2019-05-21 16:41:07 +02:00
|
|
|
;; Guix System configuration for milano-guix-1.unimi.it build machine
|
|
|
|
;; HP ProLiantDL380p Gen8
|
|
|
|
;; Copyright © 2019 Giovanni Biscuolo <g@xelera.eu>
|
|
|
|
;; Released under the GNU GPLv3 or any later version.
|
|
|
|
|
2020-07-07 18:18:42 +02:00
|
|
|
;; DNS name in UNIMI data centre: milano-guix-1.mips.di.unimi.it.
|
|
|
|
|
|
|
|
;; SHA256:NMG2qnisy+qm8KXyTAg5kcyzkghmnYiWiM+Eyt83PcY.
|
|
|
|
|
2019-10-02 08:43:15 +02:00
|
|
|
(use-modules (gnu)
|
|
|
|
(guix gexp))
|
|
|
|
(use-service-modules databases getmail guix networking mcron ssh
|
|
|
|
virtualization web)
|
2020-07-07 18:18:42 +02:00
|
|
|
(use-package-modules certs screen tmux ssh linux)
|
2019-05-21 16:41:07 +02:00
|
|
|
|
|
|
|
;; The following definition are **almost** copied from dover.scm: a
|
|
|
|
;; quick hack to have a(n almost) self contained config file
|
|
|
|
|
|
|
|
;; FIXME: refactor using modules (e.g. like berlin.scm)
|
|
|
|
|
|
|
|
(define (sysadmin name full-name)
|
|
|
|
(user-account
|
|
|
|
(name name)
|
|
|
|
(comment full-name)
|
|
|
|
(group "users")
|
|
|
|
(supplementary-groups '("wheel" "kvm"))
|
|
|
|
(home-directory (string-append "/home/" name))))
|
|
|
|
|
|
|
|
(define %accounts
|
|
|
|
(list (sysadmin "ludo" "Ludovic Courtès")
|
|
|
|
(sysadmin "rekado" "Ricardo Wurmus")
|
2019-06-11 20:35:01 +02:00
|
|
|
(sysadmin "andreas" "Andreas Enge")
|
|
|
|
(sysadmin "cbaines" "Christopher Baines")
|
2019-05-21 16:41:07 +02:00
|
|
|
(sysadmin "degrees380" "Giovanni Biscuolo")
|
2019-06-11 20:35:01 +02:00
|
|
|
(sysadmin "atrent" "Andrea Trentini")
|
2019-05-21 16:41:07 +02:00
|
|
|
(user-account
|
|
|
|
(name "hydra")
|
|
|
|
(comment "Hydra User")
|
|
|
|
(group "users")
|
|
|
|
(home-directory (string-append "/home/" name)))
|
|
|
|
(user-account
|
|
|
|
(name "bayfront")
|
|
|
|
(comment "Bayfront Offload")
|
|
|
|
(group "users")
|
|
|
|
(home-directory (string-append "/home/" name)))))
|
|
|
|
|
|
|
|
(define %authorized-guix-keys
|
|
|
|
;; List of authorized 'guix archive' keys.
|
|
|
|
(list (local-file "keys/guix/berlin.guixsd.org-export.pub")
|
|
|
|
(local-file "keys/guix/bayfront.guix.info-export.pub")))
|
|
|
|
|
|
|
|
(define gc-job
|
|
|
|
;; Run 'guix gc' at 3AM every day.
|
|
|
|
#~(job '(next-hour '(3)) "guix gc -F 50G"))
|
|
|
|
|
|
|
|
(define btrfs-job
|
|
|
|
;; Run 'btrfs balance' every three days to make free space.
