Posts on Thomas Ieong https://ieong.ovh/posts/ Recent content in Posts on Thomas Ieong Hugo -- gohugo.io en-US <a href="https://creativecommons.org/licenses/by-nc/4.0/" target="_blank" rel="noopener">CC BY-NC 4.0</a> Sat, 17 Feb 2024 00:00:00 +0000 How do you find information about Guix? https://ieong.ovh/posts/how-do-you-find-information-about-guix/ Sat, 17 Feb 2024 00:00:00 +0000 https://ieong.ovh/posts/how-do-you-find-information-about-guix/ So you&rsquo;re trying to make some app work on Guix or maybe you have some questions on how to do X or Y, you use google to find what you&rsquo;re looking for but there isn&rsquo;t that much results, not much on stackoverflow either so where are you supposed to look? Everybody in this community (mostly) hang out in mailing lists or IRC, you can see the archive of each of these in the below links: So you’re trying to make some app work on Guix or maybe you have some questions on how to do X or Y, you use google to find what you’re looking for but there isn’t that much results, not much on stackoverflow either so where are you supposed to look?

Everybody in this community (mostly) hang out in mailing lists or IRC, you can see the archive of each of these in the below links:

I highly recommend that you subscribe to these lists, there is an actual subreddit for Guix but not many people there.

If you have a bug or try to package some app not yet in guix, first check this site:

Here is an awesome list for Guix that I found not so long ago:

When I was starting out with this system and had trouble configuring my system to make the wifi, bluetooth works… I found that the most effective thing to do in this situation was to stalk people involved in the project to lift some parts of their configuration, here is a small list I’ve compiled:

Now let say you want to deploy guix in production, where do you find examples?

You want to make nvidia works? Check out the nonguix channel

As of february 2024 this is the PR that makes NVIDIA actually works on my machine https://gitlab.com/nonguix/nonguix/-/merge_requests/328

Finally let’s not forget the official site and the cookbook

Youtube wise last time I checked there wasn’t much content about Guix in general, only videos on the topic were from Andrew Tropin and System Crafters.

]]> Recipes to make Tor,Burp Suite,Android Studio… works on Guix https://ieong.ovh/posts/recipes-to-make-tor-burp-android-works-on-guix/ Sat, 17 Feb 2024 00:00:00 +0000 https://ieong.ovh/posts/recipes-to-make-tor-burp-android-works-on-guix/ Hey quick post on how I managed to get some of these apps running on my machine: Android Studio guix shell --container --network --emulate-fhs -e $&#39;(list (@@ (gnu packages gcc) gcc) &#34;lib&#34;)&#39; --development ungoogled-chromium nss nss-certs libgccjit alsa-lib bash grep sed file libcxx libxkbfile openjdk fuse gtk gtk+ cups --preserve=&#39;^DISPLAY$&#39; --share=/tmp --preserve=&#39;^DBUS_&#39; --expose=/var/run/dbus --expose=/sys/dev --expose=/sys/devices --expose=/dev/dri --share=/home/user --share=/dev/kvm Then I run the emulator with the following flags, they are needed otherwise it crashes. Hey quick post on how I managed to get some of these apps running on my machine:

Android Studio

guix shell --container --network --emulate-fhs        -e $'(list (@@ (gnu packages gcc) gcc) "lib")'        --development ungoogled-chromium        nss nss-certs libgccjit alsa-lib bash grep sed file        libcxx libxkbfile openjdk fuse gtk gtk+ cups        --preserve='^DISPLAY$'        --share=/tmp        --preserve='^DBUS_' --expose=/var/run/dbus        --expose=/sys/dev --expose=/sys/devices --expose=/dev/dri --share=/home/user --share=/dev/kvm

Then I run the emulator with the following flags, they are needed otherwise it crashes.

user@linux ~/Android/Sdk/emulator [env]$ ./emulator -avd Pixel_6_Pro_API_33 -feature -Vulkan -writable-system

Burp Suite

# launch this with shell positionned in $HOME/
guix shell --container --network --emulate-fhs --preserve='DISPLAY|_JAVA.*|DBUS.*|QT.*|SDL.*|XDG.*' --expose=/var/run/dbus --expose=/run/user/$(id -u)  --expose=/sys/dev --expose=/sys/devices --expose=/dev/dri --share=/dev/kvm --development ungoogled-chromium --expression='(list (@@ (gnu packages gcc) gcc) "lib")' coreutils bash grep sed gcc-toolchain patchelf gtk+ dbus-glib libxt libevent openssl glibc file alsa-lib nss nss-certs cups openjdk gzip tar zlib freetype file fontconfig openssh libxext libx11 libxrender libxtst dbus

I think I must have given up on trying to make it work with Guix I don’t remember exactly why, I think it had to do with the embedded chromium browser not working fine, so I ended up just using nix IIRC.

NIXPKGS_ALLOW_UNFREE=1 nix profile install –impure nixpkgs#burpsuite

Bellard’s TextSynth

 guix shell --check --pure --expression='(list (@@ (gnu packages gcc) gcc) "lib")' coreutils bash grep sed gcc-toolchain patchelf gtk+ dbus-glib libxt libevent openssl glibc file alsa-lib libmicrohttpd libjpeg cuda-toolkit@12.3.2 nvidia-driver

FIRST_PART=$(echo "$LIBRARY_PATH" | cut -d ":" -f1)
SECOND_PART=$(echo "$LIBRARY_PATH" | cut -d ":" -f2)

patchelf --set-interpreter $FIRST_PART/ld-linux-x86-64.so.2 ts_server
patchelf --add-needed $FIRST_PART/libjpeg.so.62 ts_server
patchelf --add-needed $FIRST_PART/libmicrohttpd.so.12 ts_server
patchelf --add-needed $FIRST_PART/libstdc++.so.6 ts_server
patchelf --add-needed $FIRST_PART/libgcc_s.so.1 ts_server

patchelf --add-needed $FIRST_PART/libcublasLt.so.12  libnc_cuda.so
patchelf --add-needed $FIRST_PART/libcuda.so.1 libnc_cuda.so

./ts_sd --cuda -m sd_v2.1.bin -o out.jpg "an astronaut riding a horse"

./ts_sd --cuda -m sd_v2.1.bin -o out.jpg "an astronaut riding a horse" -t bf16

Tor Browser

cd Browser
guix shell --check --pure --expression='(list (@@ (gnu packages gcc) gcc) "lib")' coreutils bash grep sed gcc-toolchain patchelf gtk+ dbus-glib libxt libevent openssl glibc file alsa-lib
patchelf --set-interpreter $LIBRARY_PATH/ld-linux-x86-64.so.2 firefox.real
patchelf --set-interpreter $LIBRARY_PATH/ld-linux-x86-64.so.2 updater
patchelf --set-interpreter $LIBRARY_PATH/ld-linux-x86-64.so.2 TorBrowser/Tor/tor

LD_LIBRARY_PATH=$LIBRARY_PATH ./start-tor-browser

See https://gitlab.com/nonguix/nonguix/-/issues/112

Building a kernel

guix shell -D gcc-toolchain ncurses bison bc flex openssl@1.1.1l util-linux make autoconf coreutils sed diffutils bash grep libelf findutils elfutils gawk crypto++ perl gzip kmod

