1(use-modules (gnu)2 (gnu packages shells)3 (gnu services dbus)4 (gnu services desktop)5 (gnu services dns)6 (gnu services linux)7 (gnu services networking)8 (gnu services mcron)9 (gnu services ssh)10 (gnu services sysctl)11 (gnu system locale)12 (gnu system pam)1314 (gnu services dns)1516 (nmeum packages misc)17 (nmeum packages desktop)18 ((nongnu packages linux) #:select (linux linux-firmware)))1920;; The signing key for the nonguix substitutes embedded as plain text.21;;22;; See: https://gitlab.com/nonguix/nonguix23(define nonguix-signkey24 "(public-key25 (ecc26 (curve Ed25519)27 (q #C1FD53E5D4CE971933EC50C9F307AE2171A2D3B52C804642A7A35F84F3A4EA98#)))")2829;; Guix configuration which enables nonguix substitutes.30;;31;; See https://guix.gnu.org/en/manual/devel/en/guix.html#index-guix_002dconfiguration32(define (nonguix-config config)33 (guix-configuration34 (inherit config)35 ;; Run guix-daemon in non-privileged mode. This may become the default in the future.36 ;;37 ;; See https://codeberg.org/guix/guix-mirror/commit/ba53ff9cc403c7f0388e2dc932cb46e665e81be738 (privileged? #f)39 (substitute-urls40 (append (list "https://substitutes.nonguix.org")41 %default-substitute-urls))42 (authorized-keys43 (append (list (plain-file "non-guix.pub" nonguix-signkey))44 %default-authorized-guix-keys))))4546(operating-system47 (kernel linux)48 (firmware (list linux-firmware))4950 (locale "en_US.utf8")51 (locale-definitions52 (list (locale-definition53 (name "en_US.utf8") (source "en_US"))))5455 (timezone "Europe/Berlin")56 (keyboard-layout (keyboard-layout "de" "neo"))57 (host-name "hassium")5859 ;; The list of user accounts ('root' is implicit).60 (users (cons* (user-account61 (name "soeren")62 (comment "Sören Tempel")63 (group "users")64 (shell (file-append loksh-bracketed "/bin/ksh"))65 (home-directory "/home/soeren")66 ;; Note: Without elogind, it is neccessary to also be in both67 ;; the audio and the video group as seatd doesn't mediated access68 ;; to audio/video devices.69 (supplementary-groups '("wheel" "netdev")))70 %base-user-accounts))7172 ;; Allow sudo use without password authentication.73 ;;74 ;; XXX: A bit ugly since there is no declarative API for this yet.75 (sudoers-file76 (plain-file "sudoers" "root ALL=(ALL) ALL\n%wheel ALL=(ALL) NOPASSWD: ALL\n"))7778 ;; Below is the list of system services. To search for available79 ;; services, run 'guix system search KEYWORD' in a terminal.80 (services81 (append (list82 (service elogind-service-type)83 (service dbus-root-service-type)84 (service fstrim-service-type)8586 ;; TODO: btrfs snapshots (see comment regarding subvolumes below).87 ;;88 ;; XXX: mcron has not been designed to run anachronistically.89 ;; See: https://www.gnu.org/software/mcron/manual/mcron.html#Behaviour-on-laptops90 (let ((guix-gc #~(job '(next-hour '(12)) "guix gc -F 100G")))91 (simple-service 'guix-gc-cron92 mcron-service-type93 (list guix-gc)))9495 (service unbound-service-type96 (unbound-configuration97 (forward-zone98 (list99 (unbound-zone100 (name ".")101 (forward-addr '("149.112.112.112#dns.quad9.net"102 "2620:fe::9#dns.quad9.net"))103 (forward-tls-upstream #t))))))104105 (service openssh-service-type106 (openssh-configuration107 (allow-agent-forwarding? #f)108 (password-authentication? #f)))109110 (service openntpd-service-type111 (openntpd-configuration112 (servers '("europe.pool.ntp.org"))113 (constraint-from114 '(;; Quad9 DNS (IPv4)115 "9.9.9.9"116 ;; Quad9 DNS (IPv6)117 "2620:fe::fe"118 ;; Google LLC (DNS)119 "www.google.com"))))120121 (service dhcpcd-service-type122 (dhcpcd-configuration123 (vendor-class-id "MSFT")124 (option '("rapid_commit" "interface_mtu"))125 (no-option '("nd_rdnss"126 "dhcp6_name_servers"127 "domain_name_servers"128 "domain_name"129 "domain_search"))130 (static '("domain_name_servers=127.0.0.1"))131 (no-hook '("hostname")))))132133 (modify-services %base-services134 ;; Enable substitutes for nonguix.135 (guix-service-type config => (nonguix-config config))136137 ;; Set a custom console font.138 (console-font-service-type config =>139 (map (lambda (tty)140 (cons tty141 #~(string-append142 #+font-terminus-patched143 "/share/consolefonts/ter-v16n.psf.gz")))144 '("tty1" "tty2" "tty3" "tty4" "tty5" "tty6")))145146 ;; Enable additional sysctls.147 (sysctl-service-type config =>148 (sysctl-configuration149 (inherit config)150 (settings151 (append %default-sysctl-settings152 '(("kernel.dmesg_restrict" . "1")153 ("kernel.kptr_restrict" . "1")))))))))154155 (bootloader (bootloader-configuration156 ;; Use a removable bootloader configuration here to prevent157 ;; Grub from updating UEFI boot entries, thereby making Guix158 ;; (instead of Alpine) the default entry.159 ;;160 ;; See the --removable and --no-nvram option of grub-install.161 (bootloader grub-efi-removable-bootloader)162 (targets (list "/boot/efi"))163 (keyboard-layout keyboard-layout)164 (extra-initrd "/key-file.cpio")))165166 (mapped-devices (list (mapped-device167 (source (uuid "d9bd4aa0-bd68-4fef-b6a5-0657bd69daef"))168 (target "cryptroot")169 (type (luks-device-mapping-with-options170 #:allow-discards? #t171 #:key-file "/key-file.bin")))))172173 ;; The list of file systems that get "mounted". The unique174 ;; file system identifiers there ("UUIDs") can be obtained175 ;; by running 'blkid' in a terminal.176 (file-systems177 (let ((btrfs-subvol (lambda (mnt flags opts)178 (file-system179 (mount-point mnt)180 (device "/dev/mapper/cryptroot")181 (type "btrfs")182 (flags flags)183 (options (alist->file-system-options184 (cons (cons "subvol" mnt) opts)))185 (dependencies mapped-devices)))))186 (cons* (file-system187 (check? #f)188 (mount-point "/tmp")189 (device "none")190 (type "tmpfs"))191192 ;; TODO: Subvolumes for /home, /var, /var/log, /var/tmp, …193 ;;194 ;; Note: Btrfs does presently not support filesystem-specific195 ;; mount options on subvolume-granularity, generic ones work.196 ;;197 ;; See https://btrfs.readthedocs.io/en/stable/btrfs-subvolume.html#mount-options198 (btrfs-subvol "/"199 '(no-atime)200 '("rw"201 "ssd"202 ("compress" . "lzo")203 ("space_cache" . "v2")))204 ;; TODO: Consider using a tmpfs for /var/tmp205 (btrfs-subvol "/var/tmp"206 '(no-atime no-suid no-dev no-exec)207 '())208209 (file-system210 (mount-point "/boot/efi")211 (device (uuid "04FA-08B2" 'fat32))212 (type "vfat")) %base-file-systems))))