|
|
|
|
#~(job (lambda (now)
|
|
|
|
(next-day-from now (range 1 31 3)))
|
|
|
|
(string-append #$btrfs-progs "/bin/btrfs balance "
|
2020-10-12 09:23:18 +02:00
|
|
|
"start -dusage=50 /")))
|
2019-05-21 16:41:07 +02:00
|
|
|
|
2019-10-02 08:43:15 +02:00
|
|
|
(define %nginx-configuration
|
|
|
|
(nginx-configuration
|
|
|
|
(server-names-hash-bucket-size 64)
|
|
|
|
(extra-content
|
|
|
|
"
|
|
|
|
proxy_cache_path /var/cache/nginx/guix-data-service
|
|
|
|
levels=2
|
|
|
|
inactive=2d
|
|
|
|
keys_zone=guix-data-service:4m # ~32K keys
|
|
|
|
max_size=1g
|
|
|
|
use_temp_path=off;")
|
|
|
|
(upstream-blocks
|
|
|
|
(list
|
|
|
|
(nginx-upstream-configuration
|
|
|
|
(name "guix-data-service-proxy")
|
|
|
|
(servers '("localhost:8765")))))
|
|
|
|
(server-blocks
|
|
|
|
(list
|
|
|
|
(nginx-server-configuration
|
|
|
|
(server-name '("_"))
|
|
|
|
(listen '("80"))
|
|
|
|
(locations
|
|
|
|
(list
|
|
|
|
(nginx-location-configuration
|
|
|
|
(uri "/")
|
|
|
|
(body '("return 404;"))))))
|
|
|
|
(nginx-server-configuration
|
|
|
|
(server-name '("data.guix.gnu.org"))
|
|
|
|
(listen '("80"))
|
|
|
|
(locations
|
|
|
|
(list
|
|
|
|
(nginx-location-configuration
|
|
|
|
(uri "/")
|
|
|
|
(body '("proxy_pass http://guix-data-service-proxy;"
|
|
|
|
"proxy_set_header Host $host;"
|
|
|
|
"proxy_set_header X-Forwarded-For $remote_addr;"
|
|
|
|
|
|
|
|
"proxy_cache guix-data-service;"
|
|
|
|
"proxy_cache_revalidate on;"
|
|
|
|
"proxy_cache_min_uses 3;"
|
|
|
|
"proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;"
|
|
|
|
"proxy_cache_background_update on;"
|
|
|
|
"proxy_cache_lock on;"
|
|
|
|
"add_header X-Cache-Status $upstream_cache_status;"
|
|
|
|
|
|
|
|
"gzip on;"
|
|
|
|
"gzip_types text/html application/json;"
|
|
|
|
"gzip_proxied any;")))
|
|
|
|
(nginx-location-configuration
|
|
|
|
(uri "/dumps")
|
|
|
|
(body '("root /var/lib/guix-data-service;"
|
|
|
|
"autoindex on;")))
|
|
|
|
(nginx-location-configuration
|
|
|
|
(uri "^~ /.well-known/acme-challenge/")
|
|
|
|
(body '("root /srv/http/data.guix.gnu.org;")))
|
|
|
|
(nginx-location-configuration
|
|
|
|
(uri "= /.well-known/acme-challenge/")
|
|
|
|
(body '("return 404;"))))))))))
|
|
|
|
|
2019-05-21 16:41:07 +02:00
|
|
|
;; The actual machine
|
|
|
|
|
|
|
|
(operating-system
|
|
|
|
(locale "en_US.utf8")
|
|
|
|
(timezone "Europe/Rome")
|
|
|
|
(keyboard-layout
|
2020-07-07 18:18:42 +02:00
|
|
|
(keyboard-layout "us" "winkeys"))
|
2019-05-21 16:41:07 +02:00
|
|
|
|
|
|
|
(kernel-arguments '("vga=791"))
|
|
|
|
|
2019-11-27 16:26:42 +01:00
|
|
|
(initrd-modules (append (list "hpsa") ;; Smart Array P420i controller
|
2019-06-11 20:35:01 +02:00
|
|
|
%base-initrd-modules))
|
|
|
|
|
2019-05-21 16:41:07 +02:00
|
|
|
(bootloader
|
2019-06-11 20:35:01 +02:00
|
|
|
(bootloader-configuration
|
|
|
|
(bootloader grub-bootloader)
|
|
|
|
(target "/dev/sda")
|
|
|
|
(keyboard-layout keyboard-layout)))
|
|
|
|
|
2019-05-21 16:41:07 +02:00
|
|
|
(file-systems
|
2019-06-11 20:35:01 +02:00
|
|
|
(cons* (file-system
|
|
|
|
(mount-point "/")
|
|
|
|
(device
|
2020-07-07 18:18:42 +02:00
