(define-module (operating-systems buer)
  #|GNU|#
  #|•|# #:use-module (gnu)
  #|S|# #:use-module ((gnu system) #:select (operating-system)
                                   #:prefix gnu:)

  #|GNU packages|#
  #|A|# #:use-module (gnu packages admin)
        #:use-module (gnu packages android)
  #|B|# #:use-module (gnu packages base)
  #|C|# #:use-module (gnu packages certs)
        #:use-module (gnu packages compression)
  #|G|# #:use-module (gnu packages gawk)
        #:use-module (gnu packages guile)
        #:use-module (gnu packages guile-xyz)
  #|L|# #:use-module (gnu packages less)
        #:use-module (gnu packages linux)
  #|M|# #:use-module (gnu packages man)
  #|S|# #:use-module (gnu packages shells)
  #|T|# #:use-module (gnu packages texinfo)
  #|V|# #:use-module (gnu packages vpn)

  #|GNU services|#
  #|A|# #:use-module (gnu services admin)
        #:use-module (gnu services avahi)
  #|D|# #:use-module (gnu services dbus)
        #:use-module (gnu services desktop)
  #|M|# #:use-module (gnu services mcron)
  #|N|# #:use-module (gnu services linux)
        #:use-module (gnu services networking)
  #|P|# #:use-module (gnu services pm)
  #|S|# #:use-module (gnu services sound)
        #:use-module (gnu services sysctl)

  #|Guix|#
  #|•|# #:use-module (guix)

  #|Radix|#
  #|A|# #:use-module (radix artwork)
  #|C|# #:use-module (radix combinators)
  #|U|# #:use-module (radix utils)

  #|Radix packages|#
  #|A|# #:use-module (radix packages admin)
  #|L|# #:use-module (radix packages linux)
  #|S|# #:use-module (radix packages shells)
  #|T|# #:use-module (radix packages text-editors)

  #|Radix services|#
  #|A|# #:use-module (radix services admin)
  #|P|# #:use-module (radix services pm)

  #|Radix system|#
  #|S|# #:use-module (radix system security)
        #:use-module (radix system setuid)

  #|M|# #:use-module (radix system monitoring)

  #|Buer|#
  #|S|# #:use-module (buer secrets)

  #|Buer files|#
  #|S|# #:use-module ((buer files substitute-keys) #:prefix substitute-key:)
        #:use-module ((buer files ssh-keys) #:prefix ssh-key:)
  #|T|# #:use-module ((buer files thinkfan)        #:prefix file:thinkfan-)

  #|SRFIs|#
  #|1|# #:use-module (srfi srfi-1)

  #:export (operating-system))

(define user:radio
  (user-account
   (name "radio")
   (password %radio-password)
   (home-directory "/home/radio")
   (shell (file-append fish "/bin/fish"))
   (uid 1000)
   (group "users")
   (supplementary-groups `("audio" "seat" "video" "wheel"))))

(define user:root
  (user-account
   (name "root")
   (password %root-password)
   (system? #t)
   (home-directory "/root")
   (uid 0)
   (group "root")
   (shell (file-append dash-next "/bin/dash"))))

(define operating-system
  (gnu:operating-system
   (host-name "buer")
   (timezone "America/Sao_Paulo")
   (locale "en_US.utf8")

   (keyboard-layout
    (keyboard-layout "us,br"
                     #:options `("grp:menu_switch"
                                 "parens:swap_brackets"
                                 "caps:swapescape")))

   (bootloader
    (bootloader-configuration
     (bootloader grub-bootloader)
     (targets `("/dev/sda"))
     (timeout 1)
     (theme (grub-theme
             (color-normal
              '((fg . light-gray) (bg . black)))
             (color-highlight
              '((fg . black) (bg . light-gray)))
             (image (file-append %artwork-repository
                                 "/backgrounds/guix-silver-16-9.svg"))
             (gfxmode `("1280x720x32"))))))

   (kernel linux-libre-6.8)
   (kernel-arguments
    (cons* "modprobe.blacklist=usbmouse,usbkbd,pcspkr"
           "thinkpad_acpi.fan_control=1"
           (filter (apply conjoin
                          (map (partial partial (negate string-prefix?))
                               (list "debugfs"
                                     "l1tf"
                                     "mds"
                                     "mitigations"
                                     "nosmt")))
                   %kicksecure-kernel-arguments)))

