andrew.scm (15858B)

      1 (define-module (system andrew)
      2   #:use-module (system andrew ci)
      3   #:use-module (system andrew minecraft)
      4   #:use-module (guix gexp)
      5   #:use-module (guix packages)
      6   #:use-module (guix modules)
      7   #:use-module (guix git)
      8   #:use-module (gnu bootloader)
      9   #:use-module (gnu bootloader grub)
     10   #:use-module (gnu services)
     11   #:use-module (gnu services base)
     12   #:use-module (gnu services certbot)
     13   #:use-module (gnu services networking)
     14   #:use-module (gnu services version-control)
     15   #:use-module (gnu services shepherd)
     16   #:use-module (gnu services web)
     17   #:use-module (gnu system)
     18   #:use-module (gnu system keyboard)
     19   #:use-module (gnu system shadow)
     20   #:use-module (gnu packages rsync)
     21   #:use-module (gnu packages version-control)
     22   #:use-module (gnu packages wget)
     23   #:use-module (nongnu packages linux)
     24   #:use-module (nongnu system linux-initrd)
     25   #:use-module (mt services)
     26   #:use-module (mt services version-control)
     27   #:use-module (mt system)
     28   #:use-module (mt artwork)
     29   #:use-module (mt utils)
     30   #:export (andrew-os))
     31 
     32 ;;;
     33 ;;; OS Configuration
     34 ;;;
     35 
     36 (define %issue "
     37 Welcome to \"andrew\" the, first MonasTech server.
     38 ")
     39 
     40 (define %nftables-ruleset
     41   (plain-file "nftables.conf" "\
     42 # A simple and safe firewall
     43 table inet filter {
     44   chain input {
     45     type filter hook input priority 0; policy drop;
     46 
     47     # early drop of invalid connections
     48     ct state invalid drop
     49 
     50     # allow established/related connections
     51     ct state { established, related } accept
     52 
     53     # allow from loopback
     54     iif lo accept
     55     # drop connections to lo not coming from lo
     56     iif != lo ip daddr 127.0.0.1/8 drop
     57     iif != lo ip6 daddr ::1/128 drop
     58 
     59     # allow icmp
     60     ip protocol icmp accept
     61     ip6 nexthdr icmpv6 accept
     62 
     63     # allow ssh
     64     tcp dport ssh accept
     65                
     66     # allow git
     67     tcp dport 9418 accept
     68 
     69     # allow ngninx
     70     tcp dport { 80, 443 } accept
     71 
     72     # allow minecraft java (TCP)
     73     tcp dport 25565 accept
     74 
     75     # allow minecraft bedrock & voice chat (UDP)
     76     udp dport 19132 accept
     77 
     78     # reject everything else
     79     reject with icmpx type port-unreachable
     80   }
     81   chain forward {
     82     type filter hook forward priority 0; policy drop;
     83   }
     84   chain output {
     85     type filter hook output priority 0; policy accept;
     86   }
     87 }
     88 "))
     89 
     90 (define %mod-list
     91   (list
     92    (minecraft-mod
     93      (url "https://cdn.modrinth.com/data/P7dR8mSH/versions/q87Wssd1/fabric-api-0.148.2+26.1.2.jar")
     94      (sha256 (base32 "1ar6f4f94yxk06flpknh10y6q8k5yibm6nzjzzrd738jnvyviicr")))
     95    (minecraft-mod
     96      (url "https://cdn.modrinth.com/data/aZj58GfX/versions/h9nSM2ZF/easyauth-mc26.1-3.4.3-SNAPSHOT.48.jar")
     97      (sha256 (base32 "01v14b7r0b95idjqimqa0q3wdyzqmyi3j03bw3n8jpbsqzni613n")))
     98    (minecraft-mod
     99      (url "https://cdn.modrinth.com/data/qpPoAL6m/versions/lOYCVRCp/trade-cycling-fabric-1.0.21+26.1.2.jar")
    100      (sha256 (base32 "0b42a8xdmh9mkriz81jdfhr0j80zf9rxmmhl1fswhymmlhj4hg8y")))
    101    (minecraft-mod
    102      (url "https://cdn.modrinth.com/data/zQhsx8KF/versions/eu63Kj9A/servux-fabric-26.1.2-0.10.2.jar")
    103      (sha256 (base32 "1vv00hrr2sgadlqb7lxl66ncaa9vy5yyaasga43i3yyi77yi20af")))
