commit 8937c1db0d26821e51786a50375c6f68dd22bb30 parent 118f4d029e53a9ff7bc02e6a6de3b25e1ae74f3d Author: Vineet Kumar <git@vineetk.net> Date: Sat, 24 Jan 2026 12:34:06 -0500 demiurge: reindent Diffstat:
| M | epistemia/systems/demiurge.scm | | | 510 | ++++++++++++++++++++++++++++++++++++++++---------------------------------------- |
1 file changed, 255 insertions(+), 255 deletions(-)
diff --git a/epistemia/systems/demiurge.scm b/epistemia/systems/demiurge.scm @@ -34,139 +34,139 @@ (define (nginx-reverse-proxy domain proxy-port) (nginx-server-configuration - (server-name (list domain)) - (listen '("10.0.13.2:443" "[fd00:b0ba:cafe:babe::2]:443" "10.0.13.2:80" "[fd00:b0ba:cafe:babe::2]:80")) - (ssl-certificate "/var/demiurge.epistemia.crt") - (ssl-certificate-key "/var/demiurge.epistemia.key") - (locations - (list - (nginx-location-configuration - (uri "/") - (body (list (string-append "proxy_pass http://127.0.0.1:" (number->string proxy-port) ";")))))))) + (server-name (list domain)) + (listen '("10.0.13.2:443" "[fd00:b0ba:cafe:babe::2]:443" "10.0.13.2:80" "[fd00:b0ba:cafe:babe::2]:80")) + (ssl-certificate "/var/demiurge.epistemia.crt") + (ssl-certificate-key "/var/demiurge.epistemia.key") + (locations + (list + (nginx-location-configuration + (uri "/") + (body (list (string-append "proxy_pass http://127.0.0.1:" (number->string proxy-port) ";")))))))) (operating-system - (inherit base-system) - (host-name "demiurge") + (inherit base-system) + (host-name "demiurge") - (users (cons (user-account - (name "vin") - (comment "Vineet") - (shell (file-append bash "/bin/bash")) - (group "users") - (supplementary-groups '("wheel" "audio" "video" "input" "seat" "tty" "cgroup"))) ;; TODO remove docker - %base-user-accounts)) + (users (cons (user-account + (name "vin") + (comment "Vineet") + (shell (file-append bash "/bin/bash")) + (group "users") + (supplementary-groups '("wheel" "audio" "video" "input" "seat" "tty" "cgroup"))) ;; TODO remove docker + %base-user-accounts)) - (kernel linux-6.17) - (kernel-arguments (list "net.ifnames=0" "modprobe.blacklist=snd_hda_intel")) - (kernel-loadable-modules (list (list zfs-linux "module"))) + (kernel linux-6.17) + (kernel-arguments (list "net.ifnames=0" "modprobe.blacklist=snd_hda_intel")) + (kernel-loadable-modules (list (list zfs-linux "module"))) - (initrd (lambda (file-systems . args) - (apply microcode-initrd file-systems - #:initrd epistemia-zfs-initrd - #:zfs-package zfs-linux - args))) - (firmware (cons* amdgpu-firmware %base-firmware)) + (initrd (lambda (file-systems . args) + (apply microcode-initrd file-systems + #:initrd epistemia-zfs-initrd + #:zfs-package zfs-linux + args))) + (firmware (cons* amdgpu-firmware %base-firmware)) - (bootloader (bootloader-configuration - (bootloader grub-zfs) - (targets '("/boot/efi")))) + (bootloader (bootloader-configuration + (bootloader grub-zfs) + (targets '("/boot/efi")))) - (file-systems (append - (list (file-system - (device "zroot/root") - (mount-point "/") - (type "zfs") - (check? #f) - (needed-for-boot? #t)) - (file-system - (device "zroot/gnu") - (mount-point "/gnu") - (type "zfs") - (check? #f) - (needed-for-boot? #t)) - (file-system - (device "zroot/var") - (mount-point "/var") - (type "zfs") - (check? #f) - (needed-for-boot? #t)) - (file-system - (device "zroot/home") - (mount-point "/home") - (type "zfs") - (check? #f) - (needed-for-boot? #t)) - (file-system - (device (uuid "F618-FA9F" 'fat)) - (mount-point "/boot/efi") - (type "vfat"))) - %base-file-systems)) + (file-systems (append + (list (file-system + (device "zroot/root") + (mount-point "/") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device "zroot/gnu") + (mount-point "/gnu") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device "zroot/var") + (mount-point "/var") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device "zroot/home") + (mount-point "/home") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device (uuid "F618-FA9F" 'fat)) + (mount-point "/boot/efi") + (type "vfat"))) + %base-file-systems)) - (packages (append (list emacs-no-x - git - llama-cpp ; TODO make rocm version (upstream is only cpu and vulkan) - zfs-linux) - %base-packages)) + (packages (append (list emacs-no-x + git + llama-cpp ; TODO make rocm version (upstream is only cpu and vulkan) + zfs-linux) + %base-packages)) - (services (modify-services (append (list (simple-service 'zfs-loader - kernel-module-loader-service-type - '("zfs")) - (simple-service 'zfs-shepherd-services - shepherd-root-service-type - zfs-shepherd-services) - (simple-service 'zfs-shepherd-services-user-processes - user-processes-service-type - '(zfs-automount)) - (service