1(use-modules (gnu)2 (gnu packages shells)3 (gnu services dbus)4 (gnu services desktop)5 (gnu services dns)6 (gnu services networking)7 (gnu services ssh)8 (gnu services sysctl)9 (gnu system locale)10 (gnu system pam)1112 (gnu services dns)1314 (nmeum packages misc)15 (nmeum packages desktop)16 (nmeum services networking)17 (nmeum services system)18 ((nongnu packages linux) #:select (linux linux-firmware)))1920;; The signing key for the nonguix substitutes embedded as plain text.21;;22;; See: https://gitlab.com/nonguix/nonguix23(define nonguix-signkey24 "(public-key25 (ecc26 (curve Ed25519)27 (q #C1FD53E5D4CE971933EC50C9F307AE2171A2D3B52C804642A7A35F84F3A4EA98#)))")2829;; Guix configuration which enables nonguix substitutes.30;;31;; See https://guix.gnu.org/en/manual/devel/en/guix.html#index-guix_002dconfiguration32(define (nonguix-config config)33 (guix-configuration34 (inherit config)35 (substitute-urls36 (append (list "https://substitutes.nonguix.org")37 %default-substitute-urls))38 (authorized-keys39 (append (list (plain-file "non-guix.pub" nonguix-signkey))40 %default-authorized-guix-keys))))4142(operating-system43 (kernel linux)44 (firmware (list linux-firmware))4546 (locale "en_US.utf8")47 (locale-definitions48 (list (locale-definition49 (name "en_US.utf8") (source "en_US"))))5051 (timezone "Europe/Berlin")52 (keyboard-layout (keyboard-layout "de" "neo"))53 (host-name "hassium")5455 ;; The list of user accounts ('root' is implicit).56 (users (cons* (user-account57 (name "soeren")58 (comment "Sören Tempel")59 (group "users")60 (shell (file-append loksh-bracketed "/bin/ksh"))61 (home-directory "/home/soeren")62 ;; Note: Without elogind, it is neccessary to also be in both63 ;; the audio and the video group as seatd doesn't mediated access64 ;; to audio/video devices.65 (supplementary-groups '("wheel" "netdev")))66 %base-user-accounts))6768 ;; Allow sudo use without password authentication.69 ;;70 ;; XXX: A bit ugly since there is no declarative API for this yet.71 (sudoers-file72 (plain-file "sudoers" "root ALL=(ALL) ALL\n%wheel ALL=(ALL) NOPASSWD: ALL\n"))7374 ;; Below is the list of system services. To search for available75 ;; services, run 'guix system search KEYWORD' in a terminal.76 (services77 (append (list78 (service elogind-service-type)79 (service dbus-root-service-type)8081 (service unbound-service-type82 (unbound-configuration83 (forward-zone84 (list85 (unbound-zone86 (name ".")87 (forward-addr '("149.112.112.112#dns.quad9.net"88 "2620:fe::9#dns.quad9.net"))89 (forward-tls-upstream #t))))))9091 (service openssh-service-type92 (openssh-configuration93 (allow-agent-forwarding? #f)94 (password-authentication? #f)))9596 (service openntpd-service-type97 (openntpd-configuration98 (servers '("europe.pool.ntp.org"))99 (constraint-from100 '(;; Quad9 DNS (IPv4)101 "9.9.9.9"102 ;; Quad9 DNS (IPv6)103 "2620:fe::fe"104 ;; Google LLC (DNS)105 "www.google.com"))))106107 (service dhcpcd-service-type108 (dhcpcd-configuration109 (vendorclassid "MSFT")110 (option '("rapid_commit" "interface_mtu"))111 (nooption '("nd_rdnss"112 "dhcp6_name_servers"113 "domain_name_servers"114 "domain_name"115 "domain_search"))116 (static '("domain_name_servers=127.0.0.1"))117 (nohook '("hostname")))))118119 (modify-services %base-services120 ;; Enable substitutes for nonguix.121 (guix-service-type config => (nonguix-config config))122123 ;; Enable additional sysctls.124 (sysctl-service-type config =>125 (sysctl-configuration126 (inherit config)127 (settings128 (append %default-sysctl-settings129 '(("kernel.dmesg_restrict" . "1")130 ("kernel.kptr_restrict" . "1")))))))))131132 (bootloader (bootloader-configuration133 ;; Use a removable bootloader configuration here to prevent134 ;; Grub from updating UEFI boot entries, thereby making Guix135 ;; (instead of Alpine) the default entry.136 ;;137 ;; See the --removable and --no-nvram option of grub-install.138 (bootloader grub-efi-removable-bootloader)139 (targets (list "/boot/efi"))140 (keyboard-layout keyboard-layout)141 (extra-initrd "/key-file.cpio")))142143 (mapped-devices (list (mapped-device144 (source (uuid "d9bd4aa0-bd68-4fef-b6a5-0657bd69daef"))145 (target "cryptroot")146 (type (luks-device-mapping-with-options147 #:key-file "/key-file.bin")))))148149 ;; The list of file systems that get "mounted". The unique150 ;; file system identifiers there ("UUIDs") can be obtained151 ;; by running 'blkid' in a terminal.152 (file-systems (cons* (file-system153 (check? #f)154 (mount-point "/tmp")155 (device "none")156 (type "tmpfs"))157158 (file-system159 (mount-point "/")160 (device "/dev/mapper/cryptroot")161 (type "btrfs")162 (dependencies mapped-devices))163 (file-system164 (mount-point "/boot/efi")165 (device (uuid "04FA-08B2" 'fat32))166 (type "vfat")) %base-file-systems)))