Don't forget to make clean if somethings weird

VSCodium

https://gitlab.com/nonguix/nonguix/-/issues/51

guix shell --container --network --emulate-fhs \
     -e $'(list (@@ (gnu packages gcc) gcc) "lib")' \
     --development ungoogled-chromium \
     nss nss-certs libgccjit alsa-lib bash grep sed file \
     libcxx libxkbfile openjdk fuse gtk gtk+ cups \
     --preserve='^DISPLAY$' \
     --share=/tmp \
     --preserve='^DBUS_' --expose=/var/run/dbus \
     --expose=/sys/dev --expose=/sys/devices --expose=/dev/dri
./VSCodium-1.78.2.23132.glibc2.17-x86_64.AppImage --appimage-extract-and-run
]]> Comment lancer OWASP ZAP dans Gitlab avec l'Automation Framework ? https://ieong.ovh/posts/zaproxy/ Mon, 12 Feb 2024 00:00:00 +0000 https://ieong.ovh/posts/zaproxy/ ZAP est un scanner de sécurité pour des applications web, on m&rsquo;a chargé de le mettre en place au boulot dans la chaîne d&rsquo;intégration. Pour des scénarios simples ça se fait assez facilement, mais dès qu&rsquo;on veut utiliser l&rsquo;outil à pleine puissance la documentation est juste manquante. Là dans notre chaîne on voudrait faire en sorte que ZAP utilise nos tests selenium pour apprendre la structure de notre application, une fois fait ZAP devrait lancer ses scans puis générer un rapport qui sera envoyé par mail, dans notre slack&hellip; ZAP est un scanner de sécurité pour des applications web, on m’a chargé de le mettre en place au boulot dans la chaîne d’intégration.

Pour des scénarios simples ça se fait assez facilement, mais dès qu’on veut utiliser l’outil à pleine puissance la documentation est juste manquante.

Là dans notre chaîne on voudrait faire en sorte que ZAP utilise nos tests selenium pour apprendre la structure de notre application, une fois fait ZAP devrait lancer ses scans puis générer un rapport qui sera envoyé par mail, dans notre slack…

Ça à l’air simple sur le papier mais pour gitlab y’a pas de template ou quoi faut tout réimplémenter et c’est pas simple parce que je me suis heurté à des limitations de gitlab.

Mon premier instinct aurait été d’implémenter ZAP dans un job qui ressemblerait à ça:

zap-vulnerability-test:
  stage: test
  when: manual
  image: big-business-image-containing-zap
  tags:
    - php
  variables:
    ZAP_PLAN_AUTHORITY: "http://10.X.X.X"
    ZAP_PLAN_AUTHORITY_REPORT: "10.X.X.X"
  parallel: 5
  services:
    - selenium-standalone/firefox
    - postgresql
    - name: ghcr.io/zaproxy/zaproxy:2.14.0
      alias: zap
      command: [
        "zap.sh",
        "-cmd",
        "-silent",
        "-host",
        "0.0.0.0",
        "-port",
        "8080",
        "-configfile",
        "config-zap",
        "-autorun",
        "plan.yml"
      ]
  script:
    - # lancer votre commande pour les tests selenium
    - # Une fois que tous les tests sont passé signaler à ZAP qu'il peut lancer les tests

Et là je suis bloqué parce que vu qu’on a plein de tests selenium, je les fait tourner en parallèle, je peux pas utiliser le keyword after_script pour dire que ok tous les tests sont passés, ça marche que pour chaque groupe individuel de test alors qu’on veut que ZAP continue son travail après que l’intégralité des tests soit passé.

Et il est hors de question de lancer les 300 tests dans un seul job donc je vois pas trop de solution à part ne pas utiliser ZAP en tant que service mais plutot le déployer dans un environnement dédié.

J’ai envoyé toute une série de mails https://groups.google.com/g/zaproxy-users/c/TKe1_OrsqOU qui reprend tout ça plus en détail mais pour l’instant pas de réponse et toujours aucun exemple :(

N’hésitez pas à me contacter si vous avez déjà eus affaire à ce genre de cas d’utilisation.

]]> [UPDATED] Guix on Vultr https://ieong.ovh/posts/guix-vultr/ Mon, 05 Feb 2024 00:00:00 +0000 https://ieong.ovh/posts/guix-vultr/ Hey there, Quick post to report back on my experiment with guix on a Vultr VPS. There are 2 options to get a Guix system running: Custom ISO From your Vultr panel you need to add a custom iso, simply points it toward the guix installer iso. Then on your VPS go to server details -&gt; and look for isos, attach your iso. Now this is all good if you want to do things manually but what about something more automatable? Hey there,

Quick post to report back on my experiment with guix on a Vultr VPS.

There are 2 options to get a Guix system running:

Custom ISO

From your Vultr panel you need to add a custom iso, simply points it toward the guix installer iso.

Then on your VPS go to server details -> and look for isos, attach your iso.

Now this is all good if you want to do things manually but what about something more automatable?

Vultr snapshot and guix images

Fortunately Vultr allows you to bring in your own snapshots.

As of 2024 Guix does not provide an equivalent of Preseed/Kickstart or answers file so that’s why we’re not going to make an iso using that feature.

The only way for you to make a pre-made system is via the guix system image api.

The workflow is like this:

  1. Generate an image with the api, in our case we will need to generate an efi-raw image as the vultr snapshot feature only accept those, which is a shame as they do take more space than qcow2

  2. Upload that image to a bucket on S3 (scaleway, aws…)

  3. Download that image on Vultr

  4. When you deploy a news vps look for snapshot, and simply choose the snapshot you downloaded, it will restart with your snapshot.

  5. Resize the partition and the filesystem of the snapshot to match with the HDD/SSD storage volume provided by vultr.

  6. Create a swapfile.

  7. Recreate the /etc/guix/acl file, if this file is missing any guix pull or guix install command will try to build everything instead of using substitutes, I do not know why this is happening so please feel free to ping me.

    For now this is easily fixed with a guix archive command and then a reconfigure.