alsa-service-type - (alsa-configuration - (alsa-plugins "alsa-plugins:jack") - (pulseaudio? #f))) - (service seatd-service-type) - (service iptables-service-type) - (service static-networking-service-type - (list (static-networking - (addresses - (list (network-address - (device "eth0") - (value "192.168.1.2/24")))) - (routes - (list (network-route - (destination "default") - (gateway "192.168.1.1"))))))) - (simple-service 'resolv-configuration - etc-service-type - `(("resolv.conf" - ,(plain-file "resolv.conf" - (string-append - "nameserver 127.0.0.1\n" - "search epistemia\n"))))) - (service openssh-service-type - (openssh-configuration - (permit-root-login #f) - (authorized-keys - `(("vin" ,(local-file "/data/ssh/id_ed25519.pub")) - ("root" ,(local-file "/data/ssh/id_ed25519.pub")))) - (extra-content "\ + (services (modify-services (append (list (simple-service 'zfs-loader + kernel-module-loader-service-type + '("zfs")) + (simple-service 'zfs-shepherd-services + shepherd-root-service-type + zfs-shepherd-services) + (simple-service 'zfs-shepherd-services-user-processes + user-processes-service-type + '(zfs-automount)) + (service alsa-service-type + (alsa-configuration + (alsa-plugins "alsa-plugins:jack") + (pulseaudio? #f))) (service ladspa-service-type (ladspa-configuration (plugins (list lsp-plugins)))) + (service seatd-service-type) + (service iptables-service-type) + (service static-networking-service-type + (list (static-networking + (addresses + (list (network-address + (device "eth0") + (value "192.168.1.2/24")))) + (routes + (list (network-route + (destination "default") + (gateway "192.168.1.1"))))))) + (simple-service 'resolv-configuration + etc-service-type + `(("resolv.conf" + ,(plain-file "resolv.conf" + (string-append + "nameserver 127.0.0.1\n" + "search epistemia\n"))))) + (service openssh-service-type + (openssh-configuration + (permit-root-login #f) + (authorized-keys + `(("vin" ,(local-file "/data/ssh/id_ed25519.pub")) + ("root" ,(local-file "/data/ssh/id_ed25519.pub")))) + (extra-content "\ ListenAddress 127.0.0.1:22 ListenAddress 192.168.1.2:22 ListenAddress 10.0.13.2:22"))) - (service unbound-service-type - (unbound-configuration - (server - (unbound-server - (interface '("127.0.0.1" - "::1" - "10.0.13.2")) - (hide-version #t) - (hide-identity #t))) - (forward-zone - (list - (unbound-zone - (name ".") - (forward-addr '("192.168.1.1"))))) - (extra-content "\ + (service unbound-service-type + (unbound-configuration + (server + (unbound-server + (interface '("127.0.0.1" + "::1" + "10.0.13.2")) + (hide-version #t) + (hide-identity #t))) + (forward-zone + (list + (unbound-zone + (name ".") + (forward-addr '("192.168.1.1"))))) + (extra-content "\ server: access-control: 127.0.0.0/8 allow access-control: 10.0.13.0/24 allow @@ -196,145 +196,145 @@ rpz: name: \"hagezi.ultimate\" zonefile: \"hagezi.ultimate\" url: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt"))) - (service wireguard-service-type - (wireguard-configuration - (interface "wg0") - (addresses '("10.68.117.111/32" "fc00:bbbb:bbbb:bb01::5:756e/128")) - (port 51821) - (bootstrap-private-key? #f) - (private-key - #~(string-append "<(" - #$(file-append age "/bin/age -d -i /data/ssh/id_ed25519") - " /data/src/public/guixsd-config/epistemia/secrets/wg0_demiurge.age)")) - (pre-up '("ip route replace 79.127.222.207 via 192.168.1.1 dev eth0")) - (post-up - (list "ip rule add fwmark 0x1 table 100 priority 100" - "ip rule add fwmark 51820 table 100 priority 100" - "ip route add default via 192.168.1.1 dev eth0 table 100" - #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1") - #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -j CONNMARK --restore-mark") - #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark"))) - (post-down - (list "ip route del 79.127.222.207 via 192.168.1.1 dev eth0" - "ip rule del fwmark 0x1 table 100" - "ip rule del fwmark 51820 table 100" - "ip route flush table 100" - #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1") - #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D PREROUTING -i eth0 -j CONNMARK --restore-mark") - #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark"))) - (peers - (list - (wireguard-peer - (name "mullvad-us-txc-wg-002") - (public-key "mjv8qVNwhVKO0ePAI97CRil188uwdR/VR6ihcNY/hio=") - (allowed-ips '("0.0.0.0/0" "::0/0")) - (endpoint "79.127.222.207:51820")))))) - (service wireguard-service-type - (wireguard-configuration - (interface "wg1") - (addresses '("10.0.13.2/24" "fd00:b0ba:cafe:babe::2/64 ")) - (port 51820) - (bootstrap-private-key? #f) - (private-key - #~(string-append "<(" - #$(file-append age "/bin/age -d -i /data/ssh/id_ed25519") - " /data/src/public/guixsd-config/epistemia/secrets/wg1_demiurge.age)")) - (table #f) - (post-up - ;; IPv4 and IPv6 NAT - (list #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -I POSTROUTING 1 -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE") - #~(string-append #$(file-append iptables "/sbin/iptables") " -N WG1-FWD") + (service wireguard-service-type + (wireguard-configuration + (interface "wg0") + (addresses '("10.68.117.111/32" "fc00:bbbb:bbbb:bb01::5:756e/128")) + (port 51821) + (bootstrap-private-key? #f) + (private-key + #~(string-append "<(" + #$(file-append age "/bin/age -d -i /data/ssh/id_ed25519") + " /data/src/public/guixsd-config/epistemia/secrets/wg0_demiurge.age)")) + (pre-up '("ip route replace 79.127.222.207 via 192.168.1.1 dev eth0")) + (post-up + (list "ip rule add fwmark 0x1 table 100 priority 100" + "ip rule add fwmark 51820 table 100 priority 100" + "ip route add default via 192.168.1.1 dev eth0 table 100" + #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1") + #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -j CONNMARK --restore-mark") + #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark"))) + (post-down + (list "ip route del 79.127.222.207 via 192.168.1.1 dev eth0" + "ip rule del fwmark 0x1 table 100" + "ip rule del fwmark 51820 table 100" + "ip route flush table 100" + #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1") + #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D PREROUTING -i eth0 -j CONNMARK --restore-mark") + #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark"))) + (peers + (list + (wireguard-peer + (name "mullvad-us-txc-wg-002") + (public-key "mjv8qVNwhVKO0ePAI97CRil188uwdR/VR6ihcNY/hio=") + (allowed-ips '("0.0.0.0/0" "::0/0")) + (endpoint "79.127.222.207:51820")))))) + (service wireguard-service-type + (wireguard-configuration + (interface "wg1") + (addresses '("10.0.13.2/24" "fd00:b0ba:cafe:babe::2/64 ")) + (port 51820) + (bootstrap-private-key? #f) + (private-key + #~(string-append "<(" + #$(file-append age "/bin/age -d -i /data/ssh/id_ed25519") + " /data/src/public/guixsd-config/epistemia/secrets/wg1_demiurge.age)")) + (table #f) + (post-up + ;; IPv4 and IPv6 NAT + (list #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -I POSTROUTING 1 -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE") + #~(string-append #$(file-append iptables "/sbin/iptables") " -N WG1-FWD") - ;; IPv4 Forwarding Chain - #~(string-append #$(file-append iptables "/sbin/iptables") " -I FORWARD 1 -j WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT") - #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT") - #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT") + ;; IPv4 Forwarding Chain + #~(string-append #$(file-append iptables "/sbin/iptables") " -I FORWARD 1 -j WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT") + #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT") + #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT") - ;; IPv6 Forwarding Chain - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -N WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -I FORWARD 1 -j WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT") + ;; IPv6 Forwarding Chain + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -N WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -I FORWARD 1 -j WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT") - ;; force saklas endpoint through wg0 (Mullvad); I can't connect otherwise - "ip rule add to 157.180.125.215/32 lookup 51820 priority 50" + ;; force saklas endpoint through wg0 (Mullvad); I can't connect otherwise + "ip rule add to 157.180.125.215/32 lookup 51820 priority 50" - ;; Set fwmark on wg1 interface to bypass wg0 (Mullvad) - #~(string-append #$(file-append wireguard-tools "/bin/wg") " set wg1 fwmark 51820"))) - (pre-down - ;; IPv4 and IPv6 NAT - (list "ip rule del to 157.180.125.215/32 lookup 51820" - #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -D POSTROUTING -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE") + ;; Set fwmark on wg1 interface to bypass wg0 (Mullvad) + #~(string-append #$(file-append wireguard-tools "/bin/wg") " set wg1 fwmark 51820"))) + (pre-down + ;; IPv4 and IPv6 NAT + (list "ip rule del to 157.180.125.215/32 lookup 51820" + #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -D POSTROUTING -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE") - ;; IPv4 Forwarding Chain - #~(string-append #$(file-append iptables "/sbin/iptables") " -D FORWARD -j WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/iptables") " -F WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/iptables") " -X