commit 515c3d9b787b5cd1d81643415f2de0e5f7867658
parent 34c25c0a91830939d200bdc856e17499e8346b09
Author: Vineet Kumar <git@vineetk.net>
Date: Tue, 20 Jan 2026 16:58:58 -0500
some reindenting
Diffstat:
2 files changed, 178 insertions(+), 178 deletions(-)
diff --git a/epistemia/systems/base-system.scm b/epistemia/systems/base-system.scm
@@ -7,34 +7,34 @@
(define base-system
(operating-system
- (host-name "base")
- (timezone "Canada/Eastern")
- (locale "en_US.utf8")
+ (host-name "base")
+ (timezone "Canada/Eastern")
+ (locale "en_US.utf8")
- (users (cons (user-account
- (name "vin")
- (comment "Vineet")
- (shell (file-append bash "/bin/bash"))
- (group "users")
- (supplementary-groups '("wheel" "audio" "video" "input" "seat" "tty")))
- %base-user-accounts))
+ (users (cons (user-account
+ (name "vin")
+ (comment "Vineet")
+ (shell (file-append bash "/bin/bash"))
+ (group "users")
+ (supplementary-groups '("wheel" "audio" "video" "input" "seat" "tty" "cgroup"))) ;; TODO remove docker
+ %base-user-accounts))
- ;; should be set per-system
- (kernel '())
- (firmware '())
+ ;; should be set per-system
+ (kernel '())
+ (firmware '())
- ;; will be overrided per-system
- (bootloader (bootloader-configuration
- (bootloader grub-efi-bootloader)
- (targets '("/boot/efi"))))
+ ;; will be overrided per-system
+ (bootloader (bootloader-configuration
+ (bootloader grub-efi-bootloader)
+ (targets '("/boot/efi"))))
- (file-systems %base-file-systems)
+ (file-systems %base-file-systems)
- (packages %base-packages)
+ (packages %base-packages)
- (services (append (list (service openssh-service-type)
- (service alsa-service-type
- (alsa-configuration (pulseaudio? #f)))
- (service ladspa-service-type
- (ladspa-configuration (plugins (list lsp-plugins)))))
- %base-services))))
+ (services (append (list (service openssh-service-type)
+ (service alsa-service-type
+ (alsa-configuration (pulseaudio? #f)))
+ (service ladspa-service-type
+ (ladspa-configuration (plugins (list lsp-plugins)))))
+ %base-services))))
diff --git a/epistemia/systems/demiurge.scm b/epistemia/systems/demiurge.scm
@@ -96,54 +96,54 @@
%base-packages))
(services (modify-services (append (list (simple-service 'zfs-loader
- kernel-module-loader-service-type
- '("zfs"))
- (simple-service 'zfs-shepherd-services
- shepherd-root-service-type
- zfs-shepherd-services)
- (simple-service 'zfs-shepherd-services-user-processes
- user-processes-service-type
- '(zfs-automount))
- (service seatd-service-type)
- (service iptables-service-type)
- (service static-networking-service-type
- (list (static-networking
- (addresses
- (list (network-address
- (device "eth0")
- (value "192.168.1.2/24"))))
- (routes
- (list (network-route
- (destination "default")
- (gateway "192.168.1.1")))))))
- (simple-service 'resolv-configuration
- etc-service-type
- `(("resolv.conf"
- ,(plain-file "resolv.conf"
- (string-append
- "nameserver 127.0.0.1\n"
- "search epistemia\n")))))
- (service openssh-service-type
- (openssh-configuration
- (extra-content "\
+ kernel-module-loader-service-type
+ '("zfs"))
+ (simple-service 'zfs-shepherd-services
+ shepherd-root-service-type
+ zfs-shepherd-services)
+ (simple-service 'zfs-shepherd-services-user-processes
+ user-processes-service-type
+ '(zfs-automount))
+ (service seatd-service-type)
+ (service iptables-service-type)
+ (service static-networking-service-type
+ (list (static-networking
+ (addresses
+ (list (network-address
+ (device "eth0")
+ (value "192.168.1.2/24"))))
+ (routes
+ (list (network-route
+ (destination "default")
+ (gateway "192.168.1.1")))))))
+ (simple-service 'resolv-configuration
+ etc-service-type
+ `(("resolv.conf"
+ ,(plain-file "resolv.conf"
+ (string-append
+ "nameserver 127.0.0.1\n"
+ "search epistemia\n")))))
+ (service openssh-service-type
+ (openssh-configuration
+ (extra-content "\
ListenAddress 127.0.0.1:22
ListenAddress 192.168.1.2:22
ListenAddress 10.0.13.2:22")))
- (service unbound-service-type
- (unbound-configuration
- (server
- (unbound-server
- (interface '("127.0.0.1"
- "::1"
- "10.0.13.2"))
- (hide-version #t)
- (hide-identity #t)))
- (forward-zone
- (list
- (unbound-zone
- (name ".")