|
|
|
(uuid "5ec7b1a5-3db5-49d6-87d8-452931db91c4"))
|
2019-06-11 20:35:01 +02:00
|
|
|
(type "btrfs"))
|
|
|
|
%base-file-systems))
|
2019-05-21 16:41:07 +02:00
|
|
|
|
|
|
|
(swap-devices '("/dev/sda2"))
|
2019-06-11 20:35:01 +02:00
|
|
|
|
2019-05-21 16:41:07 +02:00
|
|
|
(host-name "milano-guix-1")
|
|
|
|
|
|
|
|
(users (append %accounts %base-user-accounts))
|
2019-06-11 20:35:01 +02:00
|
|
|
|
2020-07-07 18:18:42 +02:00
|
|
|
(packages (cons* btrfs-progs screen tmux openssh strace
|
2019-10-02 08:43:15 +02:00
|
|
|
nss-certs ; Needed for the Guix Data Service
|
|
|
|
%base-packages))
|
2019-05-21 16:41:07 +02:00
|
|
|
|
|
|
|
;; Services
|
2019-06-11 20:35:01 +02:00
|
|
|
(services
|
|
|
|
(append (list
|
|
|
|
(service dhcp-client-service-type)
|
|
|
|
|
|
|
|
(service openssh-service-type
|
|
|
|
(openssh-configuration
|
|
|
|
(port-number 22)
|
2019-10-01 16:10:57 +02:00
|
|
|
(extra-content "ListenAddress 0.0.0.0")
|
2019-06-11 20:35:01 +02:00
|
|
|
(authorized-keys
|
|
|
|
`(("degrees380" ,(local-file "keys/ssh/degrees380.pub"))
|
|
|
|
("bayfront" ,(local-file "keys/ssh/bayfront.pub"))
|
|
|
|
("atrent" ,(local-file "keys/ssh/atrent.pub"))
|
|
|
|
("ludo" ,(local-file "keys/ssh/ludo.pub"))
|
|
|
|
("andreas" ,(local-file "keys/ssh/andreas.pub"))
|
|
|
|
("cbaines" ,(local-file "keys/ssh/cbaines.pub"))
|
|
|
|
("rekado" ,(local-file "keys/ssh/rekado.pub"))))))
|
|
|
|
|
|
|
|
(service ntp-service-type)
|
|
|
|
|
|
|
|
(service qemu-binfmt-service-type
|
|
|
|
(qemu-binfmt-configuration
|
|
|
|
(platforms (lookup-qemu-platforms "arm" "aarch64"))
|
|
|
|
(guix-support? #t)))
|
|
|
|
|
2019-10-02 08:43:15 +02:00
|
|
|
(service postgresql-service-type
|
|
|
|
(postgresql-configuration
|
|
|
|
(config-file
|
|
|
|
(postgresql-config-file
|
|
|
|
(hba-file
|
|
|
|
(plain-file "pg_hba.conf"
|
|
|
|
"
|
|
|
|
local all all trust
|
|
|
|
host all all 127.0.0.1/32 md5
|
|
|
|
host all all ::1/128 md5
|
|
|
|
"))
|
|
|
|
(extra-config
|
|
|
|
'(("work_mem" "'500MB'")))))))
|
|
|
|
|
2020-07-07 18:18:42 +02:00
|
|
|
;; (service guix-data-service-type
|
|
|
|
;; (guix-data-service-configuration
|
|
|
|
;; (getmail-idle-mailboxes '("Commits"))
|
|
|
|
;; (commits-getmail-retriever-configuration
|
|
|
|
;; (getmail-retriever-configuration
|
|
|
|
;; (type "SimpleIMAPSSLRetriever")
|
|
|
|
;; (server "imap.cbaines.net")
|
|
|
|
;; (port 993)
|
|
|
|
;; (username "patchwork")
|
|
|
|
;; (password-command
|
|
|
|
;; (list (file-append coreutils "/bin/cat")
|
|
|
|
;; "/etc/guix-data-service-commits-imap-password"))
|
|
|
|
;; (extra-parameters
|
|
|
|
;; '((mailboxes . ("Commits"))))))))
|
|
|
|
|
|
|
|
;; (service nginx-service-type %nginx-configuration)
|
2019-10-02 08:43:15 +02:00
|
|
|
|
2019-06-11 20:35:01 +02:00
|
|
|
(service mcron-service-type
|
|
|
|
(mcron-configuration
|
|
|
|
(jobs (list gc-job btrfs-job)))))
|
|
|
|
|
|
|
|
(modify-services %base-services
|
|
|
|
(guix-service-type config =>
|
|
|
|
(guix-configuration
|
|
|
|
(inherit config)
|
|
|
|
(use-substitutes? #f)
|
|
|
|
(authorized-keys
|
|
|
|
%authorized-guix-keys)))))))
|