;; Ceci est une configuration de système d'exploitation générée par ;; l'installateur graphique. ;; ;; Une fois l'installation terminée, vous pouvez apprendre à modifier ;; ce fichier pour ajuster la configuration du système et le passer à ;; la commande « guix system reconfigure » pour rendre vos changements ;; effectifs. ;; Indique quels modules importer pour accéder aux variables ;; utilisées dans cette configuration. (use-modules (gnu)) (use-modules (guix inferior) (guix channels)) (use-modules (srfi srfi-1)) (use-modules (gnu system setuid) (gnu packages cups)) (use-modules (nongnu packages linux) (nongnu system linux-initrd)) (use-service-modules cups desktop networking ssh xorg virtualization vpn) ;; Configuration sudoer personnalisée (define %sudoers-specification (plain-file "sudoers" "\ root ALL=(ALL) ALL %wheel ALL=(ALL) NOPASSWD: ALL ")) ;; Configuration spice personnalisée ;; Permet le partage de périphériques USB via virt-manager ;; Permet l'utilisation d'une nitrokey (define %spice-rules (udev-rule "41-spice-and-nitrokey.rules" (string-append "\ SUBSYSTEM==\"usb\", GROUP=\"spice\", MODE=\"0660\" SUBSYSTEM==\"usb_device\", GROUP=\"spice\", MODE=\"0660\" ACTION!=\"add|change\", GOTO=\"u2f_end\" KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"2581\", ATTRS{idProduct}==\"f1d0\", TAG+=\"uaccess\" KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"4287\", TAG+=\"uaccess\" KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42b1\", TAG+=\"uaccess\" KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42b2\", TAG+=\"uaccess\" KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42dd\", TAG+=\"uaccess\" ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42e8\", TAG+=\"uaccess\" LABEL=\"u2f_end\" SUBSYSTEM!=\"usb\", GOTO=\"gnupg_rules_end\" ACTION!=\"add\", GOTO=\"gnupg_rules_end\" ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4107\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\" ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4108\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\" ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42b4\", TAG+=\"uaccess\" ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4109\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\" ATTR{idVendor}==\"03eb\", ATTR{idProduct}==\"2ff1\", TAG+=\"uaccess\" ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4211\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\" ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4230\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\" LABEL=\"gnupg_rules_end\" KERNEL==\"sd?1\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"4109\", SYMLINK+=\"nitrospace\" "))) ;; Configuration du système ;; C'est le point d'entrée de la configuration (operating-system (locale "fr_FR.utf8") (timezone "Europe/Paris") (keyboard-layout (keyboard-layout "fr" "oss")) (host-name "n-guix-fix") (kernel linux) (initrd microcode-initrd) (firmware (list linux-firmware)) ;; Application de la configuration sudoer personnalisée (définie plus haut) (kernel-arguments (list "modprobe.blacklist=nouveau,pcspkr,usbmouse,usbkbd" "iommu=pt")) (initrd-modules (append (list "vfio-pci" "vfio_iommu_type1" "dm-raid" "dm-cache" "dm-crypt" "radeon") %base-initrd-modules)) (sudoers-file %sudoers-specification) ;; La liste des comptes utilisateurs (« root » est implicite). (users (cons* (user-account (name "neox") (comment "neox") (group "users") (home-directory "/home/neox") (supplementary-groups '("users" "wheel" "netdev" "audio" "video" "libvirt" "kvm" "scanner" "spice" "cdrom" "lpadmin"))) %base-user-accounts)) (setuid-programs (append (list (setuid-program (program (file-append (specification->package "cdrtools") "/bin/cdrecord"))) (setuid-program (program (file-append (specification->package "cdrtools") "/bin/readcd"))) (setuid-program (program (file-append (specification->package "cdrtools") "/bin/mkisofs"))) (setuid-program (program (file-append (specification->package "cdrdao") "/bin/cdrdao")))) %setuid-programs)) ;; Quelques paquets installés au niveau du système. ;; On installe notamment network-manager et son extension pour openvpn, ;; ou encore libvirt/virt-manager pour la virtualisation (packages (append (list (specification->package "nss-certs") (specification->package "qemu") (specification->package "virt-manager") (specification->package "libvirt") (specification->package "lvm2") (specification->package "mdadm") (specification->package "network-manager") (specification->package "network-manager-openvpn") (specification->package "xf86-video-ati") (specification->package "thin-provisioning-tools")) %base-packages)) ;; Services du système. ;; On en profite pour modifier le comportement par défaut de quelques services. (services (modify-services (append (list (service gnome-desktop-service-type) ;; Service de gestion des clés de chiffrement physique (service pcscd-service-type) (service openssh-service-type (openssh-configuration (x11-forwarding? #t) (permit-root-login 'prohibit-password) (authorized-keys `(("neox" ,(local-file "/home/neox/.ssh/id_rsa.pub")))))) (service cups-service-type (cups-configuration (web-interface? #t) (extensions (list cups-filters epson-inkjet-printer-escpr hplip-minimal)))) ;; Service KVM/Libvirt pour virt-manager (service libvirt-service-type) (service virtlog-service-type) ;; Application de la configuration spice personnalisée (définie plus haut) (udev-rules-service 'spice %spice-rules #:groups '("spice")) ;; Modification des limites mémoires pour les accès audio temps réel ;; (utile notamment pour Ardour) (pam-limits-service (list (pam-limits-entry "@audio" 'both 'rtprio 99) (pam-limits-entry "@audio" 'both 'memlock 'unlimited))) ;; Configuration de l'environnement graphique (notamment clavier) (set-xorg-configuration (xorg-configuration (keyboard-layout keyboard-layout)))) %desktop-services) ;; Configuration du service network-manager pour prendre en charge ;; OpenVPN (network-manager-service-type config => (network-manager-configuration (inherit config) (vpn-plugins (list (specification->package "network-manager-openvpn"))))) (guix-service-type config => (guix-configuration (inherit config) (extra-options '("--cores=10")) (substitute-urls (append (list "https://substitutes.nonguix.org") %default-substitute-urls)) (authorized-keys (append (list (plain-file "non-guix.pub" (string-append "(public-key" " (ecc " " (curve Ed25519)" " (q #C1FD53E5D4CE971933EC50C9F307AE2171A2D3B52C804642A7A35F84F3A4EA98#)))"))) %default-authorized-guix-keys)))))) ;; Chargeur de démarrage (GRUB) ;; On indique ici où il doit être installé et comment le configurer (bootloader (bootloader-configuration (bootloader grub-efi-bootloader) (targets (list "/boot/efi")) (keyboard-layout keyboard-layout))) ;; Périphériques mappés ;; On configure notamment ici les partitions chiffrées (LUKS) (mapped-devices (list (mapped-device (source "HOMERAID") (target "HOMERAID-HOMERAID_data") (type lvm-device-mapping)) (mapped-device (source "/dev/mapper/HOMERAID-HOMERAID_data") (target "luks-f0a72a6c-499b-4445-8d13-21dc99337752") (type luks-device-mapping)))) ;; La liste des systèmes de fichiers montés au démarrage ;; On configure ici le montage des partitions chiffrées et non chiffrées (file-systems (cons* (file-system (mount-point "/wiab") (device (uuid "2a13cf03-fc71-44ac-8e1a-d6744201336f" 'ext4)) (type "ext4")) (file-system (mount-point "/") (device (uuid "2e44f3f7-bb6b-43ac-933a-e8992bf10d29" 'ext4)) (type "ext4")) (file-system (mount-point "/home") (device "/dev/mapper/luks-f0a72a6c-499b-4445-8d13-21dc99337752") (type "ext4") (dependencies mapped-devices)) (file-system (mount-point "/boot/efi") (device (uuid "DC58-946E" 'fat32)) (type "vfat")) %base-file-systems)))