neox
/
configurations-guix
1
0
Fork 0
Code Issues 2 Pull Requests Releases Activity
configurations-guix/config.scm

219 lines
9.2 KiB
Scheme
Raw Blame History

;; Ceci est une configuration de système d'exploitation générée par
;; l'installateur graphique.
;;
;; Une fois l'installation terminée, vous pouvez apprendre à modifier
;; ce fichier pour ajuster la configuration du système et le passer à
;; la commande « guix system reconfigure » pour rendre vos changements
;; effectifs.
;; Indique quels modules importer pour accéder aux variables
;; utilisées dans cette configuration.
(use-modules (gnu))
(use-modules (guix inferior) (guix channels))
(use-modules (srfi srfi-1))
(use-modules (gnu system setuid) (gnu packages cups))
(use-modules (nongnu packages linux) (nongnu system linux-initrd))
(use-service-modules cups desktop networking ssh xorg virtualization vpn)
;; Configuration sudoer personnalisée
(define %sudoers-specification
(plain-file "sudoers" "\
root ALL=(ALL) ALL
%wheel ALL=(ALL) NOPASSWD: ALL
"))
;; Configuration spice personnalisée
;; Permet le partage de périphériques USB via virt-manager
;; Permet l'utilisation d'une nitrokey
(define %spice-rules
(udev-rule
"41-spice-and-nitrokey.rules"
(string-append "\
SUBSYSTEM==\"usb\", GROUP=\"spice\", MODE=\"0660\"
SUBSYSTEM==\"usb_device\", GROUP=\"spice\", MODE=\"0660\"
ACTION!=\"add|change\", GOTO=\"u2f_end\"
KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"2581\", ATTRS{idProduct}==\"f1d0\", TAG+=\"uaccess\"
KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"4287\", TAG+=\"uaccess\"
KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42b1\", TAG+=\"uaccess\"
KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42b2\", TAG+=\"uaccess\"
KERNEL==\"hidraw*\", SUBSYSTEM==\"hidraw\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42dd\", TAG+=\"uaccess\"
ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42e8\", TAG+=\"uaccess\"
LABEL=\"u2f_end\"
SUBSYSTEM!=\"usb\", GOTO=\"gnupg_rules_end\"
ACTION!=\"add\", GOTO=\"gnupg_rules_end\"
ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4107\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\"
ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4108\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\"
ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"42b4\", TAG+=\"uaccess\"
ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4109\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\"
ATTR{idVendor}==\"03eb\", ATTR{idProduct}==\"2ff1\", TAG+=\"uaccess\"
ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4211\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\"
ATTR{idVendor}==\"20a0\", ATTR{idProduct}==\"4230\", ENV{ID_SMARTCARD_READER}=\"1\", ENV{ID_SMARTCARD_READER_DRIVER}=\"gnupg\", TAG+=\"uaccess\"
LABEL=\"gnupg_rules_end\"
KERNEL==\"sd?1\", ATTRS{idVendor}==\"20a0\", ATTRS{idProduct}==\"4109\", SYMLINK+=\"nitrospace\"
")))
;; Configuration du système
;; C'est le point d'entrée de la configuration
(operating-system
(locale "fr_FR.utf8")
(timezone "Europe/Paris")
(keyboard-layout (keyboard-layout "fr" "oss"))
(host-name "n-guix-fix")
(kernel linux)
(initrd microcode-initrd)
(firmware (list linux-firmware))
;; Application de la configuration sudoer personnalisée (définie plus haut)
(kernel-arguments
(list "modprobe.blacklist=nouveau,pcspkr,usbmouse,usbkbd" "iommu=pt"))
(initrd-modules (append (list "vfio-pci" "vfio_iommu_type1" "dm-raid" "dm-cache" "dm-crypt" "radeon") %base-initrd-modules))
(sudoers-file %sudoers-specification)
;; La liste des comptes utilisateurs (« root » est implicite).
(users (cons* (user-account
(name "neox")
(comment "neox")
(group "users")
(home-directory "/home/neox")
(supplementary-groups '("users" "wheel" "netdev" "audio" "video" "libvirt" "kvm" "scanner" "spice" "cdrom" "lpadmin")))
%base-user-accounts))
(setuid-programs
(append (list
(setuid-program
(program (file-append (specification->package "cdrtools") "/bin/cdrecord")))
(setuid-program
(program (file-append (specification->package "cdrtools") "/bin/readcd")))
(setuid-program
(program (file-append (specification->package "cdrtools") "/bin/mkisofs")))
(setuid-program
(program (file-append (specification->package "cdrdao") "/bin/cdrdao"))))
%setuid-programs))
;; Quelques paquets installés au niveau du système.
