configurations-guix/config.scm

;; Ceci est une configuration de système d'exploitation générée par
;; l'installateur graphique.
;;
;; Une fois l'installation terminée, vous pouvez apprendre à modifier
;; ce fichier pour ajuster la configuration du système et le passer à
;; la commande « guix system reconfigure » pour rendre vos changements
;; effectifs.


;; Indique quels modules importer pour accéder aux variables
;; utilisées dans cette configuration.
(use-modules (gnu))
(use-modules (srfi srfi-1))
(use-modules (gnu system setuid) (gnu packages cups))
(use-service-modules cups desktop networking ssh xorg virtualization vpn security-token)

;; Configuration sudoer personnalisée
(define %sudoers-specification
  (plain-file "sudoers" "\
root ALL=(ALL) ALL
%wheel ALL=(ALL) NOPASSWD: ALL
"))

;; Configuration spice personnalisée
;; Permet le partage de périphériques USB via virt-manager
;; Permet l'utilisation d'une nitrokey
(define %spice-rules
  (udev-rule
    "41-spice-and-nitrokey.rules"
    (string-append "\
SUBSYSTEM==\"usb\", GROUP=\"spice\", MODE=\"0660\"
SUBSYSTEM==\"usb_device\", GROUP=\"spice\", MODE=\"0660\"
ACTION!=\"add|change\", GOTO=\"u2f_end\"
KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"2581\", ATTRS{idProduct}==\"f1d0\", TAG+=\"uaccess\"
KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"4287\", TAG+=\"uaccess\"
KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42b1\", TAG+=\"uaccess\"
KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42b2\", TAG+=\"uaccess\"
KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42dd\", TAG+=\"uaccess\"
ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42e8\", TAG+=\"uaccess\"
LABEL=\"u2f_end\"
SUBSYSTEM!=\"usb\", GOTO=\"gnupg_rules_end\"
ACTION!=\"add\", GOTO=\"gnupg_rules_end\"
ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4107\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\"
ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4108\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\"
ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42b4\", TAG+=\"uaccess\"
ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4109\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\"
ATTR{idVendor}==\"03eb\", ATTR{idProduct}==\"2ff1\", TAG+=\"uaccess\"
ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4211\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\"
ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4230\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\"
LABEL=\"gnupg_rules_end\"
KERNEL==\"sd?1\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"4109\", SYMLINK+=\"nitrospace\"
")))

;; Configuration du système
;; C'est le point d'entrée de la configuration
(operating-system
  (locale "fr_FR.utf8")
  (timezone "Europe/Paris")
  (keyboard-layout (keyboard-layout "fr" "oss"))
  (host-name "n-guix-fix")

  ;; Application de la configuration sudoer personnalisée (définie plus haut)
  (kernel-arguments
    (list "modprobe.blacklist=pcspkr,usbmouse,usbkbd" "iommu=pt" "nouveau.config=NvClkMode=15"))

  (initrd-modules (append (list "vfio-pci" "vfio_iommu_type1" "dm-raid" "dm-cache" "dm-crypt") %base-initrd-modules))
      
  (sudoers-file %sudoers-specification)

  ;; La liste des comptes utilisateurs (« root » est implicite).
  (users (cons* (user-account
                  (name "neox")
                  (comment "neox")
                  (group "users")
                  (home-directory "/home/neox")
                  (supplementary-groups '("users" "wheel" "netdev" "audio" "video" "libvirt" "kvm" "scanner" "spice" "cdrom" "lpadmin")))
                %base-user-accounts))

  (setuid-programs
    (append (list 
              (setuid-program
                (program (file-append (specification->package "cdrtools") "/bin/cdrecord")))
              (setuid-program
                (program (file-append (specification->package "cdrtools") "/bin/readcd")))
              (setuid-program
                (program (file-append (specification->package "cdrtools") "/bin/mkisofs")))
              (setuid-program
                (program (file-append (specification->package "cdrdao") "/bin/cdrdao"))))	
            %setuid-programs))

