source: dotfiles/guix/config-desktop.scm@ eb58262

;; This is an operating system configuration template
;; for a "desktop" setup with GNOME and Xfce where the
;; root partition is encrypted with LUKS, and a swap file.

(use-modules (gnu)
             (guix transformations)
             (gnu home)
             (gnu system privilege)
             (guix gexp)
             (gnu home services shells))

(use-service-modules guix cups desktop networking ssh xorg docker nix admin vnc lightdm syncthing virtualization databases linux web backup telephony file-sharing spice security-token)
(use-package-modules gnome xdisorg vnc databases virtualization firmware security-token)

(load "/home/w96k/projects/dotfiles/guix/.dotfiles/home-configuration.scm")

(operating-system
  (host-name "wkz")
  (timezone "Asia/Tbilisi")
  (locale "en_US.utf8")
  (kernel-arguments '("quiet" "intel_iommu=on" "amd_iommu=on" "iommu=on" "video=HDMI-1:1920x1080@240"))
  (initrd-modules (append '("raid1" "br_netfilter" "vfio_iommu_type1" "vfio_pci" "vfio") %base-initrd-modules))

  ;; Choose US English keyboard layout.  The "altgr-intl"
  ;; variant provides dead keys for accented characters.
  (keyboard-layout (keyboard-layout "us,ru"
                                    #:options '("grp:shifts_toggle" "ctrl:nocaps" "ctrl:escape")))

  ;; Use the UEFI variant of GRUB with the EFI System
  ;; Partition mounted on /boot/efi.
  (bootloader (bootloader-configuration
                (bootloader grub-efi-bootloader)
                (targets '("/boot/efi"))
                (keyboard-layout keyboard-layout)))

  ;; Specify a mapped device for the encrypted root partition.
  ;; The UUID is that returned by 'cryptsetup luksUUID'.
  
  (mapped-devices
   (list
    (mapped-device
     (source (list "/dev/sda1" "/dev/sdc1"))
     ;;       (source (list (uuid "ed5b96c3-fa7f-6de7-259d-6eb8e73a631e") (uuid "daeb6a6e-290d-7792-e7b6-edf45cef2076")))
     (target "/dev/md0")
     (type raid-device-mapping))

    (mapped-device
     ;;          (source "/dev/md0")
     (source (uuid "4e2ee2d8-735d-49bd-8b3d-cd9102170a1f"))
     (target "home")
     (type luks-device-mapping))

    (mapped-device
     (source (uuid "03db8d78-051b-4a11-a7e5-b62ae0f530d4"))
     (target "guix_old")
     (type luks-device-mapping))
    )
   )

  (file-systems (append
                 (list
                        (file-system
                         (device "/dev/mapper/home")
                         (mount-point "/home")
                         (type "ext4")
                         (dependencies mapped-devices))

                        (file-system
                         (device "/dev/mapper/guix_old")
                         (mount-point "/home/storage")
                         (type "btrfs")
                         (dependencies mapped-devices))
                  
                        (file-system
                         (device (file-system-label "root"))
                         (mount-point "/")
                         (type "ext4"))

                       (file-system
                         (device (uuid "17C5-3E35" 'fat))
                         (mount-point "/boot/efi")
                         (type "vfat")))
                 %base-file-systems))

  ;; Specify a swap file for the system, which resides on the
  ;; root file system.
  (swap-devices (list (swap-space
                       (target "/swapfile"))))

  (groups
   (append
    (list
     (user-group (name "storage"))) %base-groups))
  
  (users (append (list
                  (user-account
                   (name "w96k")
                   (group "users")
                   (home-directory "/home/w96k")
                   (supplementary-groups '("wheel" "netdev" "audio" "video" "kvm" "httpd" "libvirt" "postgres" "transmission" "nitrokey")))

                  (user-account
                   (name "torrent")
                   (group "users")
                   (supplementary-groups '("wheel" "transmission"))
                   (home-directory "/home/torrent"))
                  
                  (user-account
                   (name "storage")
                   (group "users")
                   (supplementary-groups '("wheel" "transmission"))
                   (home-directory "/home/storage"))
                  )
               %base-user-accounts))