    104    ;; TODO: Make a helper function for Xaero's
    105    (minecraft-mod
    106      (url "https://cdn.modrinth.com/data/ohNO6lps/versions/mwAOaKnn/ForgeConfigAPIPort-v26.1.4-mc26.1.x-Fabric.jar")
    107      (sha256 (base32 "10k0ki8m6kjz5dsj2jq70v8pj0n9n4z7afi5503z3j8vvhpiyqvv")))
    108    (minecraft-mod
    109      (url "https://cdn.modrinth.com/data/1bokaNcj/versions/65OfA4xM/xaerominimap-fabric-26.1.2-25.3.14.jar")
    110      (sha256 (base32 "00gyxshrc445ridyhl37pljxk3c9c4nc46rgshi3as8fh1zcz410")))
    111    (minecraft-mod
    112      (url "https://cdn.modrinth.com/data/NcUtCpym/versions/nvmFod7S/xaeroworldmap-fabric-26.1.2-1.40.18.jar")
    113      (sha256 (base32 "1mqn2hqhzb0qhvhz2jbfb7zjzsnsvdkwxfbrvlp831alr78m0gq9")))
    114    (minecraft-mod
    115      (url "https://cdn.modrinth.com/data/gF3BGWvG/versions/CHfI2OKD/open-parties-and-claims-fabric-26.1.2-0.26.3.jar")
    116      (sha256 (base32 "07m9mdsiqxyici24cmh75lppnl8hwfpl8cp4248a5074ikra8mig")))
    117    ;; TODO: Make a helper function for geyser
    118    (minecraft-mod
    119      (url "https://cdn.modrinth.com/data/wKkoqHrH/versions/q4Pg0AcC/Geyser-Fabric-2.10.0-b1138.jar")
    120      (sha256 (base32 "1j1gs3kpnp4wfa8sj9s7j3c4aqx4cn33pqcfwz3iska88k54h88i"))
    121      (config (plain-file "config.yml"
    122                          "\
    123 bedrock:
    124   address: 0.0.0.0
    125   port: 19132
    126   clone-remote-port: false
    127 
    128 java:
    129   auth-type: floodgate
    130 
    131 # MOTD settings
    132 motd:
    133   primary-motd: Geyser
    134   secondary-motd: Another Geyser server.
    135   passthrough-motd: true
    136   max-players: 100
    137   passthrough-player-counts: true
    138   integrated-ping-passthrough: true
    139   ping-passthrough-interval: 3
    140 
    141 gameplay:
    142   server-name: Geyser
    143   cooldown-type: crosshair
    144   command-suggestions: true
    145   show-coordinates: true
    146   disable-bedrock-scaffolding: false
    147   nether-roof-workaround: true
    148   emotes-enabled: true
    149   block-legacy-codes: true
    150   unusable-space-block: minecraft:barrier
    151   enable-custom-content: true
    152   force-resource-packs: true
    153   enable-integrated-pack: true
    154   forward-player-ping: false
    155   xbox-achievements-enabled: false
    156   max-visible-custom-skulls: 128
    157   custom-skull-render-distance: 32
    158 
    159 default-locale: system
    160 log-player-ip-addresses: true
    161 
    162 saved-user-logins:
    163   - ThisExampleUsernameShouldBeLongEnoughToNeverBeAnXboxUsername
    164   - ThisOtherExampleUsernameShouldAlsoBeLongEnough
    165 
    166 pending-authentication-timeout: 120
    167 notify-on-new-bedrock-update: true
    168 
    169 advanced:
    170   cache-images: 0
    171   scoreboard-packet-threshold: 20
    172   add-team-suggestions: true
    173   resource-pack-urls: []
    174   floodgate-key-file: key.pem
    175 
    176   java:
    177     use-haproxy-protocol: false
    178     use-direct-connection: true
    179     disable-compression: true
    180 
    181   bedrock:
    182     broadcast-port: 0
    183     compression-level: 6
    184     use-haproxy-protocol: false
    185     haproxy-protocol-whitelisted-ips: []
    186     use-waterdogpe-forwarding: false
    187     mtu: 1400
    188     validate-bedrock-login: true
    189 
    190 enable-metrics: false
    191 debug-mode: false
    192 config-version: 7
    193 "))
    194      (config-subdir "Geyser-Fabric"))
    195    (minecraft-mod
    196      (url "https://cdn.modrinth.com/data/bWrNNfkb/versions/fD4J9lnX/Floodgate-Fabric-2.2.6-b63.jar")
    197      (sha256 (base32 "0bazalawy2md8x1q51vgns4p9847k0bgcs4pnnhvbnp53wljpapl")))
    198    (minecraft-mod
    199      (url "https://cdn.modrinth.com/data/gvQqBUqZ/versions/R7MxYvuW/lithium-fabric-0.24.2+mc26.1.2.jar")
