# #:use-module ((buer users)
                      #:prefix user:)

  #|Buer files|#
  #|S|# #:use-module ((buer files substitute-keys)
                      #:prefix substitute-key:)
  #|T|# #:use-module ((buer files thinkfan)
                      #:prefix file:thinkfan-)

  #|SRFIs|#
  #|1|# #:use-module (srfi srfi-1)

  #:export (operating-system))

(define operating-system
  (gnu:operating-system
   (host-name "buer")
   (timezone "America/Sao_Paulo")
   (locale "en_US.utf8")

   (keyboard-layout
    (keyboard-layout "us,br"
                     #:options `("grp:menu_switch"
                                 "parens:swap_brackets"
                                 "caps:swapescape")))

   (bootloader
    (bootloader-configuration
     (bootloader grub-bootloader)
     (targets `("/dev/sda"))
     (theme (grub-theme
             (color-normal
              '((fg . light-gray) (bg . black)))
             (color-highlight
              '((fg . black) (bg . light-gray)))
             (image (file-append %artwork-repository
                                 "/backgrounds/guix-silver-16-9.svg"))
             (gfxmode `("1280x720x32"))))))

   (kernel linux-libre-6.10)
   (kernel-arguments
    (cons* "modprobe.blacklist=usbmouse,usbkbd,pcspkr"
           "thinkpad_acpi.fan_control=1"
           (filter (negate ((on disjoin
                                (partial partial string-prefix?))
                            "debugfs" "l1tf" "mds" "mitigations" "nosmt"))
                   %kicksecure-kernel-arguments)))

   (file-systems
    (cons* (file-system
            (device (file-system-label "guix-root"))
            (mount-point "/")
            (type "ext4"))
           (file-system
            (device (file-system-label "home"))
            (mount-point "/home")
            (type "ext4"))
           %base-file-systems))

   (users
    (cons* user:radio
           user:root
           %base-user-accounts))

   #|System level packages|#
   (packages
    (list #|admin       |# btop inetutils isc-dhcp opendoas shadow zzz
          #|base        |# coreutils diffutils findutils grep patch sed tar which
          #|certs       |# nss-certs
          #|compression |# gzip xz zstd
          #|gawk        |# gawk
          #|guile       |# guile-next guile-colorized guile-readline
          #|less        |# less
          #|linux       |# e2fsprogs iproute kmod procps psmisc usbutils
                           util-linux
          #|man         |# man-db man-pages
          #|pciutils    |# pciutils
          #|shells      |# dash-next
          #|texinfo     |# info-reader
          #|text-editors|# kakoune
          #|vpn         |# wireguard-tools))

   #|Do not generate a sudoers file|#
   (sudoers-file #f)

   #|Run some programs from with file privileges|#
   (privileged-programs
     (append privileged-programs:authentication
             privileged-programs:file-systems
             privileged-programs:network))

   #|Allow resolution of '.local' host names with mDNS|#
   (name-service-switch %mdns-host-lookup-nss)

   #|System services|#
   (services
    (list #|TTY services|#
          (service virtual-terminal-service-type)
          (service console-font-service-type
                   (associate-right
                    (%default-console-font `("tty1" "tty2"))))

          #|Login services|#
          (service seatd-service-type)
          (service greetd-service-type
                   (greetd-configuration
                    (greeter-supplementary-groups `("seat" "video"))
                    (terminals
                      (map (lambda (x)
                             (greetd-terminal-configuration
                              (terminal-vt (number->string x))
                              (terminal-switch #t)
                              (default-session-command
                               (greetd-agreety-session
                                (command #~(getenv "SHELL"))))))
                           (iota 2 1)))))

          #|Home environment services|#
          (service guix-home-service-type
                   (if (file-exists? "/run/current-system/provenance") '()
                     `(("radio" ,home-environment:radio))))

          #|Log services|#
          (service rottlog-service-type)
          (service syslog-service-type
                   (syslog-configuration
                    (syslogd (file-append inetutils "/libexec/syslogd"))
                    (config-file %default-syslog.conf)))
          (service log-cleanup-service-type
                   (log-cleanup-configuration
                    (directory "/var/log/guix/drvs")
                    (expiry (* 3 30 24 3600))))

          #|IPC services|#
          (service dbus-root-service-type)

          #|Avahi service|#
          (service avahi-service-type
                   (avahi-configuration
                    (wide-area? #t)))

          #|Guix services|#
          (service guix-service-type
                   (guix-configuration
                    (build-accounts 16)
                    (discover? #t)
                    (authorized-keys
                     (cons* substitute-key:genenetwork.pub
                            %default-authorized-guix-keys))
                    (substitute-urls
                      `("https://ci.guix.gnu.org"
                        "https://cuirass.genenetwork.org"
                        "https://bordeaux.guix.gnu.org"))
                    (extra-options
                      `("--max-jobs=8"
                        "--cores=4"
                        "--gc-keep-derivations=yes"
                        "--gc-keep-outputs=yes"))))
          (service guix-publish-service-type
                   (guix-publish-configuration
                    (port 8080)
                    (host "0.0.0.0")
                    (advertise? #t)
                    (compression `(("zstd" 3)))))

