commit 351c7bcbeac81814eb6c231ff239d5e7351db0ff parent 2f4bd55297cb690237e16ddd92b2a5fb79b1b867 Author: Vineet Kumar <git@vineetk.net> Date: Wed, 15 Apr 2026 11:00:30 -0400 demiurge: fix rebase Diffstat:
| M | epistemia/systems/demiurge.scm | | | 553 | ++++++++++++++++++++++++++++++++++++++++--------------------------------------- |
1 file changed, 277 insertions(+), 276 deletions(-)
diff --git a/epistemia/systems/demiurge.scm b/epistemia/systems/demiurge.scm @@ -36,15 +36,15 @@ (define (nginx-reverse-proxy domain proxy-port) (nginx-server-configuration - (server-name (list domain)) - (listen '("10.0.13.2:443" "[fd00:b0ba:cafe:babe::2]:443" "10.0.13.2:80" "[fd00:b0ba:cafe:babe::2]:80")) - (ssl-certificate "/var/demiurge.epistemia.crt") - (ssl-certificate-key "/var/demiurge.epistemia.key") - (locations - (list - (nginx-location-configuration - (uri "/") - (body (list (string-append "proxy_pass http://127.0.0.1:" (number->string proxy-port) ";")))))))) + (server-name (list domain)) + (listen '("10.0.13.2:443" "[fd00:b0ba:cafe:babe::2]:443" "10.0.13.2:80" "[fd00:b0ba:cafe:babe::2]:80")) + (ssl-certificate "/var/demiurge.epistemia.crt") + (ssl-certificate-key "/var/demiurge.epistemia.key") + (locations + (list + (nginx-location-configuration + (uri "/") + (body (list (string-append "proxy_pass http://127.0.0.1:" (number->string proxy-port) ";")))))))) ;; upstream guix updates slowly (define update-llama-cpp @@ -54,127 +54,127 @@ (with-commit . "llama-cpp=b8611")))) (operating-system - (inherit base-system) - (host-name "demiurge.epistemia") + (inherit base-system) + (host-name "demiurge.epistemia") - (users (cons (user-account - (name "vin") - (comment "Vineet") - (shell (file-append bash "/bin/bash")) - (group "users") - (supplementary-groups '("wheel" "audio" "video" "input" "seat" "tty" "cgroup"))) ;; TODO remove docker - %base-user-accounts)) + (users (cons (user-account + (name "vin") + (comment "Vineet") + (shell (file-append bash "/bin/bash")) + (group "users") + (supplementary-groups '("wheel" "audio" "video" "input" "seat" "tty" "cgroup"))) ;; TODO remove docker + %base-user-accounts)) - (kernel linux-6.18) - (kernel-arguments (list "net.ifnames=0" "modprobe.blacklist=snd_hda_intel")) - (kernel-loadable-modules (list (list zfs-linux "module"))) + (kernel linux-6.18) + (kernel-arguments (list "net.ifnames=0" "modprobe.blacklist=snd_hda_intel")) + (kernel-loadable-modules (list (list zfs-linux "module"))) - (initrd (lambda (file-systems . args) - (apply microcode-initrd file-systems - #:initrd epistemia-zfs-initrd - #:zfs-package zfs-linux - args))) - (firmware (cons* amdgpu-firmware %base-firmware)) + (initrd (lambda (file-systems . args) + (apply microcode-initrd file-systems + #:initrd epistemia-zfs-initrd + #:zfs-package zfs-linux + args))) + (firmware (cons* amdgpu-firmware %base-firmware)) - (bootloader (bootloader-configuration - (bootloader grub-zfs) - (targets '("/boot/efi")))) + (bootloader (bootloader-configuration + (bootloader grub-zfs) + (targets '("/boot/efi")))) - (file-systems (append - (list (file-system - (device "zroot/root") - (mount-point "/") - (type "zfs") - (check? #f) - (needed-for-boot? #t)) - (file-system - (device "zroot/gnu") - (mount-point "/gnu") - (type "zfs") - (check? #f) - (needed-for-boot? #t)) - (file-system - (device "zroot/var") - (mount-point "/var") - (type "zfs") - (check? #f) - (needed-for-boot? #t)) - (file-system - (device "zroot/home") - (mount-point "/home") - (type "zfs") - (check? #f) - (needed-for-boot? #t)) - (file-system - (device (uuid "F618-FA9F" 'fat)) - (mount-point "/boot/efi") - (type "vfat"))) - %base-file-systems)) + (file-systems (append + (list (file-system + (device "zroot/root") + (mount-point "/") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device "zroot/gnu") + (mount-point "/gnu") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device "zroot/var") + (mount-point "/var") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device "zroot/home") + (mount-point "/home") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device (uuid "F618-FA9F" 'fat)) + (mount-point "/boot/efi") + (type "vfat"))) + %base-file-systems)) - (packages (append (list emacs-no-x - git - (update-llama-cpp llama-cpp) - zfs-linux) - %base-packages)) + (packages (append (list emacs-no-x + git + (update-llama-cpp llama-cpp) + zfs-linux) + %base-packages)) - (services (modify-services (append (list (service age-secret-service-type - (age-secret-configuration - (secrets (list - (age-secret - (name "wg0_demiurge") - (file (local-file "../secrets/wg0_demiurge.age"))) - (age-secret - (name "wg1_demiurge") - (file (local-file "../secrets/wg1_demiurge.age"))))))) - (simple-service 'zfs-loader - kernel-module-loader-service-type - '("zfs")) - (simple-service 'zfs-shepherd-services - shepherd-root-service-type - zfs-shepherd-services) - (simple-service 'zfs-shepherd-services-user-processes - user-processes-service-type - '(zfs-automount)) - (service seatd-service-type) - (service iptables-service-type) - (service static-networking-service-type - (list (static-networking - (addresses - (list (network-address - (device "eth0") - (value "192.168.1.2/24")))) - (routes - (list (network-route - (destination "default") - (gateway "192.168.1.1"))))))) - (simple-service 'resolv-configuration - etc-service-type - `(("resolv.conf" - ,(plain-file "epistemia_resolv.conf" - (string-append - "nameserver 127.0.0.1\n" - "search epistemia\n"))))) - (service openssh-service-type - (openssh-configuration - (permit-root-login #f) - (authorized-keys - `(("vin" ,(local-file "/data/ssh/id_ed25519.pub")) - ("root" ,(local-file "/data/ssh/id_ed25519.pub")))))) - (service unbound-service-type - (unbound-configuration - (server - (unbound-server - (interface '("127.0.0.1" - "::1" - "10.0.13.2")) - (hide-version #t) - (hide-identity #t))) - (forward-zone - (list - (unbound-zone - (name ".") - (forward-addr '("192.168.1.1"))))) - (extra-content "\ + (services (modify-services (append (list (service age-secret-service-type + (age-secret-configuration + (secrets (list + (age-secret + (name "wg0_demiurge") + (file (local-file "../secrets/wg0_demiurge.age"))) + (age-secret + (name "wg1_demiurge") + (file (local-file "../secrets/wg1_demiurge.age"))))))) + (simple-service 'zfs-loader + kernel-module-loader-service-type + '("zfs")) + (simple-service 'zfs-shepherd-services + shepherd-root-service-type + zfs-shepherd-services) + (simple-service 'zfs-shepherd-services-user-processes + user-processes-service-type + '(zfs-automount)) + (service seatd-service-type) + (service iptables-service-type) + (service static-networking-service-type + (list (static-networking + (addresses + (list (network-address + (device "eth0") + (value "192.168.1.2/24")))) + (routes + (list (network-route + (destination "default") + (gateway "192.168.1.1"))))))) + (simple-service 'resolv-configuration + etc-service-type + `(("resolv.conf" + ,(plain-file "epistemia_resolv.conf" + (string-append + "nameserver 127.0.0.1\n" + "search epistemia\n"))))) + (service openssh-service-type + (openssh-configuration + (permit-root-login #f) + (authorized-keys + `(("vin" ,(local-file "/data/ssh/id_ed25519.pub")) + ("root" ,(local-file "/data/ssh/id_ed25519.pub")))))) + (service unbound-service-type + (unbound-configuration + (server + (unbound-server + (interface '("127.0.0.1" + "::1" + "10.0.13.2")) + (hide-version #t) + (hide-identity #t))) + (forward-zone + (list + (unbound-zone + (name ".") + (forward-addr '("192.168.1.1"))))) + (extra-content "\ server: access-control: 127.0.0.0/8 allow access-control: 10.0.13.0/24 allow @@ -204,160 +204,161 @@ rpz: name: \"hagezi.ultimate\" zonefile: \"hagezi.ultimate\" url: /data/src/clones/networking/hagezi_dns-blocklists/rpz/ultimate.txt"))) - (service