- (forward-addr '("192.168.1.1")))))
- (extra-content "\
+ (service unbound-service-type
+ (unbound-configuration
+ (server
+ (unbound-server
+ (interface '("127.0.0.1"
+ "::1"
+ "10.0.13.2"))
+ (hide-version #t)
+ (hide-identity #t)))
+ (forward-zone
+ (list
+ (unbound-zone
+ (name ".")
+ (forward-addr '("192.168.1.1")))))
+ (extra-content "\
server:
access-control: 127.0.0.0/8 allow
access-control: 10.0.13.0/24 allow
@@ -173,120 +173,120 @@ rpz:
name: \"hagezi.ultimate\"
zonefile: \"hagezi.ultimate\"
url: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt")))
- (service wireguard-service-type
- (wireguard-configuration
- (interface "wg0")
- (addresses '("10.68.117.111/32" "fc00:bbbb:bbbb:bb01::5:756e/128"))
- (port 51821)
- (bootstrap-private-key? #f)
- (private-key
- #~(string-append "<("
- #$(file-append age "/bin/age -d -i /data/ssh/id_ed25519")
- " /data/src/public/guixsd-config/epistemia/secrets/wg0_demiurge.age)"))
- (pre-up '("ip route replace 45.134.142.206 via 192.168.1.1 dev eth0"))
- (post-up
- (list "ip rule add fwmark 0x1 table 100 priority 100"
- "ip rule add fwmark 51820 table 100 priority 100"
- "ip route add default via 192.168.1.1 dev eth0 table 100"
- #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1")
- #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -j CONNMARK --restore-mark")
- #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark")))
- (post-down
- (list "ip route del 45.134.142.206 via 192.168.1.1 dev eth0"
- "ip rule del fwmark 0x1 table 100"
- "ip rule del fwmark 51820 table 100"
- "ip route flush table 100"
- #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1")
- #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D PREROUTING -i eth0 -j CONNMARK --restore-mark")
- #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark")))
- (peers
- (list
- (wireguard-peer
- (name "mullvad-us-mia-wg-002")
- (public-key "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=")
- (allowed-ips '("0.0.0.0/0" "::0/0"))
- (endpoint "45.134.142.206:51820"))))))
- (service wireguard-service-type
- (wireguard-configuration
- (interface "wg1")
- (addresses '("10.0.13.2/24" "fd00:b0ba:cafe:babe::2/64 "))
- (port 51820)
- (bootstrap-private-key? #f)
- (private-key
- #~(string-append "<("
- #$(file-append age "/bin/age -d -i /data/ssh/id_ed25519")
- " /data/src/public/guixsd-config/epistemia/secrets/wg1_demiurge.age)"))
- (table #f)
- (post-up
- ;; IPv4 and IPv6 NAT
- (list #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE")
- #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -I POSTROUTING 1 -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE")
- #~(string-append #$(file-append iptables "/sbin/iptables") " -N WG1-FWD")
+ (service wireguard-service-type
+ (wireguard-configuration
+ (interface "wg0")
+ (addresses '("10.68.117.111/32" "fc00:bbbb:bbbb:bb01::5:756e/128"))
+ (port 51821)
+ (bootstrap-private-key? #f)
+ (private-key
+ #~(string-append "<("
+ #$(file-append age "/bin/age -d -i /data/ssh/id_ed25519")
+ " /data/src/public/guixsd-config/epistemia/secrets/wg0_demiurge.age)"))
+ (pre-up '("ip route replace 79.127.222.207 via 192.168.1.1 dev eth0"))
+ (post-up
+ (list "ip rule add fwmark 0x1 table 100 priority 100"
+ "ip rule add fwmark 51820 table 100 priority 100"
+ "ip route add default via 192.168.1.1 dev eth0 table 100"
+ #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1")
+ #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -j CONNMARK --restore-mark")
+ #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark")))
+ (post-down
+ (list "ip route del 79.127.222.207 via 192.168.1.1 dev eth0"