  (packages
  (append
   (map
    specification->package
    '("font-gnu-freefont" "font-gnu-unifont" "nix" "virt-manager" "bridge-utils" "xmodmap" "gvfs" "ovmf-x86-64" "efibootmgr"
      "cryptsetup" "mdadm"))
   %base-packages))

  (services
   (append (list
            (service guix-home-service-type `(("w96k" ,wkz-home)))
                              (service gpm-service-type)

                              (service tor-service-type)
                              (service openssh-service-type)

                              (service transmission-daemon-service-type)

                              (service libvirt-service-type
                                       (libvirt-configuration
                                        (unix-sock-group "libvirt")
                                        (tls-port "16555")))

                              (service virtlog-service-type)

                                   (service postgresql-service-type
                    (postgresql-configuration
                     (postgresql postgresql-15)))

                                   (service dhcp-client-service-type)

                                   (extra-special-file "/usr/share/OVMF/OVMF_VARS.fd"
                                                       (file-append ovmf "/share/firmware/ovmf_x64.bin"))

           (service httpd-service-type
                    (httpd-configuration
                     (config
                      (httpd-config-file
                       (modules (cons*
                                 (httpd-module
                                  (name "proxy_module")
                                  (file "modules/mod_proxy.so"))
                                 (httpd-module
                                  (name "proxy_fcgi_module")
                                  (file "modules/mod_proxy_fcgi.so"))
                                 %default-httpd-modules))
                       (extra-config (list "\
<FilesMatch \\.php$>
    SetHandler \"proxy:unix:/var/run/php-fpm.sock|fcgi://localhost/\"
</FilesMatch>"))))))
           (service php-fpm-service-type
                    (php-fpm-configuration
                     (display-errors #t)
                     (socket "/var/run/php-fpm.sock")
                     (socket-group "httpd")))

           (service pcscd-service-type)
           (udev-rules-service 'nitrokey libnitrokey #:groups '("nitrokey"))

           (service screen-locker-service-type
            (screen-locker-configuration
             (name "xlock")
             (program (file-append xlockmore "/bin/xlock"))))

           (service qemu-binfmt-service-type
                        (qemu-binfmt-configuration
                          (platforms (lookup-qemu-platforms "aarch64"))))

           ;; (service virtual-build-machine-service-type
           ;;       (virtual-build-machine
           ;;        (qemu "qemu")
           ;;        (cpu-count 8)
           ;;        (memory-size (* 1 8096))
           ;;        (systems (list ("aarch64-linux")))
           ;;        (auto-start? #t)))

           (extra-special-file "/etc/qemu/host.conf" "allow br0\n")
           (service spice-vdagent-service-type))

          (modify-services %desktop-services
                           (delete screen-locker-service-type)
                           (delete modem-manager-service-type)
                           (delete upower-service-type)
                           (delete network-manager-service-type)
                           (delete wpa-supplicant-service-type)
                           ;; (delete usb-modeswitch-service-type)
                           (delete geoclue-service-type)
                           ;;(delete elogind-service-type)
                           (delete colord-service-type)
                           (delete ntp-service-type)
                           
                           
                           (guix-service-type config => (guix-configuration
                                                         (inherit config)
                                                         (authorized-keys (append (list
"(public-key 
 (ecc 
  (curve Ed25519)
  (q #784779217C0B279976C1F69C514797B26EB927EA9D0E9DE95B92983D37DF13B8#)
  )
 )
"

;; nonguix
;; "(public-key 
;;  (ecc 
;;   (curve Ed25519)
;;   (q #C1FD53E5D4CE971933EC50C9F307AE2171A2D3B52C804642A7A35F84F3A4EA98#)
;;   )
;;  )"
                                                                                        ) %default-authorized-guix-keys))
                                                         ;; (substitute-urls
                                                         ;;  (append (list "https://substitutes.nonguix.org")
                                                         ;;       %default-substitute-urls))
                                                         ;; (extra-options '("--max-jobs=10"))
                                                         ;; (http-proxy "http://localhost:9250")
                                                         ))
                           
                           (delete gdm-service-type))
                              
   ))

  ;; Allow resolution of '.local' host names with mDNS.
  (name-service-switch %mdns-host-lookup-nss))