   (file-systems
    (cons* (file-system
            (device (file-system-label "guix-root"))
            (mount-point "/")
            (type "ext4"))
           (file-system
            (device (file-system-label "home"))
            (mount-point "/home")
            (type "ext4"))
           %base-file-systems))

   (users
    (cons* user:radio
           user:root
           %base-user-accounts))

   #|System level packages|#
   (packages
    (list #|admin       |# btop inetutils isc-dhcp opendoas shadow zzz
          #|base        |# coreutils diffutils findutils grep patch sed tar which
          #|certs       |# nss-certs
          #|compression |# gzip xz zstd
          #|gawk        |# gawk
          #|guile       |# guile-next guile-colorized guile-readline
          #|less        |# less
          #|linux       |# e2fsprogs iproute kmod linux-libre-documentation
                           procps psmisc util-linux
          #|man         |# man-db man-pages
          #|shells      |# dash-next
          #|texinfo     |# info-reader
          #|text-editors|# kakoune
          #|vpn         |# wireguard-tools))

   #|Do not generate a sudoers file|#
   (sudoers-file #f)

   #|Run some programs from each package with file owner privileges|#
   (setuid-programs
    (map-setuid-programs
      (shadow     `("passwd" "chfn" "sg" "su" "newgrp" "newuidmap" "newgidmap"))
      (inetutils  `("ping" "ping6"))
      (opendoas   `("doas"))
      (fuse-2     `("fusermount"))
      (fuse       `("fusermount3"))
      (util-linux `("mount" "umount"))))

   #|Allow resolution of '.local' host names with mDNS|#
   (name-service-switch %mdns-host-lookup-nss)

   #|System services|#
   (services
    (list #|TTY services|#
          (service virtual-terminal-service-type)
          (service console-font-service-type
                   (associate-right
                    (%default-console-font `("tty1" "tty2"))))

          #|Login services|#
          (service seatd-service-type)
          (service greetd-service-type
                   (greetd-configuration
                    (greeter-supplementary-groups '("seat" "video"))
                    (terminals
                      (map (lambda (x)
                             (greetd-terminal-configuration
                              (terminal-vt (number->string x))
                              (terminal-switch #t)
                              (default-session-command
                               (greetd-agreety-session
                                (command #~(getenv "SHELL"))))))
                           (iota 2 1)))))

          #|Log services|#
          (service rottlog-service-type)
          (service syslog-service-type
                   (syslog-configuration
                    (syslogd (file-append inetutils "/libexec/syslogd"))
                    (config-file %default-syslog.conf)))
          (service log-cleanup-service-type
                   (log-cleanup-configuration
                    (directory "/var/log/guix/drvs")
                    (expiry (* 3 30 24 3600))))

          #|IPC services|#
          (service dbus-root-service-type)

          #|Avahi service|#
          (service avahi-service-type
                   (avahi-configuration
                    (wide-area? #t)))

          #|Guix services|#
          (service guix-service-type
                   (guix-configuration
                    (discover? #t)
                    (build-accounts 16)
                  #;(build-machines
                     (list #~(build-machine
                              (name "yumiko")
                              (systems (list "x86_64-linux"))
                              (host-key #$(plain-file-content
                                            ssh-key:yumiko.pub))
                              (private-key "/root/.ssh/id_ed25519")
                              (user "radio")
                              (port 2222))))
                    (substitute-urls
                     (cons* #;"http://substitutes.yumiko:8081"
                            "https://berlin.guix.gnu.org"
                            %default-substitute-urls))
                    (authorized-keys
                     (cons* substitute-key:yuria.pub
                            substitute-key:yumiko.pub
                            %default-authorized-guix-keys))
                    (extra-options `("--max-jobs=8" "--cores=4"))))
          (service guix-publish-service-type
                   (guix-publish-configuration
                    (port 8080)
                    (host "0.0.0.0")
                    (advertise? #t)
                    (compression `(("zstd" 3)))))

          #|Mcron service|#
          (service mcron-service-type
                   (mcron-configuration
                    (jobs (list #~(job "* * * * Sun"
                                       "guix gc --optimize --free-space=5G")))))