+ "ip rule del fwmark 0x1 table 100"
+ "ip rule del fwmark 51820 table 100"
+ "ip route flush table 100"
+ #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1")
+ #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D PREROUTING -i eth0 -j CONNMARK --restore-mark")
+ #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark")))
+ (peers
+ (list
+ (wireguard-peer
+ (name "mullvad-us-txc-wg-002")
+ (public-key "mjv8qVNwhVKO0ePAI97CRil188uwdR/VR6ihcNY/hio=")
+ (allowed-ips '("0.0.0.0/0" "::0/0"))
+ (endpoint "79.127.222.207:51820"))))))
+ (service wireguard-service-type
+ (wireguard-configuration
+ (interface "wg1")
+ (addresses '("10.0.13.2/24" "fd00:b0ba:cafe:babe::2/64 "))
+ (port 51820)
+ (bootstrap-private-key? #f)
+ (private-key
+ #~(string-append "<("
+ #$(file-append age "/bin/age -d -i /data/ssh/id_ed25519")
+ " /data/src/public/guixsd-config/epistemia/secrets/wg1_demiurge.age)"))
+ (table #f)
+ (post-up
+ ;; IPv4 and IPv6 NAT
+ (list #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE")
+ #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -I POSTROUTING 1 -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE")
+ #~(string-append #$(file-append iptables "/sbin/iptables") " -N WG1-FWD")
- ;; IPv4 Forwarding Chain
- #~(string-append #$(file-append iptables "/sbin/iptables") " -I FORWARD 1 -j WG1-FWD")
- #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT")
- #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT")
- #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT")
+ ;; IPv4 Forwarding Chain
+ #~(string-append #$(file-append iptables "/sbin/iptables") " -I FORWARD 1 -j WG1-FWD")
+ #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT")
+ #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT")
+ #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT")
- ;; IPv6 Forwarding Chain
- #~(string-append #$(file-append iptables "/sbin/ip6tables") " -N WG1-FWD")
- #~(string-append #$(file-append iptables "/sbin/ip6tables") " -I FORWARD 1 -j WG1-FWD")
- #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT")
- #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT")
- #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT")
+ ;; IPv6 Forwarding Chain
+ #~(string-append #$(file-append iptables "/sbin/ip6tables") " -N WG1-FWD")
+ #~(string-append #$(file-append iptables "/sbin/ip6tables") " -I FORWARD 1 -j WG1-FWD")
+ #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT")
+ #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT")
+ #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT")
- ;; force saklas endpoint through wg0 (Mullvad); I can't connect otherwise
- "ip rule add to 157.180.125.215/32 lookup 51820 priority 50"
+ ;; force saklas endpoint through wg0 (Mullvad); I can't connect otherwise
+ "ip rule add to 157.180.125.215/32 lookup 51820 priority 50"
- ;; Set fwmark on wg1 interface to bypass wg0 (Mullvad)
- #~(string-append #$(file-append wireguard-tools "/bin/wg") " set wg1 fwmark 51820")))
- (pre-down
- ;; IPv4 and IPv6 NAT
- (list "ip rule del to 157.180.125.215/32 lookup 51820"
- #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE")
- #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -D POSTROUTING -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE")
+ ;; Set fwmark on wg1 interface to bypass wg0 (Mullvad)
+ #~(string-append #$(file-append wireguard-tools "/bin/wg") " set wg1 fwmark 51820")))
+ (pre-down
+ ;; IPv4 and IPv6 NAT
+ (list "ip rule del to 157.180.125.215/32 lookup 51820"
+ #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE")