  8. As a bonus we will explore the setup of an nginx server with tls support.

Creating the image

Here is a sample os.scm:

(use-modules (gnu))

(use-service-modules networking ssh admin virtualization sysctl web mcron certbot)

(use-package-modules bootloaders ssh certs tls python linux disk)

(define garbage-collector-job
  ;; Collect garbage 5 minutes after midnight every day.
  ;; The job's action is a shell command.
  #~(job "5 0 * * *"            ;Vixie cron syntax
       "guix gc -F 1G"))

(define %web-root
  (with-imported-modules '((guix build utils))
    #~(begin
      (use-modules (guix build utils))
      (mkdir-p "/srv/http/YOUR-SITE")

      (call-with-output-file "/srv/http/YOUR-SITE/index.html"
        (lambda (port)
          (display "\
<!DOCTYPE html>
<html>
  <head>
    <title>Welcome to nginx!</title>
    <style>
     html { color-scheme: light dark; }
     body { width: 35em; margin: 0 auto;
       font-family: Tahoma, Verdana, Arial, sans-serif; }
    </style>
  </head>
  <body>
    <h1>Welcome to nginx!</h1>
    <p>If you see this page, the nginx web server is successfully installed and
      working. Further configuration is required.</p>

    <p>For online documentation and support please refer to
      <a href='http://nginx.org/'>nginx.org</a>.<br/>
      Commercial support is available at
      <a href='http://nginx.com/'>nginx.com</a>.</p>

    <p><em>Thank you for using nginx.</em></p>
  </body>
</html>
" port))))))

(operating-system
 (bootloader
  (bootloader-configuration
   (bootloader grub-efi-bootloader)
   (targets (list "/boot/efi"))
   ;; It is very important that terminal-outputs and inputs are set to serial.
   ;; I spent a couple hours trying to debug something that made syslogd using 100% cpu.
   ;; At first I noticed that too many failed attempts when sshing into the box caused a hang.
   ;; Then when I logged into the box via a kvm console I noticed syslog taking all the cpu.
   ;; To find out why I straced the process and discovered that it was trying to write
   ;; "max failed attempts blabla" to /dev/console except that it couldnt it was full of I/O
   ;; exceptions and syslog would try indefinitely to write to /dev/console.
   ;; I also had logs about agetty complaining about ttyS0 not being a real device or something.
   ;; So that's what pointed me towards the GRUB terminal outputs and input config and after
   ;; a bit of fiddling I found a config that worked.
   (terminal-outputs '(serial))
   (terminal-inputs '(serial))
   (serial-unit 0)
   (serial-speed 115200)))

 (host-name "web")

 (sudoers-file (plain-file "sudoers" "\
 root ALL=(ALL) ALL
 %wheel ALL=(ALL) NOPASSWD: ALL
 "))

 (timezone "Etc/UTC")
 (locale "en_US.utf8")

 (swap-devices (list (swap-space
                    (target "/swapfile"))))

 (file-systems (cons*
              (file-system
               (mount-point "/boot")
               (type "vfat")
               (device "/dev/vda1"))
              (file-system
               (mount-point "/")
               (device "/dev/vda2")
               (type "ext4"))
              %base-file-systems))

 (users (cons*
       (user-account
        (name "YOUR-USER")
        (comment "guix user")
        (group "users")
        (supplementary-groups (quote ("wheel")))
        (home-directory "/home/YOUR-USER"))
       %base-user-accounts))

 (packages (cons* nss-certs gnutls python strace parted %base-packages))

 (services (append (list
                  (service dhcp-client-service-type)

                  (service unattended-upgrade-service-type)

                  (service ntp-service-type)

                  (simple-service 'make-web-root
                                  activation-service-type
                                  %web-root)

                  (simple-service 'my-cron-jobs
                                  mcron-service-type
                                  (list garbage-collector-job))

                  (service nginx-service-type
                           (nginx-configuration
                            (server-blocks
                             (list (nginx-server-configuration
                                    (listen '("443 ssl"))
                                    (server-name '("YOUR-SITE"))
                                    (ssl-certificate
                                     "/etc/certs/YOUR-SITE/fullchain.pem")
                                    (ssl-certificate-key
                                     "/etc/certs/YOUR-SITE/privkey.pem")
                                    (root "/srv/http/YOUR-SITE"))))))

                  (service certbot-service-type
                           (certbot-configuration
                            ;; (server "https://acme-staging-v02.api.letsencrypt.org/directory")
                            (email "YOUR-EMAIL")
                            (certificates
                             (list
                              (certificate-configuration
                               (domains '("YOUR-DOMAIN")))))))

                  (service openssh-service-type
                           (openssh-configuration
                            (openssh openssh-sans-x)
                            (permit-root-login #f)
                            (password-authentication? #f)
                            (authorized-keys `(("YOUR-USER" ,(plain-file "YOUR-USER.pub" "\
YOUR-PUBKEY
")))))))
                 %base-services)))

Don’t forget to replace these values:

  • YOUR-USER
  • YOUR-PUBKEY
  • YOUR-SITE
  • YOUR-EMAIL
  • YOUR-DOMAIN

Here is a sample script to create an image from scratch:

#!/usr/bin/env bash
new_name=$1
image=$(guix system image --image-type=efi-raw --image-size=4831838208 --save-provenance os.scm)

cp "$image" .

image_name=$(basename "$image")

chmod +w "$image_name"

mv "$image_name" "$new_name"

Copy it somewhere and name it build-images, make it executable and then invoke it like this:

./build-images my-awesome-vultr-snapshot

The first parameter is a human readable name of the snapshot because by default guix output the image it created into the store and that one has a hash as a name.

You’ll notice that the image size is roughly around 4.5Gb , this is because the filesystem and partition will be resized later as mentionned earlier.

–save-provenance is there so that you can find the os.scm that was used to create the snapshot in /run/current-system/configuration.scm on the running machine.

Upload the image

I chose scaleway because they offer ~70gb for free in object storage.

You can do everything by the gui or the cli(recommended for gb uploads) so not much to say there, just don’t forget to configure the visibility of the object to public or generate a temporary link to share with vultr.

Download from vultr

Products -> Orchestration -> Snapshots -> Add Snapshot -> Upload snapshot from remote machine

Do not forget to tick the UEFI box.

Then:

Products -> Compute -> Deploy new instance -> At the server image section choose your snapshot.

Resize the partition and the filesystem

You should be able to ssh into the machine, once you’re in you’ll just need to resize the partition with parted and the filesystem with resize2fs.

# https://bugs.launchpad.net/ubuntu/+source/parted/+bug/1270203
# I tried to get a command that woud launch without prompting but alas :(
# Just follow the prompt, say fix and answer 2 then 100%
sudo parted  --fix -a opt -m /dev/vda ---pretend-input-tty unit % resizepart 2
sudo echo -e "yes\n100%" | sudo parted --fix -a opt -m /dev/vda ---pretend-input-tty unit % resizepart 2
sudo resize2fs /dev/vda2

A resize filesystem service was discussed on the mailing list https://www.mail-archive.com/help-guix@gnu.org/msg17088.html but nothing merged yet.

If you want to automate this kind of thing in the future you basically have 2 options:

  • Delegate this to an external tool such as Terraform, Pulumi or Ansible…
  • Write custom code in your os.scm that will take care of that, typically this will be implemented as a one-time service, you can use the link I posted earlier for an example.

Create a swapfile

We’ll create a swap file here, but you can use a partition aswell.

It is not enough to have this snippet in your code:

(swap-devices (list (swap-space
                 (target "/swapfile"))))

You really need to create the file with the following commands:

sudo truncate -s 0 /swapfile
# Change the amount of swap according to your requirements
# I picked 512Mb because on the vultr machine I have it has 1gb of ram.
# But you can certainly do much better, there is a plethora of literature
# concerning the optimal size of a swap file.
sudo fallocate -l 512M /swapfile
sudo chmod 0600 /swapfile
sudo mkswap /swapfile

And then start the swap service or reboot.

sudo herd start swap-/swapfile

Again you can write custom code to automate this or use an external tool.

