commit 8e0247bea06a6ba776743ec31781b1bcd9773aad
parent e686c41fb71463dfb50caaa2c8012af1dc30b19e
Author: vin <git@vineetk.net>
Date: Wed, 8 Apr 2026 10:23:04 -0400
hastur: stuff
Diffstat:
1 file changed, 140 insertions(+), 135 deletions(-)
diff --git a/epistemia/systems/hastur.scm b/epistemia/systems/hastur.scm
@@ -1,16 +1,16 @@
(define-module (epistemia systems hastur)
#:use-module (gnu)
+ #:use-module (gnu packages admin)
#:use-module (gnu packages bash)
#:use-module (gnu packages emacs)
#:use-module (gnu packages golang-crypto)
#:use-module (gnu packages linux)
#:use-module (gnu packages version-control)
#:use-module (gnu packages vpn)
- #:use-module (gnu services dbus) ; temp
#:use-module (gnu services desktop)
#:use-module (gnu services dns)
- #:use-module (gnu services containers) ; temp
#:use-module (gnu services linux)
+ #:use-module (gnu services pm)
#:use-module (gnu services networking)
#:use-module (gnu services shepherd)
#:use-module (gnu services sound)
@@ -41,7 +41,7 @@
(comment "Vineet")
(shell (file-append bash "/bin/bash"))
(group "users")
- (supplementary-groups '("wheel" "audio" "video" "input" "seat" "tty" "cgroup"))) ;; TODO remove docker
+ (supplementary-groups '("wheel" "audio" "video" "input" "seat" "tty")))
%base-user-accounts))
(kernel linux-6.18)
@@ -53,7 +53,7 @@
#:initrd epistemia-zfs-initrd
#:zfs-package zfs-linux
args)))
- (firmware (cons* amdgpu-firmware %base-firmware))
+ (firmware (cons* i915-firmware iwlwifi-firmware %base-firmware))
(bootloader (bootloader-configuration
(bootloader grub-zfs)
@@ -85,144 +85,149 @@
(check? #f)
(needed-for-boot? #t))
(file-system
- (device (uuid "F618-FA9F" 'fat))
+ (device (uuid "85DD-DE6D" 'fat))
(mount-point "/boot/efi")
(type "vfat")))
%base-file-systems))
+ (swap-devices (list (swap-space (target (uuid "a9f91237-58fe-452a-b4af-cbd281f5b8ce")))))
+
(packages (append (list emacs-no-x
git
zfs-linux)
%base-packages))
- (services (append (list (service age-secret-service-type
- (age-secret-configuration
- (secrets (list
- (age-secret
- (name "wg0_hastur")
- (file (local-file "../secrets/wg0_hastur.age")))
- (age-secret
- (name "wg1_hastur")
- (file (local-file "../secrets/wg1_hastur.age")))))))
- (simple-service 'zfs-loader
- kernel-module-loader-service-type
- '("zfs"))
- (simple-service 'zfs-shepherd-services
- shepherd-root-service-type
- zfs-shepherd-services)
- (simple-service 'zfs-shepherd-services-user-processes
- user-processes-service-type
- '(zfs-automount))
- (service seatd-service-type)
- (service iptables-service-type)
- (service static-networking-service-type
- (list (static-networking
- (addresses
- (list (network-address
- (device "eth0")
- (value "192.168.1.2/24"))))
- (routes
- (list (network-route
- (destination "default")
- (gateway "192.168.1.1")))))))
- (simple-service 'resolv-configuration
- etc-service-type
- `(("resolv.conf"
- ,(plain-file "epistemia_resolv.conf"
- (string-append
- "nameserver 10.0.13.2\n"
- "search epistemia\n")))))
- (service openssh-service-type
- (openssh-configuration
- (permit-root-login #f)
- (authorized-keys
- `(("vin" ,(local-file "/data/ssh/id_ed25519.pub"))
- ("root" ,(local-file "/data/ssh/id_ed25519.pub"))))
- (extra-content "\
+ (services (modify-services (append (list (service age-secret-service-type
+ (age-secret-configuration
+ (secrets (list
+ (age-secret
+ (name "wpa_supplicant")
+ (file (local-file "../secrets/wpa_supplicant.age")))
+ (age-secret
+ (name "wg0_hastur")
+ (file (local-file "../secrets/wg0_hastur.age")))
+ (age-secret
+ (name "wg1_hastur")
+ (file (local-file "../secrets/wg1_hastur.age")))))))
+ (simple-service 'zfs-loader
+ kernel-module-loader-service-type
+ '("zfs"))
+ (simple-service 'zfs-shepherd-services
+ shepherd-root-service-type
+ zfs-shepherd-services)
+ (simple-service 'zfs-shepherd-services-user-processes
+ user-processes-service-type
+ '(zfs-automount))
+ (service seatd-service-type)
+ (service iptables-service-type)
+ (service unbound-service-type
+ (unbound-configuration
+ (server
+ (unbound-server
+ (interface '("127.0.0.1"
+ "::1"
+ "10.0.13.2"))
+ (hide-version #t)
+ (hide-identity #t)))
+ (forward-zone
+ (list
+ (unbound-zone
+ (name ".")
