guixsd-config

commit 4a717e1175dd29416eabe62fcf597cdb77358bb1
parent 1fcb6b5914a5f974a097c919c00e6d25a434f144
Author: Vineet Kumar <git@vineetk.net>
Date:   Sun, 25 Jan 2026 03:14:37 -0500

saklas: setup basic website hosting

Diffstat:
M
epistemia/systems/saklas.scm
 | 
53
++++++++++++++++++++++++++++++++++++++---------------

1 file changed, 38 insertions(+), 15 deletions(-)
diff --git a/epistemia/systems/saklas.scm b/epistemia/systems/saklas.scm
@@ -5,6 +5,7 @@
   #:use-module (gnu packages golang-crypto)
   #:use-module (gnu packages linux)
   #:use-module (gnu packages version-control)
+  #:use-module (gnu services certbot)
   #:use-module (gnu services dns)
   #:use-module (gnu services linux)
   #:use-module (gnu services networking)
@@ -25,16 +26,6 @@
   #:use-module (epistemia services zfs)
   #:use-module (epistemia packages zfs))
 
-(define (nginx-reverse-proxy domain proxy-port)
-  (nginx-server-configuration
-    (server-name (list domain))
-    (listen '("10.0.13.1:443" "[fd00:b0ba:cafe:babe::1]:443" "10.0.13.1:80" "[fd00:b0ba:cafe:babe::1]:80"))
-    (locations
-     (list
-      (nginx-location-configuration
-	(uri "/")
-	(body (list (string-append "proxy_pass http://127.0.0.1:" (number->string proxy-port) ";"))))))))
-
 (operating-system
   (inherit base-system)
   ;; (host-name "saklas")
@@ -221,14 +212,46 @@ rpz:
 							  (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=")
 							  (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128"))
 							  (keep-alive 25))))))
+					   (service certbot-service-type
+						    (certbot-configuration
+						      (email "postmaster@vineetk.net")
+						      (certificates
+						       (list
+							(certificate-configuration
+							 (domains '("vineetk.net"
+					;"git.vineetk.net"
+					;"mail.vineetk.net"
+								    "u.vineetk.net"
+					;"xmpp.vineetk.net"
+								    )))
+							(certificate-configuration
+							 (domains '("13f0.net"
+								    "m.13f0.net"
+					;"snac.13f0.net"
+								    )))
+							(certificate-configuration
+							 (domains '("vinbiz.ca")))))))
 					   (service nginx-service-type
 						    (nginx-configuration
 						      (server-blocks
-						       (list
-							(nginx-reverse-proxy "searx.demiurge.epistemia" 8081)
-							(nginx-reverse-proxy "redlib.demiurge.epistemia" 8085)
-							(nginx-reverse-proxy "navidrome.demiurge.epistemia" 4533)
-							(nginx-reverse-proxy "sdui.demiurge.epistemia" 5000))))))
+						       (list (nginx-server-configuration
+							       (server-name '("vineetk.net"))
+							       (listen '("443 ssl"))
+							       (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem")
+							       (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem")
+							       (root "/var/www/site_vineetk"))
+							     (nginx-server-configuration
+							       (server-name '("13f0.net"))
+							       (listen '("443 ssl"))
+							       (ssl-certificate "/etc/certs/13f0.net/fullchain.pem")
+							       (ssl-certificate-key "/etc/certs/13f0.net/privkey.pem")
+							       (root "/var/www/site_13f0"))
+							     (nginx-server-configuration
+							       (server-name '("vinbiz.ca"))
+							       (listen '("443 ssl"))
+							       (ssl-certificate "/etc/certs/vinbiz.ca/fullchain.pem")
+							       (ssl-certificate-key "/etc/certs/vinbiz.ca/privkey.pem")
+							       (root "/var/www/site_vinbiz")))))))
 				     %base-services)
 	      (guix-service-type config =>
 				 (guix-configuration