Making substitutes work again

I noticed that any guix pull or install would throw with this warning:

substitute: guix substitute: warning: ACL for archive imports seems to be uninitialized, substitutes may be unavailable

I have no idea why but the /etc/guix/acl file doesn’t get created when you restore the snapshot, this file is necessary otherwise you won’t download packages and build everything from scratch.

The workaround is simple just use the guix archive command to recreate that file and then reconfigure the system.

sudo guix archive --authorize < /run/current-system/profile/share/guix/berlin.guix.gnu.org.pub
sudo guix system reconfigure /run/current-system/configuration.scm

The reconfigure will make sure that you have the acl with the keys you defined in your os.scm or the default ones.

Deploying an nginx site with tls support

In 2023 nginx and certbot didn’t play nice together and you first needed to reconfigure once with only the certbot service defined to get the certificates and a second time with the actual nginx service.

This was needed because if nginx started without a path to a certificate file it would just error out.

Now this has been fixed and you can have the 2 services at the same time from the get go, basically certbot will generate a self signed certificate for nginx to use so that it doesn’t complain about the missing certificate and then the cronjob that run certbot every hour will try to get a new one from let’s encrypt.

If you do not want to wait for the cronjob you can force the renewal with this:

sudo herd start renew-certbot-certificates

Of course be sure to have pointed an A record to your VPS, if anything fails you’ll get the logs in /var/log/letsencrypt

Finally if you want to know when the next certbot command will be run you can check with:

sudo herd schedule mcron

Pro-tip to know which action you can use on a service use:

sudo herd doc mcron list-actions

Conclusion

You should have a guix system up and running.

]]> CCNA https://ieong.ovh/posts/ccna-experience/ Sun, 05 Feb 2023 00:00:00 +0000 https://ieong.ovh/posts/ccna-experience/ Random thoughts about the CCNA. I passed it at the beginning of this month, the test center was quite shit, they gave me a marker that was end of life so I could not write on that tiny board for long. And to add insult to injury they gave me a qwerty which meant I had to type very slowly. Now the exam in itself, I feel it was ok, the labs weren&rsquo;t hard they were quite broad but that&rsquo;s all, I don&rsquo;t know if you had to write mem? Random thoughts about the CCNA.

I passed it at the beginning of this month, the test center was quite shit, they gave me a marker that was end of life so I could not write on that tiny board for long. And to add insult to injury they gave me a qwerty which meant I had to type very slowly.

Now the exam in itself, I feel it was ok, the labs weren’t hard they were quite broad but that’s all, I don’t know if you had to write mem? I only did it 2 out of 3 labs.

Lot of memorization concerning proprietary protocols that I am certainly not going to use like EIGRP, PaGP or the cisco marketing bullshit with meraki, I got 2-3 questions on that and they weren’t technical just marketing.

I ended up speedrunning the exam I had 2:30 to do the exam, I only need 1:30, I thought I had failed but there you go.

The value of certs

Now I don’t think certs bring that much on the table, and I don’t think it"s limited to certs in IT but in general.

It really feels like it’s a business, with all those courses on youtube,udemy, paid exams…

Sure you do have to put in some work to get the damn paper, but it’s not really that hard, like I feel you could just study like a monkey the topic exams, ace the exam and still be not very useful in a real situation where you actually have to put into practice what you have supposedly learnt.

But hey if this can get me a job or atleast a foot in the door I’m not gonna complain I don’t actually have any formal education in IT, so let’s see how this will turn out.

I think I will try to pass the AWS devops and stop there with the certs while they don’t cost much compared to a year in college in the US it’s still 300$.

]]> How do you deal with your favorite package not being in Guix? https://ieong.ovh/posts/how-do-you-deal-with-your-favorite-package-not-being-in-guix/ Sat, 17 Feb 2024 00:00:00 +0000 https://ieong.ovh/posts/how-do-you-deal-with-your-favorite-package-not-being-in-guix/ You have 2 options: Package the missing app yourself and contribute it back to upstream. Give up and just use Nix, the language package manager or just use guix shell and patchelf your way through. Option 1 is fairly involved, depending on how big the dependency tree of your app is you&rsquo;re probably not going to want to do this even if you manage to package the app and want to contribute it back you&rsquo;ll have to get used to the mail workflow, how to use git send-email, patch guidelines&hellip; not that it&rsquo;s particularly hard but if you&rsquo;re just getting started I highly recommend taking it slow and contribute only once you feel comfortable. You have 2 options:

  • Package the missing app yourself and contribute it back to upstream.
  • Give up and just use Nix, the language package manager or just use guix shell and patchelf your way through.

Option 1 is fairly involved, depending on how big the dependency tree of your app is you’re probably not going to want to do this even if you manage to package the app and want to contribute it back you’ll have to get used to the mail workflow, how to use git send-email, patch guidelines… not that it’s particularly hard but if you’re just getting started I highly recommend taking it slow and contribute only once you feel comfortable.

We’ll explore option 2 in this post:

Use nix

Nix is the alternative to Guix if you want to keep using a functional package manager it has been around for a quite a while and the community is a bit bigger, there is also much more packages to choose from.

Just drop this snippet in your configuration.scm:

(service nix-service-type)

And then you can use the usual nix command to install stuff:

nix search nixpkgs#burpsuite
nix profile install nipkgs#burpsuite

I’ll leave you with my config for nix:

Here is my ~/.config/nix/nix.conf

experimental-features = nix-command flakes

The channels that I use

https://github.com/nix-community/home-manager/archive/master.tar.gz home-manager
https://nixos.org/channels/nixpkgs-unstable nixpkgs
https://tadfisher.github.io/android-nixpkgs android-nixpkgs

And my ~/.config/nixpkgs/config.nix file

  {
  allowUnfree = true;
  packageOverrides = pkgs: with pkgs; {
    myPackages = pkgs.buildEnv {
      name = "myPackages";
      paths = [
      scrcpy
      deno
      nodejs
      apktool
      ];
    };
  };
}

Finally you might encounter a weird little bug when you try to launch a nix command, it complains about a pseudo tty missing or something, there is an issue for that on https://issues.guix.gnu.org/ but basically you just have to restart the nix daemon.

sudo herd restart nix-daemon

Use your language package manager

Not much to say here, once you installed say python with guix you can just use pip to install apps not yet packaged in guix.

You might need to change your PATH to ~/.local/bin or wherever your language package manager is storing its binaries but that should be all.

Use Guix shell

If the app that you want is not packaged in Guix,Nix or a language package manager and you just have a binary to work with you’ll have to use ldd and patchelf the headers of that binary to make it work.

I’ll take the TextSynth server from Fabrice Bellard as an example, once you downloaded the ts_zip you’ll have multiple binaries to work with.