+ (forward-addr '("9.9.9.9")))
+ (unbound-zone
+ (name "epistemia.")
+ (forward-addr '("10.0.13.2")))))
+ (extra-content "\
+server:
+ access-control: 127.0.0.0/8 allow
+ access-control: 10.0.13.0/24 allow
+ access-control: ::1 allow
+
+ ip-freebind: yes
+ aggressive-nsec: no
+ module-config: \"respip validator iterator\"
+
+rpz:
+ name: localhost
+ zonefile: /data/src/clones/networking/hagezi_dns-blocklists/rpz/ultimate.txt\n")))
+ (service dhcpcd-service-type
+ (dhcpcd-configuration
+ (option '("rapid_commit" "interface_mtu"))
+ (no-option '("nd_rdnss"
+ "dhcp6_name_servers"
+ "domain_name_servers"
+ "domain_name"
+ "domain_search"))
+ (static '("domain_name_servers=9.9.9.9"
+ "domain_search=epistemia"))
+ (no-hook '("hostname"))))
+ (service wpa-supplicant-service-type
+ (wpa-supplicant-configuration
+ (shepherd-requirement '(age-secret kernel-module-loader))
+ (wpa-supplicant wpa-supplicant-minimal)
+ (dbus? #f)
+ (interface "wlan0")
+ (config-file "/run/secrets/wpa_supplicant")))
+ (service openssh-service-type
+ (openssh-configuration
+ (permit-root-login #f)
+ (authorized-keys
+ `(("vin" ,(local-file "/data/ssh/id_ed25519.pub"))
+ ("root" ,(local-file "/data/ssh/id_ed25519.pub"))))
+ (extra-content "\
ListenAddress 127.0.0.1:22
- ListenAddress 192.168.1.2:22
- ListenAddress 10.0.13.3:22")))
- (service wireguard-service-type
- (wireguard-configuration
- (interface "wg0")
- (addresses '("10.68.117.111/32" "fc00:bbbb:bbbb:bb01::5:756e/128"))
- (port 51821)
- (bootstrap-private-key? #f)
- (private-key "/run/secrets/wg0_hastur")
- (pre-up '("while [ ! -f /run/secrets/wg0_hastur ]; do sleep 1; done"
- "ip route replace 79.127.222.207 via 192.168.1.1 dev eth0"))
- (post-up
- (list "ip rule add fwmark 0x1 table 100 priority 100"
- "ip rule add fwmark 51820 table 100 priority 100"
- "ip route add default via 192.168.1.1 dev eth0 table 100"
- #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1")
- #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -j CONNMARK --restore-mark")
- #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark")))
- (post-down
- (list "ip route del 79.127.222.207 via 192.168.1.1 dev eth0"
- "ip rule del fwmark 0x1 table 100"
- "ip rule del fwmark 51820 table 100"
- "ip route flush table 100"
- #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1")
- #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D PREROUTING -i eth0 -j CONNMARK --restore-mark")
- #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark")))
- (peers
- (list
- (wireguard-peer
- (name "mullvad-fi-hel-wg-003")
- (public-key "FKodo9V6BehkNphL+neI0g4/G/cjbZyYhoptSWf3Si4=")
- (allowed-ips '("0.0.0.0/0" "::0/0"))
- (endpoint "185.204.1.219:51820"))))))
- (service wireguard-service-type
- (wireguard-configuration
- (interface "wg1")
- (addresses '("10.0.13.3/24" "fd00:b0ba:cafe:babe::3/64 "))
- (port 51820)
- (bootstrap-private-key? #f)
- (private-key "/run/secrets/wg1_hastur")
- (table #f)
- (shepherd-requirement '(age-secret))
- (pre-up '("while [ ! -f /run/secrets/wg1_hastur ]; do sleep 1; done"))
- (peers
- (list
- (wireguard-peer
- (name "saklas.epistemia")
- (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=")
- (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128"))