    200      (sha256 (base32 "002fvncv6g6122ark6748lj4b3za0ffa8raz6sdp9qphlbqqjli2")))
    201    (minecraft-mod
    202      (url "https://cdn.modrinth.com/data/fhTDuo6c/versions/YKP6d9vM/TreeTimberFabric-26.1.2-1.0.2.jar")
    203      (sha256 (base32 "1dz5klmsjm12ndlggchhwy5nxcdr6j1hgcf5c1gbhqhpyr6iv42r")))))
    204 
    205 (define andrew-os
    206   (operating-system
    207     (host-name "andrew")
    208     (timezone "America/New_York") ;; Located in vinthill
    209     (locale "en_US.utf8")
    210    
    211     (issue %issue)
    212 
    213     (keyboard-layout (keyboard-layout "us"))
    214 
    215     (kernel linux-lts)
    216     (initrd microcode-initrd)
    217     (firmware (list linux-firmware))
    218 
    219     (bootloader (bootloader-configuration
    220                   (bootloader grub-efi-bootloader)
    221                   (targets '("/boot/efi"))
    222                   (keyboard-layout keyboard-layout)))
    223 
    224     (kernel-arguments '("net.ipv6.conf.all.autoconf=0"
    225                         "net.ipv6.conf.all.accept_ra=0"))
    226 
    227     (swap-devices %mt-swap-devices)
    228 
    229     (file-systems %mt-file-systems)
    230 
    231     (users
    232       (cons*
    233         (user-account
    234           (name "lukejw")
    235           (comment "Luke Willis")
    236           (group "users")
    237           (home-directory "/home/lukejw")
    238           (supplementary-groups '("wheel")))
    239         %base-user-accounts))
    240     
    241     (packages
    242       (cons*
    243         rsync
    244         %mt-base-packages))
    245 
    246     (services
    247      (append
    248       (list (service static-networking-service-type
    249                      (list (static-networking
    250                             (addresses
    251                              (list (network-address
    252                                     (value "147.135.11.131/24")
    253                                     (device "eno1"))
    254                                    (network-address
    255                                     (value "2604:2dc0:100:283::1/128")
    256                                     (device "eno1"))))
    257                             (routes
    258                              (list (network-route
    259                                     (destination "default")
    260                                     (gateway "147.135.11.254"))
    261                                    (network-route
    262                                     (destination "2604:2dc0:100:2ff:ff:ff:ff:ff/128")
    263                                     (device "eno1")
    264                                     (ipv6? #t)
    265                                     (scope 'link))
    266                                    (network-route
    267                                     (destination "default")
    268                                     (gateway "2604:2dc0:100:2ff:ff:ff:ff:ff"))))
    269                             (name-servers '("8.8.8.8" "8.8.4.4" "1.1.1.1")))))
    270             (service nftables-service-type
    271                      (nftables-configuration
    272                        (ruleset %nftables-ruleset)))
    273             (service minecraft-service-type
    274                      (minecraft-configuration
    275                       (properties `(("motd" . "HolyCross SMP - CHADS ONLY")
    276                                     ("level-seed" . "-3181141381111340746")
    277                                     ("difficulty" . "hard")
    278                                     ("allow-flight" . "true")
    279                                     ("white-list" . "true")
    280                                     ("spawn-protection" . "0")
    281                                     ("online-mode" . "true")