;; On installe notamment network-manager et son extension pour openvpn,
;; ou encore libvirt/virt-manager pour la virtualisation
(packages (append (list (specification->package "nss-certs")
(specification->package "qemu")
(specification->package "virt-manager")
(specification->package "libvirt")
(specification->package "lvm2")
(specification->package "mdadm")
(specification->package "network-manager")
(specification->package "network-manager-openvpn")
(specification->package "xf86-video-ati")
(specification->package "thin-provisioning-tools"))
%base-packages))
;; Services du système.
;; On en profite pour modifier le comportement par défaut de quelques services.
(services
(modify-services (append (list
(service gnome-desktop-service-type)
;; Service de gestion des clés de chiffrement physique
(service pcscd-service-type)
(service openssh-service-type
(openssh-configuration
(x11-forwarding? #t)
(permit-root-login 'prohibit-password)
(authorized-keys
`(("neox" ,(local-file "/home/neox/.ssh/id_rsa.pub"))))))
(service cups-service-type
(cups-configuration
(web-interface? #t)
(extensions
(list cups-filters epson-inkjet-printer-escpr hplip-minimal))))
;; Service KVM/Libvirt pour virt-manager
(service libvirt-service-type)
(service virtlog-service-type)
;; Application de la configuration spice personnalisée (définie plus haut)
(udev-rules-service 'spice %spice-rules #:groups '("spice"))
;; Modification des limites mémoires pour les accès audio temps réel
;; (utile notamment pour Ardour)
(pam-limits-service
(list
(pam-limits-entry "@audio" 'both 'rtprio 99)
(pam-limits-entry "@audio" 'both 'memlock 'unlimited)))
;; Configuration de l'environnement graphique (notamment clavier)
(set-xorg-configuration
(xorg-configuration (keyboard-layout keyboard-layout))))
%desktop-services)
;; Configuration du service network-manager pour prendre en charge
;; OpenVPN
(network-manager-service-type config => (network-manager-configuration
(inherit config)
(vpn-plugins
(list (specification->package "network-manager-openvpn")))))
(guix-service-type config => (guix-configuration
(inherit config)
(extra-options '("--cores=10"))
(substitute-urls
(append (list "https://substitutes.nonguix.org")
%default-substitute-urls))
(authorized-keys
(append
(list
(plain-file "non-guix.pub"
(string-append
"(public-key"
" (ecc "
" (curve Ed25519)"
" (q #C1FD53E5D4CE971933EC50C9F307AE2171A2D3B52C804642A7A35F84F3A4EA98#)))")))
%default-authorized-guix-keys))))))
;; Chargeur de démarrage (GRUB)
;; On indique ici où il doit être installé et comment le configurer
(bootloader (bootloader-configuration
(bootloader grub-efi-bootloader)
(targets (list "/boot/efi"))
(keyboard-layout keyboard-layout)))
;; Périphériques mappés
;; On configure notamment ici les partitions chiffrées (LUKS)
(mapped-devices
(list
(mapped-device
(source "HOMERAID")
(target "HOMERAID-HOMERAID_data")
(type lvm-device-mapping))
(mapped-device
(source "/dev/mapper/HOMERAID-HOMERAID_data")
(target "luks-f0a72a6c-499b-4445-8d13-21dc99337752")
(type luks-device-mapping))))
;; La liste des systèmes de fichiers montés au démarrage
;; On configure ici le montage des partitions chiffrées et non chiffrées
(file-systems
(cons*
(file-system
(mount-point "/wiab")
(device (uuid "2a13cf03-fc71-44ac-8e1a-d6744201336f" 'ext4))
(type "ext4"))
(file-system
(mount-point "/")
(device (uuid "2e44f3f7-bb6b-43ac-933a-e8992bf10d29" 'ext4))
(type "ext4"))
(file-system
(mount-point "/home")
(device "/dev/mapper/luks-f0a72a6c-499b-4445-8d13-21dc99337752")
(type "ext4")
(dependencies mapped-devices))
(file-system
(mount-point "/boot/efi")
(device (uuid "DC58-946E" 'fat32))
(type "vfat"))
%base-file-systems)))
Reference in New Issue View Git Blame Copy Permalink