- (endpoint "162.55.242.220:51820")
- (keep-alive 25))
- (wireguard-peer
- (name "demiurge.epistemia")
- (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=")
- (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128"))
- (keep-alive 25))
- (wireguard-peer
- (name "iphonebob.epistemia")
- (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=")
- (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128"))
- (keep-alive 25))
- (wireguard-peer
- (name "lab.epistemia")
- (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=")
- (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128"))
- (keep-alive 25))))))
- (simple-service 'wireguard-route-timer
- shepherd-root-service-type
- (list (shepherd-timer
- '(wg1-route-updater)
- "* * * * *"
- #~("/data_hdd/wireguard-endpoint-route")
- #:requirement '(wireguard-wg1)
- #:documentation "Update Wireguard routes every minute.")))
- (service pam-limits-service-type
- (list (pam-limits-entry "@audio" 'both 'rtprio 99)
- (pam-limits-entry "@audio" 'both 'memlock 'unlimited)))
- ;; netx three temporary
- (service dbus-root-service-type)
- (service rootless-podman-service-type
- (rootless-podman-configuration
- (subgids
- (list (subid-range (name "vin"))))
- (subuids
- (list (subid-range (name "vin")))))))
- %base-services)))
+ ListenAddress 10.0.13.3:22\n")))
+ (service wireguard-service-type
+ (wireguard-configuration
+ (interface "wg0")
+ (addresses '("10.68.117.111/32" "fc00:bbbb:bbbb:bb01::5:756e/128"))
+ (port 51821)
+ (bootstrap-private-key? #f)
+ (shepherd-requirement '(age-secret networking))
+ (private-key "/run/secrets/wg0_hastur")
+ (pre-up '("while [ ! -f /run/secrets/wg0_hastur ]; do sleep 1; done"
+ "ip route add 185.204.1.219 via $(ip route show default | cut -d' ' -f3) dev wlan0"))
+ (post-down '("ip route del 185.204.1.219"))
+ (peers
+ (list
+ (wireguard-peer
+ (name "mullvad-fi-hel-wg-003")
+ (public-key "FKodo9V6BehkNphL+neI0g4/G/cjbZyYhoptSWf3Si4=")
+ (allowed-ips '("0.0.0.0/0" "::0/0"))
+ (endpoint "185.204.1.219:51820"))))))
+ (service wireguard-service-type
+ (wireguard-configuration
+ (interface "wg1")
+ (addresses '("10.0.13.3/24" "fd00:b0ba:cafe:babe::3/64 "))
+ (port 51820)
+ (bootstrap-private-key? #f)
+ (private-key "/run/secrets/wg1_hastur")
+ (table #f)
+ (shepherd-requirement '(age-secret networking unbound))
+ (pre-up '("while [ ! -f /run/secrets/wg1_hastur ]; do sleep 1; done"))
+ (peers
+ (list
+ (wireguard-peer
+ (name "saklas.epistemia")
+ (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=")
+ (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128"))
+ (endpoint "162.55.242.220:51820")
+ (keep-alive 25))
+ (wireguard-peer
+ (name "demiurge.epistemia")
+ (public-key "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=")
+ (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128"))
+ (endpoint "carcosa.13f0.net:51820")
+ (keep-alive 25))))))
+ (service pam-limits-service-type
+ (list (pam-limits-entry "@audio" 'both 'rtprio 99)
+ (pam-limits-entry "@audio" 'both 'memlock 'unlimited)))
+ (service tlp-service-type))
+ %base-services)
+ (sysctl-service-type config =>
+ (sysctl-configuration
+ (settings
+ (append
+ '(("net.ipv4.ip_forward" . "1")
+ ("net.ipv6.conf.all.forwarding" . "1"))
+ %default-sysctl-settings)))))))