If you try to launch them directly it’s going to complain about a file not being there:

-bash: ./ts_sd: Aucun fichier ou dossier de ce type

But what this really means is that the binary complains about missing libraries, to found out which one you’ll have to use ldd, a tool that comes with glibc:lib on guix:

guix shell --check --pure --expression='(list (@@ (gnu packages gcc) gcc) "lib")' coreutils bash grep sed gcc-toolchain patchelf

Then run:

ldd ts_sd

# it yields something like
user@linux ~/Downloads/ts_server_free-2024-01-20 [env]$ ldd ts_sd
      linux-vdso.so.1 (0x00007ffe1655e000)
      libnc.so => /home/user/Downloads/ts_server_free-2024-01-20/./libnc.so (0x00007f1024a00000)
      libjpeg.so.62 => not found
      libm.so.6 => /gnu/store/ln6hxqjvz6m9gdd9s97pivlqck7hzs99-glibc-2.35/lib/libm.so.6 (0x00007f1024d3a000)
      libpthread.so.0 => /gnu/store/ln6hxqjvz6m9gdd9s97pivlqck7hzs99-glibc-2.35/lib/libpthread.so.0 (0x00007f1024d35000)
      libc.so.6 => /gnu/store/ln6hxqjvz6m9gdd9s97pivlqck7hzs99-glibc-2.35/lib/libc.so.6 (0x00007f1024804000)
      libdl.so.2 => /gnu/store/ln6hxqjvz6m9gdd9s97pivlqck7hzs99-glibc-2.35/lib/libdl.so.2 (0x00007f1024d2e000)
      /lib64/ld-linux-x86-64.so.2 => /gnu/store/ln6hxqjvz6m9gdd9s97pivlqck7hzs99-glibc-2.35/lib/ld-linux-x86-64.so.2 (0x00007f1024e19000)

So we know that libjpeg is missing, we use a guix search libjpeg command to see if it’s packaged in guix, fortunately for us it is and we add it to our command line like this:

guix shell --check --pure --expression='(list (@@ (gnu packages gcc) gcc) "lib")' coreutils bash grep sed gcc-toolchain patchelf libjpeg

Now you’ll need to patch the actual binary, one in the guix shell run:

patchelf --add-needed $LIBRARY_PATH/libjpeg.so.62 ts_server

Repeat the process until you have all the libraries that you need, at the end of the day this is what I needed to make it work on my machine:

  guix shell --check --pure --expression='(list (@@ (gnu packages gcc) gcc) "lib")' coreutils bash grep sed gcc-toolchain patchelf gtk+ dbus-glib libxt libevent openssl glibc file alsa-lib libmicrohttpd libjpeg cuda-toolkit@12.3.2 nvidia-driver

FIRST_PART=$(echo "$LIBRARY_PATH" | cut -d ":" -f1)
SECOND_PART=$(echo "$LIBRARY_PATH" | cut -d ":" -f2)

patchelf --set-interpreter $FIRST_PART/ld-linux-x86-64.so.2 ts_server
patchelf --add-needed $FIRST_PART/libjpeg.so.62 ts_server
patchelf --add-needed $FIRST_PART/libmicrohttpd.so.12 ts_server
patchelf --add-needed $FIRST_PART/libstdc++.so.6 ts_server
patchelf --add-needed $FIRST_PART/libgcc_s.so.1 ts_server

patchelf --add-needed $FIRST_PART/libcublasLt.so.12  libnc_cuda.so
patchelf --add-needed $FIRST_PART/libcuda.so.1 libnc_cuda.so

./ts_sd --cuda -m sd_v2.1.bin -o out.jpg "an astronaut riding a horse"

./ts_sd --cuda -m sd_v2.1.bin -o out.jpg "an astronaut riding a horse" -t bf16

Note that you could also have used the –emulate-fhs flag, what it does is basically recreate the usual /usr/lib /lib… file structure and with that I think you could have skipped the various patchelf steps.

What if you don’t want to guix shell every single time? Well you could actually turn this into it’s own package with the patchelf included, you have plenty of examples in the nonguix channel and the guix-games channel.

]]> Guix for a newcomer https://ieong.ovh/posts/guix-newcomer/ Sun, 05 Feb 2023 00:00:00 +0000 https://ieong.ovh/posts/guix-newcomer/ I first heard about Guix from friends on a discord, the declarative configuration that is a full fledged programming language greatly appealed to me. So I decided to give it a try, watched some videos from SystemCrafters and read some pages in the manual and I was good to go. Note that guix is both a system and a package manager, I&rsquo;ll mostly talk about the system in this short post. I first heard about Guix from friends on a discord, the declarative configuration that is a full fledged programming language greatly appealed to me.

So I decided to give it a try, watched some videos from SystemCrafters and read some pages in the manual and I was good to go.

Note that guix is both a system and a package manager, I’ll mostly talk about the system in this short post.

Installation

It’s straightforward the only pain point is that guix has a very strong stance on software freedom and as such it won’t include the blobs necessary for you wifi to work.

That would have been a deal breaker if there was not an easy to use iso with the full kernel, thanks to David.

Now one thing to note on the speed of the download/install package cycles is that it feels a lot slower on guix compared to your average distro, if you don’t have an SSD this will be very painful.

Note that as of 2023 there is no equivalent of preseed for guix, only shell scripts to automate it.

Daily usage

So far if you followed the manual you should get a basic environment with X up and running.

Learning scheme

Now what about actually deviating from the default? what about adding new services and packages? Mass producing os-definition so that you can guix system image them and deploy on libvirt?

Well in order to do that you really need to learn scheme(the guile dialect to be more precise) there is no way around that.

Depending on your background you will have to write a few programs before getting the hang of it and feel confortable in guix, git clone the source code of guix, take a little stroll in it.

But once you have it will feels incredible to not be bound by a DSL.

See Scheme primer for more info

Learning how to actually use the system

You ’ll learn mostly by spending time on it.

The commands that I run most often are

guix pull to download new definitions of packages and services

guix system reconfigure to update the system

guix home reconfigure to update my home services

and finally I have a wrapper that update all extra-profiles that I have in my dotfiles directory.

One thing that is annoying is that guix will sometimes try to compile humonguous packages like qt,firefox,libreoffice… and your only options to avoid that are basically setting the version of the software you want to an inferior version.

Or check with guix weather before reconfiguring the system.

You could have your own build farm too I guess.

How to use steam? How to webdev? Where is my favorite package?

Well…. you will have to use nonguix that is a channel containing some non free software.

Now what if your package/service is not in there? Well you could try search over the internet for a channel that has what you want but you will most likely either:

  1. Package it yourself, depending on the package it can be too time consuming or dead simple.

    Now there are importers to ease the process of packaging but they are not magic, sometimes they just don’t work.

    And even if they are working if your package is non trivial you will most likely have to do some manual stuff.

  2. Download the binary, and if it has dynamic dependencies you will have to patch them, here is a small snippet that was used to run tor-browser

    Found it in nonguix I believe

    cd Browser
guix shell --check --pure --expression='(list (@@ (gnu packages gcc) gcc) "lib")' coreutils bash grep sed gcc-toolchain patchelf gtk+ dbus-glib libxt libevent openssl@1.1.1l glibc
patchelf --set-interpreter $LIBRARY_PATH/ld-linux-x86-64.so.2 firefox.real
patchelf --set-interpreter $LIBRARY_PATH/ld-linux-x86-64.so.2 updater
patchelf --set-interpreter $LIBRARY_PATH/ld-linux-x86-64.so.2 TorBrowser/Tor/tor
LD_LIBRARY_PATH=$LIBRARY_PATH ./start-tor-browser

  3. Just give up and use your language package manager to install the package locally inside some foler.

So yeah that takes much more time than a simple apt update and apt install package

Get help

The official IRC channel is at #guix on libera.chat people are pretty friendly there.

