commit 3a65d7578950565d9de08a34ce6130dcebc6f136 parent c1eab5c619b801c5dd06c5634b9ee68f6bd7414f Author: Vineet Kumar <git@vineetk.net> Date: Tue, 20 Jan 2026 23:02:05 -0500 saklas: start working on config for server Diffstat:
| A | epistemia/systems/saklas.scm | | | 213 | +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ |
1 file changed, 213 insertions(+), 0 deletions(-)
diff --git a/epistemia/systems/saklas.scm b/epistemia/systems/saklas.scm @@ -0,0 +1,213 @@ +(define-module (epistemia systems saklas) + #:use-module (gnu) + #:use-module (gnu packages linux) + #:use-module (gnu system accounts) + #:use-module (guix) + #:use-module (guix gexp) + #:use-module (guix utils) + #:use-module (nongnu packages linux) + #:use-module (nongnu system linux-initrd) + #:use-module (epistemia bootloader) + #:use-module (epistemia systems base-system) + #:use-module (epistemia systems linux-initrd) + #:use-module (epistemia services zfs) + #:use-module (epistemia packages zfs)) + +(define (nginx-reverse-proxy domain proxy-port) + (nginx-server-configuration + (server-name (list domain)) + (listen '("10.0.13.1:443" "[fd00:b0ba:cafe:babe::1]:443" "10.0.13.1:80" "[fd00:b0ba:cafe:babe::1]:80")) + (locations + (list + (nginx-location-configuration + (uri "/") + (body (list (string-append "proxy_pass http://127.0.0.1:" (number->string proxy-port) ";")))))))) + +(operating-system + (inherit base-system) + (host-name "saklas") + + (kernel linux-6.17) + (kernel-arguments (list "net.ifnames=0")) + (kernel-loadable-modules (list (list zfs-linux "module"))) + + (initrd (lambda (file-systems . args) + (apply microcode-initrd file-systems + #:initrd epistemia-zfs-initrd + #:zfs-package zfs-linux + args))) + (firmware (cons* amdgpu-firmware %base-firmware)) + + (bootloader (bootloader-configuration + (bootloader grub-zfs) + (targets '("/boot/efi1" + "/boot/efi2" + "/boot/efi3" + "/boot/efi4")))) + + (file-systems (append + (list (file-system + (device "zroot/root") + (mount-point "/") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device "zroot/gnu") + (mount-point "/gnu") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device "zroot/var") + (mount-point "/var") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device "zroot/home") + (mount-point "/home") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device (uuid "F618-FA9F" 'fat)) + (mount-point "/boot/efi1") + (type "vfat")) + (file-system + (device (uuid "F618-FA9F" 'fat)) + (mount-point "/boot/efi2") + (type "vfat")) + (file-system + (device (uuid "F618-FA9F" 'fat)) + (mount-point "/boot/efi3") + (type "vfat")) + (file-system + (device (uuid "F618-FA9F" 'fat)) + (mount-point "/boot/efi4") + (type "vfat"))) + %base-file-systems)) + + (packages (append (list emacs-no-x + git + zfs-linux) + %base-packages)) + + (services (list (simple-service 'zfs-loader + kernel-module-loader-service-type + '("zfs")) + (simple-service 'zfs-shepherd-services + shepherd-root-service-type + zfs-shepherd-services) + (simple-service 'zfs-shepherd-services-user-processes + user-processes-service-type + '(zfs-automount)) + (service iptables-service-type) + (service static-networking-service-type + (list (static-networking + (addresses + (list (network-address + (device "eth0") + (value "162.55.242.220/26")))) + (routes + (list (network-route + (destination "default") + (gateway "162.55.242.193")) + (network-route + (destination "162.55.242.192/26") + (gateway "162.55.242.193")) + (network-route + (destination "162.55.242.193") + (device "eth0"))))))) + (simple-service 'resolv-configuration + etc-service-type + `(("resolv.conf" + ,(plain-file "resolv.conf" + (string-append + "nameserver 127.0.0.1\n" + "search epistemia\n"))))) + (service openssh-service-type + (openssh-configuration + (extra-content "\ + ListenAddress 127.0.0.1:22 + ListenAddress 162.55.242.220:22 + ListenAddress 10.0.13.1:22"))) + (service unbound-service-type + (unbound-configuration + (server + (unbound-server + (interface '("127.0.0.1" + "::1" + "10.0.13.2")) + (hide-version #t) + (hide-identity #t))) + (extra-content "\ +server: + access-control: 127.0.0.0/8 allow + access-control: 10.0.13.0/24 allow + access-control: ::1 allow + + ip-freebind: yes + aggressive-nsec: no + module-config: \"respip validator iterator\" + + local-data: \"saklas.epistemia. 86400 IN A 10.0.13.1\" + local-data: \"saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1\" + local-data: \"demiurge.epistemia. 86400 IN A 10.0.13.2\" + local-data: \"demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2\" + local-data: \"hastur.epistemia. 86400 IN A 10.0.13.3\" + local-data: \"hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3\" + local-data: \"iphonebob.epistemia. 86400 IN A 10.0.13.4\" + local-data: \"iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4\" + local-data: \"lab.epistemia. 86400 IN A 10.0.13.5\" + local-data: \"lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5\" + local-zone: \"saklas.epistemia.\" redirect + local-zone: \"demiurge.epistemia.\" redirect + local-zone: \"hastur.epistemia.\" redirect + local-zone: \"iphonebob.epistemia.\" redirect + local-zone: \"lab.epistemia.\" redirect + +rpz: + name: \"hagezi.ultimate\" + zonefile: \"hagezi.ultimate\" + url: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt"))) + (service wireguard-service-type + (wireguard-configuration + (interface "wg1") + (addresses '("10.0.13.1/24" "fd00:b0ba:cafe:babe::1/64 ")) + (port 51820) + (bootstrap-private-key? #f) + (private-key + #~(string-append "<(" + #$(file-append age "/bin/age -d -i /etc/ssh/ssh_host_ed25519_key") + " /data/src/public/guixsd-config/epistemia/secrets/wg1_saklas.age)")) + (peers + (list + (wireguard-peer + (name "demiurge.epistemia") + (public-key "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=") + (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128")) + (keep-alive 25)) + (wireguard-peer + (name "hastur.epistemia") + (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=") + (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128")) + (keep-alive 25)) + (wireguard-peer + (name "iphonebob.epistemia") + (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=") + (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128")) + (keep-alive 25)) + (wireguard-peer + (name "lab.epistemia") + (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=") + (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128")) + (keep-alive 25)))))) + (service nginx-service-type + (nginx-configuration + (server-blocks + (list + (nginx-reverse-proxy "searx.demiurge.epistemia" 8081) + (nginx-reverse-proxy "redlib.demiurge.epistemia" 8085) + (nginx-reverse-proxy "navidrome.demiurge.epistemia" 4533) + (nginx-reverse-proxy "sdui.demiurge.epistemia" 5000))))))))