(use-modules (gnu)
	     (nongnu packages linux)
	     (nongnu system linux-initrd)
	     ;; (gnu home)
	     (gnu services mcron)
	     (gnu services sysctl)
	     (gnu services virtualization)
	     (gnu packages firmware)
	     (gnu packages file-systems)
             (gnu packages admin)
             (gnu packages cryptsetup)
             (gnu packages rsync))
(use-service-modules cups desktop networking ssh xorg)

(define %sudoers-specification
  (plain-file "sudoers" "\
root ALL=(ALL) ALL
%wheel ALL=(ALL) ALL
guix ALL=NOPASSWD: /home/guix/.guix-home/profile/sbin/nvme smart-log /dev/nvme0, /run/current-system/profile/sbin/zpool status
"))

;; (define guix-home
;;   (home-environment
;;    ...))

(define garbage-collector-job
  #~(job '(next-hour '(3))
	 "guix gc --collect-garbage"
         "garbagecollector"))

(define clean-history-job
  #~(job '(next-minute '(0 30))
	 "bash /home/guix/bin/cleanhistory"
         "clean history"
	 #:user "guix"))

(operating-system
 (kernel linux)
 (kernel-arguments '("intel_iommu=on"))
 (kernel-loadable-modules (list (list zfs "module")))
 (initrd microcode-initrd)
 (initrd-modules (cons* "vfio_pci" "vfio" "vfio_iommu_type1" %base-initrd-modules))
 (firmware (list linux-firmware))
 (locale "en_US.utf8")
 (timezone "US")
 (keyboard-layout (keyboard-layout "us"))
 (host-name "fileserver")
 (sudoers-file %sudoers-specification)

 (bootloader (bootloader-configuration
              (bootloader grub-efi-bootloader)
              (targets (list "/boot/efi"))
              (keyboard-layout keyboard-layout)))
 (swap-devices (list (swap-space
                      (target (uuid
                               "[redacted]")))))
 (mapped-devices (list (mapped-device
                        (source (uuid
                                 "[redacted]"))
                        (target "cryptroot")
                        (type luks-device-mapping))))
 (file-systems (cons* (file-system
                       (mount-point "/")
                       (device "/dev/mapper/cryptroot")
                       (type "ext4")
                       (dependencies mapped-devices))
                      (file-system
                       (mount-point "/boot/efi")
                       (device (uuid "[redacted]"
                                     'fat32))
                       (type "vfat")) %base-file-systems))
 
 (users (cons* (user-account
                (name "guix")
                (comment "Guix")
                (group "users")
                (home-directory "/home/guix")
                (supplementary-groups '("wheel" "netdev" "audio" "video" "libvirt")))
               %base-user-accounts))

 (packages (cons* zfs cryptsetup tree rsync %base-packages))

 (services (cons*
 ;; 	    (service guix-home-service-type
	    ;; 		     `(("guix" ,guix-home)))
	    ;; Virtualization
	    (service libvirt-service-type)
	    (service virtlog-service-type)
	    (extra-special-file "/usr/share/OVMF/OVMF_CODE.fd"
				(file-append ovmf "/share/firmware/ovmf_code_x64.bin"))
	    (extra-special-file "/usr/share/OVMF/OVMF_VARS.fd"
				(file-append ovmf "/share/firmware/ovmf_vars_x64.bin"))
	    ;; SSH
	    (service openssh-service-type
		     (openssh-configuration
		      (password-authentication? #false)
		      (port-number [redacted])
		      (authorized-keys
		       `(("guix" ,(plain-file "[redacted].pub"
					      "ssh-rsa [redacted]"))))))
	    ;; Firewall
	    (service iptables-service-type)
	    ;; Scheduled jobs
	    (simple-service 'my-cron-jobs
			    mcron-service-type
			    (list garbage-collector-job
				  clean-history-job))
	    ;; Service modifications
	    (modify-services %desktop-services
                             (delete gdm-service-type)
			     (guix-service-type config => (guix-configuration
							   (inherit config)
							   (substitute-urls
							    (append (list "https://substitutes.nonguix.org")
								    %default-substitute-urls))
							   (authorized-keys
							    (append (list (plain-file "non-guix.pub"
										      "(public-key
 (ecc
  (curve Ed25519)
  (q #C1FD53E5D4CE971933EC50C9F307AE2171A2D3B52C804642A7A35F84F3A4EA98#)
  )
 )
"))
								    %default-authorized-guix-keys))))
			     (sysctl-service-type config =>
						  (sysctl-configuration
						   (settings (append '(("net.ipv4.ip_forward" . "1"))
								     %default-sysctl-settings))))))))