From: Jakub Czajka <jakub@ekhem.eu.org>
Date: Sun, 12 Jul 2026 14:06:49 +0000 (+0200)
Subject: [vps] Add VPS system and home configurations.
X-Git-Url: https://git.ekhem.eu.org/?a=commitdiff_plain;h=d92b9a44aeb19ec3f355c8973264f80c2a622ea1;p=guix.git

[vps] Add VPS system and home configurations.

Co-Authored-By: Claude <noreply@anthropic.com>
---

diff --git a/.claude/hooks/block-builds b/.claude/hooks/block-builds
index 253b13c..924c138 100755
--- a/.claude/hooks/block-builds
+++ b/.claude/hooks/block-builds
@@ -41,7 +41,7 @@ case "$command" in
             '}}'
         exit 0
         ;;
-    *'make home-'*|*'make system-'*)
+    *'make home-'*|*'make system-'*|*'make vps-'*)
         if $GUIX_BIN/echo "$PWD" | $GUIX_BIN/grep -q '/worktrees/'
         then
             $GUIX_BIN/echo \
diff --git a/Makefile b/Makefile
index 425cb4a..2ffe710 100644
--- a/Makefile
+++ b/Makefile
@@ -19,6 +19,14 @@ system-nonfree:
 system-libre:
 	sudo GUIX_PACKAGE_PATH=`pwd` PROFILE=libre guix system reconfigure system.scm
 
+vps-home:
+	GUIX_PACKAGE_PATH=`pwd` guix home reconfigure vps-home.scm
+	. $(guix-profile)/etc/profile
+
+vps-system:
+	sudo GUIX_PACKAGE_PATH=`pwd` guix system reconfigure vps-system.scm
+
+
 # Build-only targets — validate configuration without activating.
 # These build derivations and cache them in the store so a
 # subsequent reconfigure is near-instant.  The build queue runs
@@ -40,6 +48,14 @@ build-system-libre:
 	GUIX_PACKAGE_PATH=`pwd` PROFILE=libre \
 	    guix system build system.scm
 
+build-vps-system:
+	GUIX_PACKAGE_PATH=`pwd` guix system build vps-system.scm
+
+build-vps-home:
+	GUIX_PACKAGE_PATH=`pwd` guix home build vps-home.scm
+
+build-vps: build-vps-system build-vps-home
+
 tags:
 	find $(guix-store) -wholename "*guix-$(guix-version)*.scm" -or \
 		-wholename "*guix-module-union*.scm" -or \
diff --git a/vps-home.scm b/vps-home.scm
new file mode 100644
index 0000000..4d4efe4
--- /dev/null
+++ b/vps-home.scm
@@ -0,0 +1,27 @@
+;;; Copyright (c) 2026 Jakub Czajka <jakub@ekhem.eu.org>
+;;; License: GPL-3.0 or later.
+;;;
+;;; VPS home directory configuration.
+
+(use-modules (gnu home)
+	     (gnu home services)
+	     (gnu services)
+	     (gnu system shadow))
+
+(home-environment
+ (services
+  (append (list
+           ;; Uncomment the shell you wish to use for your user:
+           ;; (service home-bash-service-type)
+           ;; (service home-fish-service-type)
+           ;; (service home-zsh-service-type)
+
+           (service home-files-service-type
+                    `((".guile" ,%default-dotguile)
+                      (".Xdefaults" ,%default-xdefaults)))
+
+           (service home-xdg-configuration-files-service-type
+                    `(("gdb/gdbinit" ,%default-gdbinit)
+                      ("nano/nanorc" ,%default-nanorc))))
+
+          %base-home-services)))
diff --git a/vps-system.scm b/vps-system.scm
new file mode 100644
index 0000000..b637240
--- /dev/null
+++ b/vps-system.scm
@@ -0,0 +1,70 @@
+;;; Copyright (c) 2026 Jakub Czajka <jakub@ekhem.eu.org>
+;;; License: GPL-3.0 or later.
+;;;
+;;; Guix System operating-system definition for an OVH VPS.
+;;;
+;;; Usage:
+;;;   guix system image --image-type=mbr-raw vps-system.scm
+
+(use-modules (gnu)
+             (nongnu packages linux))
+
+(use-service-modules networking ssh)
+(use-package-modules ssh)
+
+(define %vps-openssh-config
+  (openssh-configuration (openssh openssh-sans-x)
+                         (port-number 22)
+                         (password-authentication? #f)
+                         (permit-root-login 'prohibit-password)))
+
+(operating-system
+  (host-name "vps")
+  (kernel linux)
+  (timezone "Etc/UTC")
+  (locale "en_US.utf8")
+
+  ;; ── OVH-specific (permanent -- the hardware requires these) ──
+  
+  (bootloader (bootloader-configuration
+                (bootloader grub-bootloader)
+                (targets '("/dev/sda"))))
+
+  (kernel-arguments (list "console=ttyS0 console=tty0"))
+
+  ;; ── Filesystems ──
+  
+  (file-systems (cons (file-system
+                        (device (uuid "38af4c98-d0f5-96b6-2fa6-251038af4c98"))
+                        (mount-point "/")
+                        (type "ext4")) %base-file-systems))
+
+  ;; ── Users ──
+  
+  (users (cons (user-account
+                 (name "dak")
+                 (group "users")
+                 (supplementary-groups '("wheel"))
+                 (home-directory "/home/dak")) %base-user-accounts))
+
+  ;; ── Services ──
+  
+  (services
+   (append (list
+            ;; DHCP -- OVH delivers the static IP via DHCP
+            (service dhcpcd-service-type)
+
+            ;; SSH -- key-only authentication
+            (service openssh-service-type %vps-openssh-config)
+
+            ;; NTP -- correct time is required for Guix substitutes
+            (service ntp-service-type))
+
+           %base-services))
+
+  ;; ── Sudoers: dak can reconfigure without a password ──
+  
+  (sudoers-file (plain-file "sudoers"
+                            (string-append (plain-file-content
+                                            %sudoers-specification)
+                                           "dak ALL = NOPASSWD: ALL\n"))))