    282                                     ("enforce-secure-profile" . "false")))
    283                       (mods %mod-list)))
    284             (service update-channels-locked-service-type '())
    285             (service nginx-service-type
    286                      (nginx-configuration
    287                       (server-blocks
    288                        (list (nginx-server-configuration
    289                               (server-name '("monastech.xyz" "www.monastech.xyz"))
    290                               (listen '("443 ssl"))
    291                               (root "/var/www/monastech.xyz")
    292                               (ssl-certificate "/etc/dehydrated/certs/monastech.xyz/fullchain.pem")
    293                               (ssl-certificate-key "/etc/dehydrated/certs/monastech.xyz/privkey.pem"))
    294                              (nginx-server-configuration
    295                               (server-name '("git.monastech.xyz" "www.git.monastech.xyz"))
    296                               (listen '("443 ssl"))
    297                               (root "/var/www/git.monastech.xyz")
    298                               (ssl-certificate "/etc/dehydrated/certs/monastech.xyz/fullchain.pem")
    299                               (ssl-certificate-key "/etc/dehydrated/certs/monastech.xyz/privkey.pem"))
    300                              (nginx-server-configuration
    301                               (server-name '("files.monastech.xyz" "www.files.monastech.xyz"))
    302                               (listen '("443 ssl"))
    303                               (root "/var/www/files.monastech.xyz")
    304                               (ssl-certificate "/etc/dehydrated/certs/monastech.xyz/fullchain.pem")
    305                               (ssl-certificate-key "/etc/dehydrated/certs/monastech.xyz/privkey.pem"))
    306                              (nginx-server-configuration
    307                               (server-name '("loquat.dev" "www.loquat.dev"))
    308                               (listen '("443 ssl"))
    309                               (root "/var/www/loquat.dev")
    310                               (ssl-certificate "/etc/dehydrated/certs/loquat.dev/fullchain.pem")
    311                               (ssl-certificate-key "/etc/dehydrated/certs/loquat.dev/privkey.pem"))
    312                              (nginx-server-configuration
    313                               (server-name '("orthodox.kitchen" "www.orthodox.kitchen"))
    314                               (listen '("443 ssl"))
    315                               (root "/var/www/orthodox.kitchen")
    316                               (ssl-certificate "/etc/dehydrated/certs/orthodox.kitchen/fullchain.pem")
    317                               (ssl-certificate-key "/etc/dehydrated/certs/orthodox.kitchen/privkey.pem"))
    318                              (nginx-server-configuration
    319                               (server-name '("substitutes.monastech.xyz"))
    320                               (listen '("443 ssl"))
    321                               (ssl-certificate "/etc/dehydrated/certs/monastech.xyz/fullchain.pem")
    322                               (ssl-certificate-key "/etc/dehydrated/certs/monastech.xyz/privkey.pem")
    323                               (locations
    324                                (list (nginx-location-configuration
    325                                       (uri "/")
    326                                       (body (list "proxy_pass http://127.0.0.1:8080;"))))))
    327                              ;; Default HTTP server
    328                              (nginx-server-configuration
    329                               (server-name '("_"))
    330                               (listen '("80 default_server"))
    331                               (root "/var/www/monastech.xyz")