          #|Mcron service|#
          (service mcron-service-type
                   (mcron-configuration
                    (jobs (list #~(job "* * * * Sun"
                                       "guix gc --optimize --free-space=10G")))))

          #|Device management services|#
          (service udev-service-type
                   (udev-configuration
                    (udev eudev)
                    (rules (list alsa-utils crda fuse lvm2))))

          #|Network services|#
          (service static-networking-service-type
                   (list (static-networking
                          (addresses
                           (list (network-address
                                  (device "lo")
                                  (value "127.0.0.1/8"))))
                          (provision '(loopback)))))
          (service ntp-service-type)
          (service wpa-supplicant-service-type
                   (wpa-supplicant-configuration
                    (config-file "/etc/wpa-supplicant.conf")
                    (interface "wlp2s0")
                    (extra-options `("-B"))))
          (service dhcp-client-service-type
                   (dhcp-client-configuration
                    (interfaces 'all)))
          (simple-service 'extra-hosts
                          hosts-service-type
                          (list (host "192.168.100.33" "yumiko.local"
                                      `("yumiko" "substitutes.yumiko"))))

          #|Power management services|#
          (service tlp-service-type
                   (tlp-configuration
                    (cpu-scaling-governor-on-ac  `("performance"))
                    (cpu-scaling-governor-on-bat `("powersave"))
                    (cpu-scaling-min-freq-on-ac  1500000)
                    (cpu-scaling-max-freq-on-ac  3500000)
                    (cpu-scaling-min-freq-on-bat 1000000)
                    (cpu-scaling-max-freq-on-bat 3000000)
                    (cpu-min-perf-on-ac    0)
                    (cpu-max-perf-on-ac  100)
                    (cpu-min-perf-on-bat   0)
                    (cpu-max-perf-on-bat  40)
                    (cpu-boost-on-ac?  #t)
                    (cpu-boost-on-bat? #f)
                    (nmi-watchdog? #t)
                    (start-charge-thresh-bat0 70)
                    (stop-charge-thresh-bat0  90)))
          (service thinkfan-service-type
                   (thinkfan-configuration
                    (thinkfan thinkfan-next)
                    (config-file file:thinkfan-config)))

          #|Memory management services|#
          (service zram-device-service-type
                   (zram-device-configuration
                    (size (round/ (ram-total) 2))
                    (compression-algorithm 'lz4)))

          #|Doas configuration services|#
          (simple-service 'miscellaneous-permissions doas-service-type
                          (list (permit (identity ":wheel")
                                        (setenv
                                          `(("GUILE_LOAD_PATH" . #t)
                                            ("GUILE_LOAD_COMPILED_PATH" . #t))))))
          (simple-service 'text-editors-permissions doas-service-type
                          (map (lambda (cmd)
                                 (permit (identity ":wheel")
                                         (keepenv? #t)
                                         (command cmd)))
                               `("kak" "emacsclient")))
          (simple-service 'power-management-permissions doas-service-type
                          (map (lambda (cmd)
                                 (permit (identity ":wheel")
                                         (nopass? #t)
                                         (command cmd)
                                         (args '())))
                               `("zzz" "halt" "reboot")))
          (simple-service 'shepherd-status-permissions doas-service-type
                          (map (lambda (action)
                                 (permit (identity ":wheel")
                                         (nopass? #t)
                                         (command "herd")
                                         (args (list action))))
                               `("status" "detailed-status")))
          (simple-service 'service-management-permissions doas-service-type
                          (flat-map (lambda (service action)
                                      (permit (identity ":wheel")
                                              (nopass? #t)
                                              (command "herd")
                                              (args (map symbol->string
                                                         (list action service)))))
                                    '(networking wpa-supplicant)
                                    '(doc stop start enable status restart disable)))

          #|Special file services|#
          (service special-files-service-type
                   `(("/bin/sh"      ,(file-append dash-next "/bin/dash"))
                     ("/usr/bin/env" ,(file-append coreutils "/bin/env"))))

          #|Sysctl services|#
          (simple-service 'extra-sysctl-settings sysctl-service-type
                          `(("vm.swappiness" . "180")
                            ("vm.watermark_boost_factor" . "0")
                            ("vm.watermark_scale_factor" . "125")
                            ("vm.page-cluster" . "0")))
          (simple-service 'security-syctl-settings sysctl-service-type
                          (alist-delete "net.core.bpf_jit_harden"
                                        %kicksecure-sysctl-rules))

          #|Base services|#
          (service urandom-seed-service-type)
          (service nscd-service-type)))))

operating-system