          #|Device management services|#
          (service udev-service-type
                   (udev-configuration
                    (udev eudev)
                    (rules (list alsa-utils
                                 crda
                                 fuse
                                 lvm2))))

          #|Network services|#
          (service static-networking-service-type
                   (list (static-networking
                          (addresses
                           (list (network-address
                                  (device "lo")
                                  (value "127.0.0.1/8"))))
                          (provision '(loopback)))))
          (service ntp-service-type)
          (service wpa-supplicant-service-type
                   (wpa-supplicant-configuration
                    (config-file "/etc/wpa_supplicant.conf")
                    (interface "wlp2s0")
                    (extra-options `("-B"))))
          (service dhcp-client-service-type
                   (dhcp-client-configuration
                    (interfaces 'all)))
          (simple-service 'extra-hosts
                          hosts-service-type
                          (list (host "192.168.100.33" "yumiko.local"
                                      `("yumiko" "substitutes.yumiko"))))

          #|Power management services|#
          (service tlp-service-type
                   (tlp-configuration
                    (cpu-scaling-governor-on-ac  `("performance"))
                    (cpu-scaling-governor-on-bat `("powersave"))
                    (cpu-scaling-min-freq-on-ac  1500000)
                    (cpu-scaling-max-freq-on-ac  3500000)
                    (cpu-scaling-min-freq-on-bat 1000000)
                    (cpu-scaling-max-freq-on-bat 3000000)
                    (cpu-min-perf-on-ac    0)
                    (cpu-max-perf-on-ac  100)
                    (cpu-min-perf-on-bat   0)
                    (cpu-max-perf-on-bat  40)
                    (cpu-boost-on-ac?  #t)
                    (cpu-boost-on-bat? #f)
                    (nmi-watchdog? #t)
                    (start-charge-thresh-bat0 70)
                    (stop-charge-thresh-bat0  90)))
          (service thinkfan-service-type
                   (thinkfan-configuration
                    (thinkfan thinkfan-next)
                    (config-file file:thinkfan-config)))
          (service thermald-service-type)

          #|Memory management services|#
          (service zram-device-service-type
                   (zram-device-configuration
                    (size (round/ (ram-total) 4))
                    (compression-algorithm 'lz4)))

          #|Doas configuration services|#
          (simple-service 'miscellaneous-permissions doas-service-type
                          (list (permit (identity ":wheel")
                                        (setenv `(("GUILE_LOAD_PATH" . #t))))))
          (simple-service 'text-editors-permissions doas-service-type
                          (map (lambda (cmd)
                                 (permit (identity ":wheel")
                                         (keepenv? #t)
                                         (command cmd)))
                               `("kak" "emacsclient")))
          (simple-service 'power-management-permissions doas-service-type
                          (map (lambda (cmd)
                                 (permit (identity ":wheel")
                                         (nopass? #t)
                                         (command cmd)
                                         (args '())))
                               `("zzz" "halt" "reboot")))
          (simple-service 'shepherd-status-permissions doas-service-type
                          (map (lambda (action)
                                 (permit (identity ":wheel")
                                         (nopass? #t)
                                         (command "herd")
                                         (args (list action))))
                               `("status" "detailed-status")))
          (simple-service 'service-management-permissions doas-service-type
                          (flat-map (lambda (service action)
                                      (permit (identity ":wheel")
                                              (nopass? #t)
                                              (command "herd")
                                              (args (map symbol->string
                                                         (list action service)))))
                                    '(networking wpa-supplicant)
                                    '(doc stop start enable status restart disable)))
          #|Special file services|#
          (service special-files-service-type
                   `(("/bin/sh"      ,(file-append dash-next "/bin/dash"))
                     ("/usr/bin/env" ,(file-append coreutils "/bin/env"))))

          (simple-service 'extra-sysctl-settings sysctl-service-type
                          `(("vm.swappiness" . "180")
                            ("vm.watermark_boost_factor" . "0")
                            ("vm.watermark_scale_factor" . "125")
                            ("vm.page-cluster" . "0")))
          (simple-service 'security-syctl-settings sysctl-service-type
                          (alist-delete "net.core.bpf_jit_harden"
                                        %kicksecure-sysctl-rules))

          #|Base services|#
          (service urandom-seed-service-type)
          (service nscd-service-type)))))

operating-system