    332                               (locations
    333                                (list ;; Serve ACME challenges 
    334                                      (nginx-location-configuration
    335                                       (uri "^~ /.well-known/acme-challenge")
    336                                       (body (list "alias /var/www/dehydrated;")))
    337                                      ;; Redirect to HTTPS
    338                                      (nginx-location-configuration
    339                                       (uri "/")
    340                                       (body (list "return 301 https://$host$request_uri;")))))))))))
    341       (stagit-services
    342         (stagit-configuration
    343           (admin-pubkey (plain-file
    344                           "lukejw.pub"
    345                           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEZ2qcwpwPdMmrXNrrqjqtuBw8lG9gxlAE+vwcZAHM3L lukejw@moses"))
    346           (www-home "/var/www/git.monastech.xyz")
    347           (clone-domain "monastech.xyz")
    348           (logo (file-append %mt-artwork "/logo-dynamic.svg"))
    349           (stylesheet (plain-file "stylesheet.css" "\
    350 :root {
    351     --bg: #FFFCF0;
    352     --bg-2: #F2F0E5;
    353     --ui: #E6E4D9;
    354     --ui-2: #DAD8CE;
    355     --ui-3: #CECDC3;
    356     --tx: #100F0F;
    357     --tx-2: #6F6E69;
    358     --ye: #AD8301;
    359     --ye-2: #D0A215;
    360     --cy: #24837B;
    361     --cy-2: #3AA99F;
    362 }
    363 
    364 @media (prefers-color-scheme: dark) {
    365     :root {
    366         --bg: #100F0F;
    367         --bg-2: #1C1B1A;
    368         --ui: #282726;
    369         --ui-2: #343331;
    370         --ui-3: #403E3C;
    371         --tx: #CECDC3;
    372         --tx-2: #878580;
    373         --ye: #D0A215;
    374         --ye-2: #AD8301;
    375         --cy: #3AA99F;
    376         --cy-2: #24837B;
    377     }
    378 }
    379 
    380 html {
    381   background-color: var(--bg);
    382   color: var(--tx);
    383   font-family: serif;
    384 }
    385 
    386 body {
    387   width: 100%;
    388   max-width: 72rem;
    389   margin-inline: auto;
    390 }
    391 
    392 #header {
    393   margin-inline: 1rem;
    394 }
    395 
    396 hr {
    397   border: 0.1rem solid var(--ui);
    398   margin-inline: 1rem;
    399 }
    400 
    401 #content {
    402   margin-inline: 1rem;
    403 }
    404 
    405 a {
    406   color: var(--cy);
    407   text-decoration: none;
    408 }
    409 
    410 a:hover {
    411   color: var(--cy-2);
    412   text-decoration: underline;
    413 }
    414 
    415 #header img {
    416   width: 6.75rem;
    417   height: 4.5rem;
    418 }
    419 
    420 #header h1 {
    421   margin: 0 0 0.5rem 0;
    422   font-size: 2rem;
    423   font-weight: normal;
    424   border-bottom: 2px solid var(--ui);
    425 }
    426 
    427 #header .desc {
    428   color: var(--tx-2);
    429 }
    430 
    431 #header tbody tr:last-child td {
    432   padding-top: 0.4rem;
    433 }
    434 
    435 #header .url > td:nth-child(2) {
    436   font-family: monospace;
    437   padding: 0.2rem 0.6rem;
    438   border-radius: 0.5rem;
    439   background-color: var(--bg-2);
    440 }
    441 
    442 #files tbody {
    443   font-family: monospace;
    444 }
    445 
    446 #files tbody > tr td:first-child {
    447   width: 0;
    448   white-space: nowrap;
    449   padding-right: 1rem;
    450 }
    451 
    452 #content table {
    453   width: 100%;
    454   border-collapse: collapse;
    455 }
    456 
    457 #content td {
    458   padding: 1rem;
    459 }
    460 
    461 #content tbody tr:hover {
    462 	background: var(--bg-2);
    463 }
    464 
    465 #content td {
    466   padding: 0.3rem;
    467 }
    468 "))))
    469       %mt-bishop-services))))
    470 
    471 andrew-os