Other options are the mailing-list help-guix and guix-devel comes to mind.

I know that SystemCrafters has a discord and they do talk about guix in it.

See this list for more resources

The rest are random blog post like this one, github gists.

So all in all not that much places compared to say debian.

Guix is fat

Over time you’ll notice that the store just keeps getting larger and larger you will need garbage collect every once in a while.

Every time you update the system with a reconfigure that makes a new generation.

From what I heard it’s a bit better with btrfs as there is transparent compression in that file system.

Breaking Guix

You do have to watch out for filesystem corruptions, I had one of these happens to some packages in the store and I could not delete it even with the force option of the guix gc.

The result was that I could not use the package IIRC.

If anyone has more details on what to do in these cases?

Also see chrooting into existing system if you like me managed to break grub a few times.

Conclusion

I think Guix has very solid foundations and it makes ansible & co feels prehistoric note that I feel like I haven’t talk enough about all the things can do for you so I will do a short summary here.

  1. Can actually be used to manage other guix systems with guix deploy eliminating the need for ansible.

  2. Manage your dotfiles in a manner that is reproducible with guix home see rde from Andrew Tropin that demonstrates its full power.

  3. If you managed to package stuff in guix, you can export it in .deb,.rpm format or even a docker, pretty neat right?

  4. You can actually transfer some elements of the store into another guix machine, and you can offload the build of big packages like Qt to a remote guix(note that this only concerns some part IIRC you will still needs to build derivation,profile? on the local)

  5. Have a completely isolated environment, here is a short snippet of mine that contains emacs and some dependencies specified in manifests.

    guix shell --network --container \
     --pure --emulate-fhs --no-cwd \
     --preserve="^DISPLAY$" \
     --share="/home/user/.config/emacs" \
     --share="/home/user/projects/kimsufi-infra/pulumi-state/" \
     --share="/home/user/projects/kimsufi-infra/pulumi" \
     coreutils emacs font-fira-code fontconfig nss-certs bash openssh \
     -m /home/user/dotfiles/guix/manifests/emacs.scm \
     -m /home/user/dotfiles/guix/manifests/devops.scm \
     -m /home/user/dotfiles/guix/manifests/python.scm \
     -m /home/user/dotfiles/guix/manifests/coding.scm

However every pain points revolve around the fact that guix is niche and there is not that much people that are available to review the patches, contribute to the core, add packages, write nice documentation with concrete examples.

Despite this I would recommend you to give it a try if you are willing to spend the time.

Now how much time are we talking about exactly?

Well depending on your background (I will assume 0 functionnal programming, nor nix experience just debian/arch experience) you basically have to learn a new language + a new system + the mailling-list workflow + irc setup (most people use discord these days) + read the source code to know why stuff does not works/works.

That’s actually a pretty huge time investment especially the mailing list and the irc, you have to be very proactive whereas if it was a more mainstream distro like debian you could just follow a blog post/stack overflow, copy paste some instructions with a few changes and boom that works.

Or just download a package and forget about the whole reproducibility crisis.

]]> Bootstrapping guix on Kimsufi https://ieong.ovh/posts/bootstrapping-guix-kimsufi/ Sun, 05 Feb 2023 00:00:00 +0000 https://ieong.ovh/posts/bootstrapping-guix-kimsufi/ UPDATE This post is outdated now, follow this https://guix.gnu.org/en/cookbook/en/html_node/Running-Guix-on-a-Kimsufi-Server.html This is a short guide on how to get guix up and running on a Kimsufi server. If only Kimsufi had a Bring Your Own Image feature I would not be writing this post, it took me an entire afternoon to try the usual install the system in rescue mode and that did not work. Jump straight to Converting Debian into Guix if you just want guix up and running. UPDATE This post is outdated now, follow this https://guix.gnu.org/en/cookbook/en/html_node/Running-Guix-on-a-Kimsufi-Server.html

This is a short guide on how to get guix up and running on a Kimsufi server.

If only Kimsufi had a Bring Your Own Image feature I would not be writing this post, it took me an entire afternoon to try the usual install the system in rescue mode and that did not work.

Jump straight to Converting Debian into Guix if you just want guix up and running.

Rescue method

The manual way

From the Web UI you’re supposed to change netboot to rescue64-pro then restart the machine, OVH will then mail you with the credentials needed to ssh into the server.

Once that is done you have access to a minimal debian with qemu installed and from there you can partition the disks, download the guix iso, launch it with qemu and continue the installation through vnc.

See this post for a step-by-step guide.

I chose to write a shell script that would automate the bootstrap process.

It’s not just a plug and play script you will have to adapt it to your own config (change the ip addresses, the services that you use…) and transfer it plus the os.scm file via sftp to the server.

#!/usr/bin/env bash

# See https://guix.gnu.org/cookbook/en/html_node/Running-Guix-on-a-Linode-Server.html
# From the webui -> netboot rescue rescue64-pro -> restart -> get the credentials in the mail
# -> ssh into the machine

# Guix

wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
chmod +x guix-install.sh
./guix-install.sh
guix pull

# Partitions
# See https://blog.hqcodeshop.fi/archives/273-GNU-Parted-Solving-the-dreaded-The-resulting-partition-is-not-properly-aligned-for-best-performance.html
# https://wiki.archlinux.org/title/Advanced_Format#Partition_alignment

mdadm --stop /dev/md127
mdadm --zero-superblock /dev/sda2 /dev/sdb2

wipefs -a /dev/sda
wipefs -a /dev/sdb

parted /dev/sda --align=opt -s -m -- mklabel gpt
parted /dev/sda --align=opt -s -m -- \
       mkpart bios_grub 1049kb 512MiB \
       set 1 bios_grub on
parted /dev/sda --align=opt -s -m -- \
       mkpart primary 512MiB -512MiB
       set 2 raid on
parted /dev/sda --align=opt -s -m -- mkpart primary linux-swap 512MiB 100% # Swap

parted /dev/sdb --align=opt -s -m -- mklabel gpt
parted /dev/sdb --align=opt -s -m -- \
         mkpart bios_grub 1049kb 512MiB \
         set 1 bios_grub on
parted /dev/sdb --align=opt -s -m -- \
         mkpart primary 512MiB -512MiB \
         set 2 raid on
parted /dev/sdb --align=opt -s -m -- mkpart primary linux-swap 512MiB 100% # Swap

## RAID

## Use btrfs instead of mdadm?
mdadm --create /dev/md127 --level=1 --raid-disks=2 --metadata=0.90 /dev/sda2 /dev/sdb2

## Boot partitions
mkfs.ext4  /dev/sda1
mkfs.ext4  /dev/sdb1

## Root filesystem
mkfs.ext4 /dev/md127

## Swap partitions
mkswap /dev/sda3
swapon /dev/sda3
mkswap /dev/sdb3
swapon /dev/sdb3

# Installing guix system

mkdir /mnt/guix
mount /dev/md127 /mnt/guix

guix system init /root/os.scm /mnt/guix

# Need to wait 5-10 mn to reboot

Here is an example of an os definition:

(use-modules (gnu))
(use-service-modules networking ssh vpn virtualization sysctl admin)
(use-package-modules ssh certs tls tmux vpn virtualization)

(operating-system
  (host-name "kimsufi")
  (timezone "Etc/UTC")

  (bootloader (bootloader-configuration
             (bootloader grub-bootloader)
                                      ;(targets (list "/dev/sda" "/dev/sdb"))
             (targets (list "/dev/sda"))
             (terminal-outputs '(console))))

  ;; Add a kernel module for RAID-1 (aka. "mirror").
  (initrd-modules (cons* "raid1"  %base-initrd-modules))

  ;; (mapped-devices
  ;;  (list
  ;;   (mapped-device
  ;;   ; (source (list "/dev/sda2" "/dev/sdb2"))
  ;;    (target "/dev/md2")
  ;;    (type raid-device-mapping))))

  (swap-devices
   (list
    (swap-space
     (target "/dev/sda3"))
    ;; (swap-space
    ;;  (target "/dev/sdb3"))
    ))

  (issue
   ;; Default contents for /etc/issue.
   "
This is the GNU system at Kimsufi.  Welcome.\n")

  (file-systems (cons* (file-system
                       (mount-point "/")
                       (device (file-system-label "root"))
                                      ;(device "/dev/md2")
                                      ;(device "/dev/sda2")
                       (type "ext4")
                                      ;(dependencies mapped-devices)
                       )
                     %base-file-systems))

  (users (cons (user-account
              (name "guix")
              (comment "guix")
              (group "users")
              (supplementary-groups '("wheel"))
              (home-directory "/home/guix"))
             %base-user-accounts))

  (sudoers-file
   (plain-file "sudoers" "\
root ALL=(ALL) ALL
%wheel ALL=(ALL) ALL
guix ALL=(ALL) NOPASSWD:ALL\n"))


  ;; Globally-installed packages.
  (packages (cons* tmux nss-certs gnutls wireguard-tools %base-packages))

  (services
   (cons*
    (service static-networking-service-type
           (list (static-networking
                  (addresses (list (network-address
                                    (device "enp3s0")
                                    (value "REPLACE_ME"))
                                   (network-address
                                    (device "enp3s0")
                                    (value "REPLACE_ME"))))
                  (routes (list (network-route
                                 (destination "default")
                                 (gateway "37.187.79.254"))
                                (network-route
                                 (destination "default")
                                 (gateway "2001:41d0:a:2fFF:FF:FF:FF:FF"))))
                  (name-servers '("213.186.33.99")))))

    (service unattended-upgrade-service-type)

    (service openssh-service-type
           (openssh-configuration
            (openssh openssh-sans-x)
            (permit-root-login #f)
            (port-number 22222)
            (authorized-keys
             (quasiquote
              (("REPLACE_ME" (unquote (plain-file "REPLACE_ME.pub" "SSH_KEY.PUB"))))))))
    (modify-services %base-services
      (sysctl-service-type config =>
                         (sysctl-configuration
                          (settings (append '(("net.ipv6.conf.all.autoconf" . "0")
                                              ("net.ipv6.conf.all.accept_ra" . "0"))
                                            %default-sysctl-settings))))))))

Now everything should be good to go, the only thing left is to change the netboot back to hard drive and then reboot the machine.

And……………. after rebooting it turns out that I can ping the machine but all ports are closed.

I did reboot the machine in rescue mode again, mount the guix system into /mnt hoping to see some logs, but there was not anything, the logs files were simply not there, neither was the /home/user/guix directory.

So I guess it simply cannot boot but as for why? I have no idea.

Since kimsufi does not provide you with a KVM console you’re kinda screwed.

The automated way

Now I did not want to do it the manual way, I wanted something that could be automated with pulumi and some ansible/guile/shell script (ideally everything would be done via guix and guile but there is sadly too much to reimplement at the moment).

Retrieve the SSH credentials

I examined the kimsufi api and there are 3 endpoints of interest:

  • /​me/notification/email/history​/
  • /​me/notification/email/history/{id}​/
  • /​secret​/

The first endpoint allow you to retrieve alls the ids of the emails that ovh sent you, from there you can feed the last id to the second endpoint.

This will returns a body of text with the email containing the credentials, you will have to parse it in order to retrive the secret uuid.

Once this is done you can query the secret endpoint with the uuid and that will return the ssh password in plain text.

Pulumi

Well now it’s time to write a program in one of the language supported by pulumi I decided to use python since I have to write fewer lines than say Java/C#.

I might have took Go if this was something more important but for my little infra I don’t care that much.

First step it to get the ovh provider for pulumi, this provider will allow us to query the aforementionned endpoints. Also install the command provider to run an ansible playbook that will take care of partitioning/running various guix commands…

Now the ovh provider is a terraform only thing, the pulumi provider for ovh is actually entirely generated from that terraform provider.

I could unfortunately not get it to work, when I would run pulumi up it would crash with a DistroNotFoundError.

So I just gave up because I had other problems in the manual way and I did not want to use terraform again.

Converting Debian into Guix

From the Web UI you’ll need to install either a Debian 10 or Debian 11 machine.

Once that is done you can adapt the script, transfer via sftp and run it.

Now there are gotchas when bootstraping from a live os like this.

If you try to bootstrap with a full configuration with dozen of services you will get weird errors, so it’s better to start with something minimal and once the system is up reconfigure with the full configuration you want.

That is why libvirt, virtlog… are commented out, if I did not I would otherwise get a weird dbus error.

#!/usr/bin/env bash

# Target a debian10 machine

sudo su -

apt-get update

apt-get install xz-utils -y

wget https://ftp.gnu.org/gnu/guix/guix-binary-1.4.0.x86_64-linux.tar.xz

cd /tmp

tar --warning=no-timestamp -xvf ~/guix-binary-1.4.0.x86_64-linux.tar.xz

mv var/guix /var/ && mv gnu /

mkdir -p /root/.config/guix

ln -sf /var/guix/profiles/per-user/root/current-guix ~root/.config/guix/current

export GUIX_PROFILE="/root/.config/guix/current" ;

source $GUIX_PROFILE/etc/profile

groupadd --system guixbuild

for i in `seq -w 1 10`; do
    useradd -g guixbuild -G guixbuild         \
          -d /var/empty -s `which nologin`  \
          -c "Guix build user $i" --system  \
          guixbuilder$i;
done;

cp -v /root/.config/guix/current/lib/systemd/system/guix-daemon.service /etc/systemd/system/

systemctl start guix-daemon && systemctl enable guix-daemon

mkdir -p /usr/local/bin

cd /usr/local/bin

ln -s /var/guix/profiles/per-user/root/current-guix/bin/guix

mkdir -p /usr/local/share/info

cd /usr/local/share/info

for i in /var/guix/profiles/per-user/root/current-guix/share/info/*; do
    ln -s $i;
done

guix archive --authorize < /root/.config/guix/current/share/guix/ci.guix.gnu.org.pub

guix pull
guix install glibc-utf8-locales-2.29 openssl glibc-locales

export GUIX_LOCPATH="$HOME/.guix-profile/lib/locale"

