diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..d25da52 --- /dev/null +++ b/.gitignore @@ -0,0 +1,5 @@ +*~ +\#*\# +id_ed25519 +id_ed25519.pub +signing-key.pub diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..a5cceec --- /dev/null +++ b/Makefile @@ -0,0 +1,40 @@ +# Copyright (C) 2023 Denis 'GNUtoo' Carikli +# +# This file is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or (at +# your option) any later version. +# +# You should have received a copy of the GNU General Public License +# along with this file. If not, see . + +DESTDIR ?= . + +.PHONY: all help install update $(DESTDIR)/mumble-vm.img + +IMAGE_SOURCE = \ + mumble-vm-system.scm \ + id_ed25519.pub \ + Makefile \ + signing-key.pub + +all: help + +help: + @printf "Available commands:\n\ + make help # prints this help\n\ + make install # install image to $(DESTDIR)/ \n\ + make deploy # update existing vm with guix deploy through SSH\n\ + " + +$(DESTDIR)/mumble-vm.img: $(IMAGE_SOURCE) + sudo install \ + `guix system image \ + --image-type=mbr-raw \ + --image-size=6G mumble-vm-system.scm` \ + $@ + +install: $(DESTDIR)/mumble-vm.img + +deploy: + guix deploy -L . mumble-vm-machine.scm diff --git a/mumble-vm-machine.scm b/mumble-vm-machine.scm new file mode 100644 index 0000000..f2d8174 --- /dev/null +++ b/mumble-vm-machine.scm @@ -0,0 +1,38 @@ +;;; Copyright © Guix documentation authors +;;; Copyright © 2022 Denis 'GNUtoo' Carikli +;;; +;;; This file is free software; you can redistribute it and/or modify it +;;; under the terms of the GNU General Public License as published by +;;; the Free Software Foundation; either version 3 of the License, or (at +;;; your option) any later version. +;;; +;;; This file is distributed in the hope that it will be useful, but +;;; WITHOUT ANY WARRANTY; without even the implied warranty of +;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +;;; GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License +;;; along with this file. If not, see . + +(use-modules (gnu) + (gnu machine) + (gnu machine ssh)) +(list + (machine + (operating-system + (@ (mumble-vm-system) mumble-vm-operating-system)) + (environment managed-host-environment-type) + (configuration + (machine-ssh-configuration + (authorize? #t) + (build-locally? #f) + (host-key + (string-append + "ssh-ed25519" + " " + "AAAABBBBCCCCDDDDEEEEFFFFF1111222233334444555566667777888899990000ABC")) + (host-name "audio.experimental.a-lec.org") + (identity "./id_ed25519") + (port 222) + (system "x86_64-linux") + (user "root"))))) diff --git a/mumble-vm-system.scm b/mumble-vm-system.scm new file mode 100644 index 0000000..26648b4 --- /dev/null +++ b/mumble-vm-system.scm @@ -0,0 +1,93 @@ +;; Copyright (C) 2023 Denis 'GNUtoo' Carikli +;; +;; This file is free software; you can redistribute it and/or modify it +;; under the terms of the GNU General Public License as published by +;; the Free Software Foundation; either version 3 of the License, or (at +;; your option) any later version. +;; +;; You should have received a copy of the GNU General Public License +;; along with this file. If not, see . + +(define-module (mumble-vm-system) + #:use-module (gnu) + #:use-module (gnu packages admin) + #:use-module (gnu packages dns) + #:use-module (gnu packages linux) + #:use-module (gnu packages ssh) + #:use-module (gnu services admin) + #:use-module (gnu services ssh) + #:export (mumble-vm-operating-system)) + +(define-public %nginx-deploy-hook + (program-file + "nginx-deploy-hook" + #~(let + ((nginx-pid (call-with-input-file "/var/run/nginx/pid" read)) + (mumble-server-pid + (call-with-input-file + "/var/run/mumble-server/mumble-server.pid" read))) + ((lambda _ + (kill nginx-pid SIGHUP) + (kill mumble-server-pid SIGUSR1)))))) + +(define mumble-vm-operating-system + (operating-system + (bootloader (bootloader-configuration + (bootloader grub-minimal-bootloader) + (targets '("/dev/vda")))) + ;; TODO: Does Mumble have some data? Is BTRFS safer than using ext4 + ;; without doing many fsck? + (file-systems (cons (file-system + (device (file-system-label "Guix_image")) + (mount-point "/") + (type "ext4")) %base-file-systems)) + (host-name "mumble-vm") + (timezone "Europe/Paris") + (packages + (append + (list htop + iftop + `(,isc-bind "utils") + net-tools + nmon + openssh-sans-x) + %base-packages)) + (services + (append + (list + ;; Networking + (service + static-networking-service-type + (list + (static-networking + (addresses (list (network-address + (device "eth0") + (value "192.168.10.37/24")))) + (routes (list (network-route + (destination "default") + (gateway "192.168.10.1")))) + (name-servers '("192.168.10.1"))))) + ;; OpenSSH + (service openssh-service-type + (openssh-configuration + (openssh openssh-sans-x) + (use-pam? #f) + (port-number 222) + (permit-root-login #t) + (password-authentication? #f) + (challenge-response-authentication? #f) + (authorized-keys + `(("root" , (local-file "id_ed25519.pub")) + ("gnutoo" ,(local-file "id_ed25519.pub")))))) + ;; Unattended Upgrades + (service unattended-upgrade-service-type)) + (modify-services + %base-services + (guix-service-type config => (guix-configuration + (authorized-keys + (append + (list + (local-file + "signing-key.pub")) + %default-authorized-guix-keys))))))))) +mumble-vm-operating-system diff --git a/mumble-vm.xml b/mumble-vm.xml new file mode 100644 index 0000000..9876123 --- /dev/null +++ b/mumble-vm.xml @@ -0,0 +1,90 @@ + + mumble-vm + 4194304 + 4194304 + + /machine + + + hvm + + + + + + + + + + + + + + destroy + restart + destroy + + + + + + /usr/bin/qemu-system-x86_64 + + + + +
+ + +
+ + + +
+ + + +
+ + + +
+ + + + + +
+ + + + + + + + + + + + + + + +