WG1-FWD") + ;; IPv4 Forwarding Chain + #~(string-append #$(file-append iptables "/sbin/iptables") " -D FORWARD -j WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/iptables") " -F WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/iptables") " -X WG1-FWD") - ;; IPv6 Forwarding Chain - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -D FORWARD -j WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -F WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -X WG1-FWD"))) - (peers - (list - (wireguard-peer - (name "saklas.epistemia") - (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=") - (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128")) - (endpoint "157.180.125.215:51820") - (keep-alive 25)) - (wireguard-peer - (name "hastur.epistemia") - (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=") - (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128")) - (keep-alive 25)) - (wireguard-peer - (name "iphonebob.epistemia") - (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=") - (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128")) - (keep-alive 25)) - (wireguard-peer - (name "lab.epistemia") - (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=") - (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128")) - (keep-alive 25)))))) - (service nginx-service-type - (nginx-configuration - (server-blocks - (list - (nginx-reverse-proxy "searx.demiurge.epistemia" 8081) - (nginx-reverse-proxy "redlib.demiurge.epistemia" 8085) - (nginx-reverse-proxy "navidrome.demiurge.epistemia" 4533) - (nginx-reverse-proxy "sdui.demiurge.epistemia" 5000))))) - (service pam-limits-service-type - (list (pam-limits-entry "@audio" 'both 'rtprio 99) - (pam-limits-entry "@audio" 'both 'memlock 'unlimited))) - ;; netx three temporary - (service dbus-root-service-type) - (service rootless-podman-service-type - (rootless-podman-configuration - (subgids - (list (subid-range (name "vin")))) - (subuids - (list (subid-range (name "vin"))))))) - %base-services) - (guix-service-type config => - (guix-configuration - (inherit config) - (substitute-urls - (append '("https://guix.bordeaux.inria.fr") - %default-substitute-urls)) - (authorized-keys - (append (list (local-file "../../inria.pub")) - %default-authorized-guix-keys)))) - (sysctl-service-type config => - (sysctl-configuration - (settings - (append - '(("net.ipv4.ip_forward" . "1") - ("net.ipv6.conf.all.forwarding" . "1")) - %default-sysctl-settings))))))) + ;; IPv6 Forwarding Chain + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -D FORWARD -j WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -F WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -X WG1-FWD"))) + (peers + (list + (wireguard-peer + (name "saklas.epistemia") + (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=") + (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128")) + (endpoint "157.180.125.215:51820") + (keep-alive 25)) + (wireguard-peer + (name "hastur.epistemia") + (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=") + (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128")) + (keep-alive 25)) + (wireguard-peer + (name "iphonebob.epistemia") + (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=") + (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128")) + (keep-alive 25)) + (wireguard-peer + (name "lab.epistemia") + (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=") + (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128")) + (keep-alive 25)))))) + (service nginx-service-type + (nginx-configuration + (server-blocks + (list + (nginx-reverse-proxy "searx.demiurge.epistemia" 8081) + (nginx-reverse-proxy "redlib.demiurge.epistemia" 8085) + (nginx-reverse-proxy "navidrome.demiurge.epistemia" 4533) + (nginx-reverse-proxy "sdui.demiurge.epistemia" 5000))))) + (service pam-limits-service-type + (list (pam-limits-entry "@audio" 'both 'rtprio 99) + (pam-limits-entry "@audio" 'both 'memlock 'unlimited))) + ;; netx three temporary + (service dbus-root-service-type) + (service rootless-podman-service-type + (rootless-podman-configuration + (subgids + (list (subid-range (name "vin")))) + (subuids + (list (subid-range (name "vin"))))))) + %base-services) + (guix-service-type config => + (guix-configuration + (inherit config) + (substitute-urls + (append '("https://guix.bordeaux.inria.fr") + %default-substitute-urls)) + (authorized-keys + (append (list (local-file "../../inria.pub")) + %default-authorized-guix-keys)))) + (sysctl-service-type config => + (sysctl-configuration + (settings + (append + '(("net.ipv4.ip_forward" . "1") + ("net.ipv6.conf.all.forwarding" . "1")) + %default-sysctl-settings)))))))