commit 777c5b354ed57b4ed9053a4f578e1003547e24c0 parent 0b4ce3d54bdd79aa0e10ce2bf81d6195746a44ea Author: Vineet Kumar <git@vineetk.net> Date: Wed, 13 May 2026 21:38:01 -0400 saklas: bring back main services Diffstat:
| M | epistemia/systems/saklas.scm | | | 200 | ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++--- |
1 file changed, 194 insertions(+), 6 deletions(-)
diff --git a/epistemia/systems/saklas.scm b/epistemia/systems/saklas.scm @@ -305,8 +305,7 @@ table inet filter { `(("resolv.conf" ,(plain-file "resolv.conf" (string-append - ;"nameserver 127.0.0.1\n" - "nameserver 9.9.9.9\n" + "nameserver 127.0.0.1\n" "search epistemia\n"))))) (service (fail2ban-jail-service openssh-service-type @@ -352,18 +351,207 @@ server: local-data: \"hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3\" local-data: \"iphonebob.epistemia. 86400 IN A 10.0.13.4\" local-data: \"iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4\" - local-data: \"lab.epistemia. 86400 IN A 10.0.13.5\" - local-data: \"lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5\" local-zone: \"saklas.epistemia.\" redirect local-zone: \"demiurge.epistemia.\" redirect local-zone: \"hastur.epistemia.\" redirect local-zone: \"iphonebob.epistemia.\" redirect - local-zone: \"lab.epistemia.\" redirect rpz: name: \"hagezi.ultimate\" zonefile: \"hagezi.ultimate\" - url: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt")))) + url: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt"))) + (service wireguard-service-type + (wireguard-configuration + (interface "wg1") + (addresses '("10.0.13.1/24" "fd00:b0ba:cafe:babe::1/64 ")) + (port 51820) + (bootstrap-private-key? #f) + (private-key "/run/secrets/wg1_saklas") + (peers + (list + (wireguard-peer + (name "demiurge.epistemia") + (public-key "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=") + (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128")) + (keep-alive 25)) + (wireguard-peer + (name "hastur.epistemia") + (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=") + (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128")) + (keep-alive 25)) + (wireguard-peer + (name "iphonebob.epistemia") + (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=") + (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128")) + (keep-alive 25)) + (wireguard-peer + (name "lab.epistemia") + (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=") + (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128")) + (keep-alive 25)))))) + (service certbot-service-type + (certbot-configuration + (email "postmaster@vineetk.net") + (certificates + (list + (certificate-configuration + (deploy-hook (program-file + "import-prosody-certs" + #~(begin + (let ((prosodyctl (string-append #$prosody "/bin/prosodyctl"))) + (system* prosodyctl "--root" "cert" "import" "/etc/certs"))))) + (domains '("vineetk.net" + "git.vineetk.net" + "mail.vineetk.net" + "u.vineetk.net" + "xmpp.vineetk.net"))) + (certificate-configuration + (domains '("13f0.net" + "m.13f0.net" + ;"snac.13f0.net" + ))) + (certificate-configuration + (domains '("vinbiz.ca"))))))) + (service nginx-service-type + (nginx-configuration + (server-blocks + (list (nginx-server-configuration + (server-name '("vineetk.net")) + (listen '("443 ssl")) + (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem") + (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem") + (root "/var/www/site_vineetk") + (raw-content (list "include " %nginx-badboi ";"))) + (nginx-server-configuration + (server-name '("13f0.net")) + (listen '("443 ssl")) + (ssl-certificate "/etc/certs/13f0.net/fullchain.pem") + (ssl-certificate-key "/etc/certs/13f0.net/privkey.pem") + (root "/var/www/site_13f0") + (raw-content (list "include " %nginx-badboi ";"))) + (nginx-server-configuration + (server-name '("vinbiz.ca")) + (listen '("443 ssl")) + (ssl-certificate "/etc/certs/vinbiz.ca/fullchain.pem") + (ssl-certificate-key "/etc/certs/vinbiz.ca/privkey.pem") + (root "/var/www/site_vinbiz") + (raw-content (list "include " %nginx-badboi ";"))))))) + ;; git folder needs to be readable by nginx/cgit, gets reset to 700 on reconfigure otherwise + (simple-service 'git-home-permissions + activation-service-type + #~(when (file-exists? "/data/src/bare") + (chmod "/data/src/bare" #o775))) + (service cgit-service-type + (cgit-configuration + (enable-index-links? #t) + (enable-log-filecount? #t) + (enable-log-linecount? #t) + (enable-git-config? #t) + (remove-suffix? #t) + (root-desc "") + (root-title "Vineet's git repos") + (repository-directory "/data/src/bare") + (section-from-path 1) + (side-by-side-diffs? #t) + (nginx + (list + (nginx-server-configuration + (server-name '("git.vineetk.net")) + (listen '("443 ssl")) + (root cgit) + (try-files (list "$uri" "@cgit")) + (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem") + (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem") + (raw-content (list "include" %nginx-badboi ";")) + (locations + (list + (nginx-location-configuration + (uri "@cgit") + (body '("fastcgi_param SCRIPT_FILENAME $document_root/lib/cgit/cgit.cgi;" + "fastcgi_param PATH_INFO $uri;" + "fastcgi_param QUERY_STRING $args;" + "fastcgi_param HTTP_HOST $server_name;" + "fastcgi_pass 127.0.0.1:9000;")))))))))) + (service prosody-service-type + (prosody-configuration + (admins '("vin@vineetk.net")) + (allow-registration? #f) + (c2s-require-encryption? #t) + (s2s-require-encryption? #t) + (s2s-secure-auth? #t) + (authentication "internal_hashed") + (plugin-paths (list prosody-cloud-notify)) + (modules-enabled + ;; list from https://github.com/monal-im/Monal/wiki/Considerations-for-XMPP-server-admins#prosody + (cons* "sasl_ssdp" + ;; TODO update prosody to 13 + ;; "sasl2" + ;; "sasl2_bind2" + ;; "sasl2_sm" + ;; "sasl2_fast" + "muc_notifications" + "smacks" + "mam" + "csi_simple" + "cloud_notify" + "bookmarks" + %default-modules-enabled)) + ;; I don't want my syslog flooded. can't control changes either in service yet + (log "/var/lib/prosody/prosody.log") + (virtualhosts + (list + (virtualhost-configuration + (domain "vineetk.net")))))) + (service opensmtpd-service-type + (opensmtpd-configuration + (config-file %opensmtpd-config))) + (service dovecot-service-type + (dovecot-configuration + (listen '("*" "::")) + (mail-location "maildir:/var/vmail/%d/%n") + (mail-uid "vmail") + (mail-gid "vmail") + (ssl? "required") + (ssl-cert "</etc/certs/vineetk.net/fullchain.pem") + (ssl-key "</etc/certs/vineetk.net/privkey.pem") + (namespaces + (list (namespace-configuration + (name "inbox") + (inbox? #t) + (location "") + (prefix "") + (mailboxes + (list (mailbox-configuration + (name "Drafts") + (special-use '("\\Drafts"))) + (mailbox-configuration + (name "Junk") + (special-use '("\\Junk"))) + (mailbox-configuration + (name "Sent") + (special-use '("\\Sent"))) + (mailbox-configuration + (name "Trash") + (special-use '("\\Trash")))))))) + (passdbs + (list (passdb-configuration + (driver "passwd-file") + (args '("scheme=CRYPT" "username_format=%u" "/run/secrets/saklas_smtpd_passwd"))))) + (userdbs + (list (userdb-configuration + (driver "static") + (args '("uid=vmail" "gid=vmail" "home=/var/vmail/%d/%n"))))) + (protocols + (list (protocol-configuration (name "imap")) + (protocol-configuration (name "lmtp")))) + (services + (list (service-configuration + (kind "lmtp") + (listeners + (list (unix-listener-configuration + (path "lmtp") + (group "vmail") + (user "vmail")))))))))) %base-services) (guix-service-type config => (guix-configuration