wireguard-service-type - (wireguard-configuration - (interface "wg0") - (addresses '("10.68.117.111/32" "fc00:bbbb:bbbb:bb01::5:756e/128")) - (port 51821) - (bootstrap-private-key? #f) - (private-key "/run/secrets/wg0_demiurge") - (pre-up '("while [ ! -f /run/secrets/wg0_demiurge ]; do sleep 1; done" - "ip route replace 79.127.222.207 via 192.168.1.1 dev eth0")) - (post-up - (list "ip rule add fwmark 0x1 table 100 priority 100" - "ip rule add fwmark 51820 table 100 priority 100" - "ip route add default via 192.168.1.1 dev eth0 table 100" - #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1") - #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -j CONNMARK --restore-mark") - #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark"))) - (post-down - (list "ip route del 79.127.222.207 via 192.168.1.1 dev eth0" - "ip rule del fwmark 0x1 table 100" - "ip rule del fwmark 51820 table 100" - "ip route flush table 100" - #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1") - #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D PREROUTING -i eth0 -j CONNMARK --restore-mark") - #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark"))) - (peers - (list - (wireguard-peer - (name "mullvad-fi-hel-wg-003") - (public-key "FKodo9V6BehkNphL+neI0g4/G/cjbZyYhoptSWf3Si4=") - (allowed-ips '("0.0.0.0/0" "::0/0")) - (endpoint "185.204.1.219:51820")))))) - (service wireguard-service-type - (wireguard-configuration - (interface "wg1") - (addresses '("10.0.13.2/24" "fd00:b0ba:cafe:babe::2/64 ")) - (port 51820) - (bootstrap-private-key? #f) - (private-key "/run/secrets/wg1_demiurge") - (table #f) - (shepherd-requirement '(age-secret)) - (pre-up '("while [ ! -f /run/secrets/wg1_demiurge ]; do sleep 1; done")) - (post-up - ;; IPv4 and IPv6 NAT - (list #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -I POSTROUTING 1 -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE") - #~(string-append #$(file-append iptables "/sbin/iptables") " -N WG1-FWD") + (service wireguard-service-type + (wireguard-configuration + (interface "wg0") + (addresses '("10.68.117.111/32" "fc00:bbbb:bbbb:bb01::5:756e/128")) + (port 51821) + (bootstrap-private-key? #f) + (private-key "/run/secrets/wg0_demiurge") + (pre-up '("while [ ! -f /run/secrets/wg0_demiurge ]; do sleep 1; done" + "ip route replace 79.127.222.207 via 192.168.1.1 dev eth0")) + (post-up + (list "ip rule add fwmark 0x1 table 100 priority 100" + "ip rule add fwmark 51820 table 100 priority 100" + "ip route add default via 192.168.1.1 dev eth0 table 100" + #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1") + #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -j CONNMARK --restore-mark") + #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark"))) + (post-down + (list "ip route del 79.127.222.207 via 192.168.1.1 dev eth0" + "ip rule del fwmark 0x1 table 100" + "ip rule del fwmark 51820 table 100" + "ip route flush table 100" + #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1") + #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D PREROUTING -i eth0 -j CONNMARK --restore-mark") + #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark"))) + (peers + (list + (wireguard-peer + (name "mullvad-fi-hel-wg-003") + (public-key "FKodo9V6BehkNphL+neI0g4/G/cjbZyYhoptSWf3Si4=") + (allowed-ips '("0.0.0.0/0" "::0/0")) + (endpoint "185.204.1.219:51820")))))) + (service wireguard-service-type + (wireguard-configuration + (interface "wg1") + (addresses '("10.0.13.2/24" "fd00:b0ba:cafe:babe::2/64 ")) + (port 51820) + (bootstrap-private-key? #f) + (private-key "/run/secrets/wg1_demiurge") + (table #f) + (shepherd-requirement '(age-secret)) + (pre-up '("while [ ! -f /run/secrets/wg1_demiurge ]; do sleep 1; done")) + (post-up + ;; IPv4 and IPv6 NAT + (list #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -I POSTROUTING 1 -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE") + #~(string-append #$(file-append iptables "/sbin/iptables") " -N WG1-FWD") - ;; IPv4 Forwarding Chain - #~(string-append #$(file-append iptables "/sbin/iptables") " -I FORWARD 1 -j WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT") - #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT") - #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT") + ;; IPv4 Forwarding Chain + #~(string-append #$(file-append iptables "/sbin/iptables") " -I FORWARD 1 -j WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT") + #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT") + #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT") - ;; IPv6 Forwarding Chain - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -N WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -I FORWARD 1 -j WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT"))) - (pre-down - ;; IPv4 and IPv6 NAT - (list #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -D POSTROUTING -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE") + ;; IPv6 Forwarding Chain + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -N WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -I FORWARD 1 -j WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT"))) + (pre-down + ;; IPv4 and IPv6 NAT + (list #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -D POSTROUTING -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE") - ;; IPv4 Forwarding Chain - #~(string-append #$(file-append iptables "/sbin/iptables") " -D FORWARD -j WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/iptables") " -F WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/iptables") " -X WG1-FWD") + ;; IPv4 Forwarding Chain + #~(string-append #$(file-append iptables "/sbin/iptables") " -D FORWARD -j WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/iptables") " -F WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/iptables") " -X WG1-FWD") - ;; IPv6 Forwarding Chain - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -D FORWARD -j WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -F WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -X WG1-FWD"))) - (peers - (list - (wireguard-peer - (name "saklas.epistemia") - (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=") - (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128")) - (endpoint "162.55.242.220:51820") - (keep-alive 25)) - (wireguard-peer - (name "hastur.epistemia") - (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=") - (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128")) - (keep-alive 25)) - (wireguard-peer - (name "iphonebob.epistemia") - (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=") - (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128")) - (keep-alive 25)) - (wireguard-peer - (name "lab.epistemia") - (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=") - (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128")) - (keep-alive 25)))))) - (simple-service 'wireguard-route-timer - shepherd-root-service-type - (list (shepherd-timer - '(wg1-route-updater) - "* * * * *" - #~("/data_hdd/wireguard-endpoint-route") - #:requirement '(wireguard-wg1) - #:documentation "Update Wireguard routes every minute."))) - (service nginx-service-type - (nginx-configuration - (server-blocks - (list - (nginx-reverse-proxy "llm.demiurge.epistemia" 8080) - (nginx-reverse-proxy "searx.demiurge.epistemia" 8081) - (nginx-reverse-proxy "redlib.demiurge.epistemia" 8085) - (nginx-reverse-proxy "navidrome.demiurge.epistemia" 4533) - (nginx-reverse-proxy "sdui.demiurge.epistemia" 5000))))) - (service pam-limits-service-type - (list (pam-limits-entry "@audio" 'both 'rtprio 99) - (pam-limits-entry "@audio" 'both 'memlock 'unlimited))) - ;; netx three temporary - (service dbus-root-service-type) - (service rootless-podman-service-type - (rootless-podman-configuration - (subgids - (list (subid-range (name "vin")))) - (subuids - (list (subid-range (name "vin")))))) - (service oci-service-type - (oci-configuration - (runtime 'podman) - (containers - (list - (oci-container-configuration - (image "llm") - (user "vin") - (ports '(("8080" . "8080"))) - (volumes '("/data/models:/app/models")) - (extra-arguments - '("--privileged" - "--cap-add=CAP_SYS_ADMIN" - "--cap-add=SYS_PTRACE" - "--device=/dev/kfd" - "--device=/dev/dri" - "--device=/dev/mem" - "--security-opt" "seccomp=unconfined"))) - (oci-container-configuration - (image "deluan/navidrome:latest") - (user "vin") - (ports '(("4533" . "4533"))) - (environment '("ND_ENABLEINSIGHTCOLLECTOR=false")) - (volumes '("data:/data" - "/data_hdd/music:/music:ro")))))))) - %base-services) - (sysctl-service-type config => - (sysctl-configuration - (settings - (append - '(("net.ipv4.ip_forward" . "1") - ("net.ipv6.conf.all.forwarding" . "1")) - %default-sysctl-settings))))))) + ;; IPv6 Forwarding Chain + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -D FORWARD -j WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -F WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -X WG1-FWD"))) + (peers + (list + (wireguard-peer + (name "saklas.epistemia") + (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=") + (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128")) + (endpoint "162.55.242.220:51820") + (keep-alive 25)) + (wireguard-peer + (name "hastur.epistemia") + (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=") + (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128")) + (keep-alive 25)) + (wireguard-peer + (name "iphonebob.epistemia") + (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=") + (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128")) + (keep-alive 25)) + (wireguard-peer + (name "lab.epistemia") + (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=") + (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128")) + (keep-alive 25)))))) + (simple-service 'wireguard-route-timer + shepherd-root-service-type + (list (shepherd-timer + '(wg1-route-updater) + "* * * * *" + #~("/data_hdd/wireguard-endpoint-route") + #:requirement '(wireguard-wg1) + #:documentation "Update Wireguard routes every minute."))) + (service nginx-service-type + (nginx-configuration + (server-blocks + (list + (nginx-reverse-proxy "llm.demiurge.epistemia" 8080) + (nginx-reverse-proxy "searx.demiurge.epistemia" 8081) + (nginx-reverse-proxy "redlib.demiurge.epistemia" 8085) + (nginx-reverse-proxy "navidrome.demiurge.epistemia" 4533) + (nginx-reverse-proxy "sdui.demiurge.epistemia" 5000))))) + (service pam-limits-service-type + (list (pam-limits-entry "@audio" 'both 'rtprio 99) + (pam-limits-entry "@audio" 'both 'memlock 'unlimited))) + ;; netx three temporary + (service dbus-root-service-type) + (service rootless-podman-service-type + (rootless-podman-configuration + (subgids + (list (subid-range (name "vin")))) + (subuids + (list (subid-range (name "vin")))))) + (service oci-service-type + (oci-configuration + (runtime 'podman) + (containers + (list + (oci-container-configuration + (image "llm") + (user "vin") + (ports '(("8080" . "8080"))) + (volumes '("/data/models:/data/models")) + (extra-arguments + '("--privileged" + "--cap-add=CAP_SYS_ADMIN" + "--cap-add=SYS_PTRACE" + "--device=/dev/kfd" + "--device=/dev/dri" + "--device=/dev/mem" + "--shm-size=10G" + "--security-opt" "seccomp=unconfined"))) + (oci-container-configuration + (image "deluan/navidrome:latest") + (user "vin") + (ports '(("4533" . "4533"))) + (environment '("ND_ENABLEINSIGHTCOLLECTOR=false")) + (volumes '("data:/data" + "/data_hdd/music:/music:ro")))))))) + %base-services) + (sysctl-service-type config => + (sysctl-configuration + (settings + (append + '(("net.ipv4.ip_forward" . "1") + ("net.ipv6.conf.all.forwarding" . "1")) + %default-sysctl-settings)))))))