  ;; Quelques paquets installés au niveau du système.
  ;; On installe notamment network-manager et son extension pour openvpn, 
  ;; ou encore libvirt/virt-manager pour la virtualisation
  (packages (append (list (specification->package "nss-certs")
                          (specification->package "qemu")
                          (specification->package "virt-manager")
                          (specification->package "libvirt") 
                          (specification->package "lvm2") 
                          (specification->package "mdadm") 
                          (specification->package "network-manager")
                          (specification->package "network-manager-openvpn")
                          (specification->package "xf86-video-ati")
                          (specification->package "thin-provisioning-tools"))
                    %base-packages))

  ;; Services du système.
  ;; On en profite pour modifier le comportement par défaut de quelques services.
  (services
    (modify-services (append (list
      (service gnome-desktop-service-type)
      
      ;; Service de gestion des clés de chiffrement physique
      (service pcscd-service-type)

      (service openssh-service-type
        (openssh-configuration
          (x11-forwarding? #t)
          (permit-root-login 'prohibit-password)))

      ;; Service impression et scanner
      (service cups-service-type
          (cups-configuration
            (web-interface? #t)
            (extensions
              (list cups-filters epson-inkjet-printer-escpr hplip-minimal))))

      (service sane-service-type)
              
      ;; Service KVM/Libvirt pour virt-manager
      (service libvirt-service-type)
      (service virtlog-service-type)
      
      ;; Application de la configuration spice personnalisée (définie plus haut)
      (udev-rules-service 'spice %spice-rules #:groups '("spice"))

      ;; Modification des limites mémoires pour les accès audio temps réel
      ;; (utile notamment pour Ardour)
      (service pam-limits-service-type
        (list
          (pam-limits-entry "@audio" 'both 'rtprio 99)
          (pam-limits-entry "@audio" 'both 'memlock 'unlimited)))

      ;; Configuration de l'environnement graphique (notamment clavier)
      (set-xorg-configuration
        (xorg-configuration (keyboard-layout keyboard-layout))))
        %desktop-services)

    ;; Configuration du service network-manager pour prendre en charge
    ;; OpenVPN
    (network-manager-service-type config => (network-manager-configuration 
      (inherit config)
      (vpn-plugins
        (list (specification->package "network-manager-openvpn")))))

    (guix-service-type config => (guix-configuration
      (inherit config)
      (extra-options '("--cores=10"))))))

  ;; Chargeur de démarrage (GRUB)
  ;; On indique ici où il doit être installé et comment le configurer
  (bootloader (bootloader-configuration
                (bootloader grub-efi-bootloader)
                (targets (list "/boot/efi"))
                (keyboard-layout keyboard-layout)))

  ;; Périphériques mappés
  ;; On configure notamment ici les partitions chiffrées (LUKS)
  (mapped-devices
   (list
    (mapped-device
      (source "HOMERAID")
      (target "HOMERAID-HOMERAID_data")
      (type lvm-device-mapping))
    (mapped-device
      (source "/dev/mapper/HOMERAID-HOMERAID_data")
      (target "luks-f0a72a6c-499b-4445-8d13-21dc99337752")
      (type luks-device-mapping))))

  ;; La liste des systèmes de fichiers montés au démarrage
  ;; On configure ici le montage des partitions chiffrées et non chiffrées  
  (file-systems 
    (cons* 
      (file-system
        (mount-point "/wiab")
        (device (uuid "2a13cf03-fc71-44ac-8e1a-d6744201336f" 'ext4))
        (create-mount-point? #t)
        (type "ext4"))
      (file-system
        (mount-point "/")
        (device (uuid "2e44f3f7-bb6b-43ac-933a-e8992bf10d29" 'ext4))
        (type "ext4"))
      (file-system
        (mount-point "/home")
        (device "/dev/mapper/luks-f0a72a6c-499b-4445-8d13-21dc99337752")
        (type "ext4")
        (dependencies mapped-devices))
      (file-system
        (mount-point "/boot/efi")
        (device (uuid "DC58-946E" 'fat32))
        (type "vfat"))
     %base-file-systems)))