+ #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -D POSTROUTING -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE")
- ;; IPv4 Forwarding Chain
- #~(string-append #$(file-append iptables "/sbin/iptables") " -D FORWARD -j WG1-FWD")
- #~(string-append #$(file-append iptables "/sbin/iptables") " -F WG1-FWD")
- #~(string-append #$(file-append iptables "/sbin/iptables") " -X WG1-FWD")
+ ;; IPv4 Forwarding Chain
+ #~(string-append #$(file-append iptables "/sbin/iptables") " -D FORWARD -j WG1-FWD")
+ #~(string-append #$(file-append iptables "/sbin/iptables") " -F WG1-FWD")
+ #~(string-append #$(file-append iptables "/sbin/iptables") " -X WG1-FWD")
- ;; IPv6 Forwarding Chain
- #~(string-append #$(file-append iptables "/sbin/ip6tables") " -D FORWARD -j WG1-FWD")
- #~(string-append #$(file-append iptables "/sbin/ip6tables") " -F WG1-FWD")
- #~(string-append #$(file-append iptables "/sbin/ip6tables") " -X WG1-FWD")))
- (peers
- (list
- (wireguard-peer
- (name "saklas.epistemia")
- (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=")
- (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128"))
- (endpoint "157.180.125.215:51820")
- (keep-alive 25))
- (wireguard-peer
- (name "hastur.epistemia")
- (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=")
- (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128"))
- (keep-alive 25))
- (wireguard-peer
- (name "iphonebob.epistemia")
- (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=")
- (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128"))
- (keep-alive 25))
- (wireguard-peer
- (name "lab.epistemia")
- (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=")
- (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128"))
- (keep-alive 25))))))
- (service nginx-service-type
- (nginx-configuration
- (server-blocks
- (list
- (nginx-reverse-proxy "searx.demiurge.epistemia" 8081)
- (nginx-reverse-proxy "redlib.demiurge.epistemia" 8085)
- (nginx-reverse-proxy "navidrome.demiurge.epistemia" 4533)
- (nginx-reverse-proxy "sdui.demiurge.epistemia" 5000))))))
+ ;; IPv6 Forwarding Chain
+ #~(string-append #$(file-append iptables "/sbin/ip6tables") " -D FORWARD -j WG1-FWD")
+ #~(string-append #$(file-append iptables "/sbin/ip6tables") " -F WG1-FWD")
+ #~(string-append #$(file-append iptables "/sbin/ip6tables") " -X WG1-FWD")))
+ (peers
+ (list
+ (wireguard-peer
+ (name "saklas.epistemia")
+ (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=")
+ (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128"))
+ (endpoint "157.180.125.215:51820")
+ (keep-alive 25))
+ (wireguard-peer
+ (name "hastur.epistemia")
+ (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=")
+ (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128"))
+ (keep-alive 25))
+ (wireguard-peer
+ (name "iphonebob.epistemia")
+ (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=")
+ (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128"))
+ (keep-alive 25))
+ (wireguard-peer
+ (name "lab.epistemia")
+ (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=")
+ (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128"))
+ (keep-alive 25))))))
+ (service nginx-service-type
+ (nginx-configuration
+ (server-blocks
+ (list
+ (nginx-reverse-proxy "searx.demiurge.epistemia" 8081)
+ (nginx-reverse-proxy "redlib.demiurge.epistemia" 8085)
+ (nginx-reverse-proxy "navidrome.demiurge.epistemia" 4533)
+ (nginx-reverse-proxy "sdui.demiurge.epistemia" 5000)))))
(service pam-limits-service-type
(list (pam-limits-entry "@audio" 'both 'rtprio 99)
(pam-limits-entry "@audio" 'both 'memlock 'unlimited))))