# Yeah I actually have to comment out libvirt and virtlog for now
# otherwise I get a werid libvirt error.
# Reenable them once we've succesfully bootstraped.

cat > /etc/bootstrap-config.scm << EOF
(use-modules (gnu))
(use-service-modules networking ssh vpn virtualization sysctl certbot admin)
(use-package-modules ssh certs tls tmux vpn virtualization)

(operating-system
  (host-name "guix")
  (timezone "Etc/UTC")

  (bootloader (bootloader-configuration
             (bootloader grub-bootloader)
             (targets (list "/dev/sda" "/dev/sdb"))
             (terminal-outputs '(console))))

  ;; Add a kernel module for RAID-1 (aka. "mirror").
  (initrd-modules (cons "raid1" %base-initrd-modules))

  (mapped-devices
   (list
    (mapped-device
     (source (list "/dev/sda2" "/dev/sdb2"))
     (target "/dev/md2")
     (type raid-device-mapping))))

  (swap-devices
    (list
     (swap-space
       (target "/dev/sda3"))
     (swap-space
       (target "/dev/sdb3"))))

  (issue
  ;; Default contents for /etc/issue.
  "
This is the GNU system at Kimsufi.  Welcome.\n")

  (file-systems (cons* (file-system
                      (mount-point "/")
                      (device "/dev/md2")
                      (type "ext4")
                      (dependencies mapped-devices))
                    %base-file-systems))

  (users (cons (user-account
              (name "debian")
              (comment "debian")
              (group "users")
              ;(supplementary-groups '("wheel"))
              ;(supplementary-groups '("wheel" "libvirt" "kvm"))
              (home-directory "/home/debian"))
             %base-user-accounts))

  (sudoers-file
   (plain-file "sudoers" "\
root ALL=(ALL) ALL
%wheel ALL=(ALL) ALL
debian ALL=(ALL) NOPASSWD:ALL\n"))


  ;; Globally-installed packages.
  (packages (cons* tmux nss-certs gnutls wireguard-tools %base-packages))

(services
 (cons*
  (service static-networking-service-type
         (list (static-networking
                (addresses (list (network-address
                                  (device "enp3s0")
                                  (value "37.187.79.64/24"))
                                 (network-address
                                  (device "enp3s0")
                                  (value "2001:41d0:a:2f40::1/64"))))
                (routes (list (network-route
                               (destination "default")
                               (gateway "37.187.79.254"))
                              (network-route
                               (destination "default")
                               (gateway "2001:41d0:a:2fFF:FF:FF:FF:FF"))))
                (name-servers '("213.186.33.99")))))

;             (service unattended-upgrade-service-type)
;
;		     (service nftables-service-type
;                      (nftables-configuration
;                       (ruleset
;                        (plain-file "nftables.nft"
;                                    "\
;table ip nat {
;	chain prerouting {
;		type nat hook prerouting priority -100;
;		tcp dport { http, https } dnat to 192.168.1.10:http
;	}
;
;	chain postrouting {
;		type nat hook postrouting priority 100;
;		masquerade
;	}
;}
;
;table inet filter {
; chain input {
;   type filter hook input priority 0; policy drop;
;
;   # early drop of invalid connections
;   ct state invalid drop
;
;   # allow established/related connections
;   ct state { established, related } accept
;
;   # allow icmp
;   ip protocol icmp accept
;   ip6 nexthdr icmpv6 accept
;
;   # allow from loopback
;   iifname lo accept
;
;   # added: make NAT from libvirt work
;   iifname virbr0 accept
;
;   # allow ssh,http
;   tcp dport {http,https,53,67,2222} accept
;   udp dport {53,67} accept
;
;   # reject everything else
;   reject with icmpx type port-unreachable
; }
; chain forward {
;   type filter hook forward priority 0; policy drop;
;   iifname virbr0 oifname enp3s0 accept
;   iifname enp3s0 oifname virbr0 accept
; }
; chain output {
;   type filter hook output priority 0; policy accept;
; }
;}"))))
;
;	     (service libvirt-service-type
;		      (libvirt-configuration
;		       (unix-sock-group "libvirt")
;		       (tls-port "16555")))
;
;	     (service virtlog-service-type
;		      (virtlog-configuration
;		       (max-clients 1000)))

  (service openssh-service-type
         (openssh-configuration
          (port-number 2222)
          (permit-root-login #f)))

           (modify-services %base-services
               (sysctl-service-type config =>
                     (sysctl-configuration
                       (settings (append '(("net.ipv6.conf.all.autoconf" . "0")
                                           ("net.ipv6.conf.all.accept_ra" . "0"))
                                         %default-sysctl-settings))))))))
EOF

guix system build /etc/bootstrap-config.scm

# TODO: dbus
mv /etc/{ssl,pam.d,skel,udev} /tmp

guix system reconfigure /etc/bootstrap-config.scm

mv /etc /old-etc

mkdir /etc

cp -r /old-etc/{passwd,group,shadow,gshadow,mtab,guix,bootstrap-config.scm} /etc/

guix system reconfigure /etc/bootstrap-config.scm

# The users uid created by guix is set to 100 and the one made
# made by debian is 1000, so we change that for guix.

chown -R debian:users /home/debian

reboot

Now if everything has gone smoothly you should have a guix system up and running!

]]> Guix as a mail server https://ieong.ovh/posts/guix-mail-server/ Mon, 06 Feb 2023 00:00:00 +0000 https://ieong.ovh/posts/guix-mail-server/ The mail is not hard is a meme, for my previous deployment of a mail server I had multiple ansible playbooks to deploy the postfix + dovecot + rspamd stack to a debian server. There were dozens of templates file, it was horrible I did this because I found the other options were way too bloated, most tutorials and examples on the internet tell you to set up a sql database, for a dead simple deployment for 1-6 users this is far too much. The mail is not hard is a meme, for my previous deployment of a mail server I had multiple ansible playbooks to deploy the postfix + dovecot + rspamd stack to a debian server.

There were dozens of templates file, it was horrible I did this because I found the other options were way too bloated, most tutorials and examples on the internet tell you to set up a sql database, for a dead simple deployment for 1-6 users this is far too much.

There are of course containers with mailcow & co but again I found them either too bloated or the stack was too old.

postfix + amavis + postgrey + spamassassin + opendkim + spfsomething + dovecot + clamav is too much in 2023 when you can simply go opensmtpd + dovecot + rspamd

But there is hope, guix as a system allows you to declaratively configure some services but how far are we exactly of a fully reproducible mail setup?

Well not that far actually there are opensmtpd and dovecot already packaged and they can be used as a service already.

There is a patch series for postfix but no news so far.

From what I’ve seen dovecot configuration is mostly complete save some modules like managesieve again a patch series is there

Now rspamd is available but it is only available as a package, I am working to get the service done

For webmail roundcube is not packaged in guix because the php imported is not finished yet.

This is just for the setup, now imagine having to deal with your reputation, backup mx, if you want to get fancy tlsa and mts records, how to manage your dkims keys over time…

]]>