commit 91efb01910e5cdeb12c562c208f8fe5bed521593 parent e8ecf0859bfd3571af5b1a6dd0d96bded7dbea71 Author: Vineet Kumar <git@vineetk.net> Date: Mon, 4 May 2026 12:59:59 -0400 saklas: switch back to old vps for now Diffstat:
| M | epistemia/systems/saklas.scm | | | 773 | ++++++++++++++++++++++++++++++++++++++++--------------------------------------- |
1 file changed, 388 insertions(+), 385 deletions(-)
diff --git a/epistemia/systems/saklas.scm b/epistemia/systems/saklas.scm @@ -188,181 +188,184 @@ table inet filter { (operating-system - (inherit base-system) - (host-name "saklas.epistemia") + (inherit base-system) + (host-name "saklas.epistemia") - (users (cons* (user-account - (name "vin") - (comment "Vineet") - (shell (file-append bash "/bin/bash")) - (group "users") - (supplementary-groups '("wheel" "git" "torrents"))) - (user-account - (name "git") - (comment "git account") - (group "git") - (shell (file-append git "/bin/git-shell")) - (home-directory "/data/src/bare") - (system? #t)) - (user-account - (name "torrents") - (comment "torrenting account") - (group "torrents") - (shell "/dev/null") - (home-directory "/var/empty") - (system? #t)) - (user-account - (name "vmail") - (comment "virtual mail account") - (group "vmail") - (shell "/dev/null") - (home-directory "/var/vmail") - (system? #t)) - %base-user-accounts)) - (groups (cons* (user-group - (name "git")) - (user-group - (name "torrents")) - (user-group - (name "vmail")) - %base-groups)) + (users (cons* (user-account + (name "vin") + (comment "Vineet") + (shell (file-append bash "/bin/bash")) + (group "users") + (supplementary-groups '("wheel" "git" "torrents"))) + (user-account + (name "git") + (comment "git account") + (group "git") + (shell (file-append git "/bin/git-shell")) + (home-directory "/data/src/bare") + (system? #t)) + (user-account + (name "torrents") + (comment "torrenting account") + (group "torrents") + (shell "/dev/null") + (home-directory "/var/empty") + (system? #t)) + (user-account + (name "vmail") + (comment "virtual mail account") + (group "vmail") + (shell "/dev/null") + (home-directory "/var/vmail") + (system? #t)) + %base-user-accounts)) + (groups (cons* (user-group + (name "git")) + (user-group + (name "torrents")) + (user-group + (name "vmail")) + %base-groups)) - (kernel linux-6.18) - (kernel-arguments (list "net.ifnames=0")) - (kernel-loadable-modules (list (list zfs-linux "module"))) + (kernel linux-6.18) + (kernel-arguments (list "net.ifnames=0")) + (kernel-loadable-modules (list (list zfs-linux "module"))) - (initrd (lambda (file-systems . args) - (apply microcode-initrd file-systems - #:initrd epistemia-zfs-initrd - #:zfs-package zfs-linux - args))) - (firmware (cons* amdgpu-firmware %base-firmware)) + (initrd (lambda (file-systems . args) + (apply microcode-initrd file-systems + #:initrd epistemia-zfs-initrd + #:zfs-package zfs-linux + args))) + (firmware (cons* amdgpu-firmware %base-firmware)) - (bootloader (bootloader-configuration - (bootloader grub-zfs-bios) - (targets '("/dev/sda" - "/dev/sdb")))) + (bootloader (bootloader-configuration + (bootloader grub-zfs-bios) + (targets '("/dev/sda")))) - (file-systems (append - (list (file-system - (device "zroot/root") - (mount-point "/") - (type "zfs") - (check? #f) - (needed-for-boot? #t)) - (file-system - (device "zroot/gnu") - (mount-point "/gnu") - (type "zfs") - (check? #f) - (needed-for-boot? #t)) - (file-system - (device "zroot/var") - (mount-point "/var") - (type "zfs") - (check? #f) - (needed-for-boot? #t)) - (file-system - (device "zroot/home") - (mount-point "/home") - (type "zfs") - (check? #f) - (needed-for-boot? #t))) - %base-file-systems)) + (file-systems (append + (list (file-system + (device "zroot/root") + (mount-point "/") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device "zroot/gnu") + (mount-point "/gnu") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device "zroot/var") + (mount-point "/var") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device "zroot/home") + (mount-point "/home") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device (uuid "0837-6658" 'fat)) + (mount-point "/boot/efi") + (type "vfat"))) + %base-file-systems)) - (packages (append (list emacs-no-x - git - zfs-linux) - %base-packages)) + (packages (append (list emacs-no-x + git + zfs-linux) + %base-packages)) - (services (modify-services (append (list (service age-secret-service-type - (age-secret-configuration - (secrets (list - (age-secret - (name "wg1_saklas") - (file (local-file "../secrets/wg1_saklas.age"))) - (age-secret - (name "saklas_smtpd_dkim") - (file (local-file "../secrets/saklas_smtpd_dkim.age")) - (owner "smtpd") - (group "nogroup") - (mode #o400)) - (age-secret - (name "saklas_smtpd_virtuals") - (file (local-file "../secrets/saklas_smtpd_virtuals.age")) - (owner "smtpd") - (group "nogroup") - (mode #o400)) - (age-secret - (name "saklas_smtpd_passwd") - (file (local-file "../secrets/saklas_smtpd_passwd.age")) - (owner "smtpd") - (group "dovecot") - (mode #o440)))))) - (simple-service 'zfs-loader - kernel-module-loader-service-type - '("zfs")) - (simple-service 'zfs-shepherd-services - shepherd-root-service-type - zfs-shepherd-services) - (simple-service 'zfs-shepherd-services-user-processes - user-processes-service-type - '(zfs-automount)) - (service nftables-service-type - (nftables-configuration - (ruleset %nftables-ruleset))) - (service static-networking-service-type - (list (static-networking - (addresses - (list (network-address - (device "eth0") - (value "51.68.181.121/32")) - (network-address - (device "eth0") - (value "2001:41d0:700:1c79::1/128")))) - (routes - (list (network-route - (destination "default") - (device "eth0") - (gateway "51.68.181.254")) - (network-route - (destination "default") - (device "eth0") - (gateway "2001:41d0:0700:1cff:00ff:00ff:00ff:00ff"))))))) - (simple-service 'resolv-configuration - etc-service-type - `(("resolv.conf" - ,(plain-file "resolv.conf" - (string-append - "nameserver 127.0.0.1\n" - "search epistemia\n"))))) - (service (fail2ban-jail-service - openssh-service-type - (fail2ban-jail-configuration - (name "sshd") - (enabled? #t))) - (openssh-configuration - (permit-root-login 'prohibit-password) - (password-authentication? #f) - (authorized-keys - `(("vin" ,(local-file "/data/ssh/id_ed25519.pub")) - ("git" ,(local-file "/data/ssh/id_ed25519.pub")) - ("root" ,(local-file "/data/ssh/id_ed25519.pub")))) - (extra-content "\ + (services (modify-services (append (list (service age-secret-service-type + (age-secret-configuration + (secrets (list + (age-secret + (name "wg1_saklas") + (file (local-file "../secrets/wg1_saklas.age"))) + (age-secret + (name "saklas_smtpd_dkim") + (file (local-file "../secrets/saklas_smtpd_dkim.age")) + (owner "smtpd") + (group "nogroup") + (mode #o400)) + (age-secret + (name "saklas_smtpd_virtuals") + (file (local-file "../secrets/saklas_smtpd_virtuals.age")) + (owner "smtpd") + (group "nogroup") + (mode #o400)) + (age-secret + (name "saklas_smtpd_passwd") + (file (local-file "../secrets/saklas_smtpd_passwd.age")) + (owner "smtpd") + (group "dovecot") + (mode #o440)))))) + (simple-service 'zfs-loader + kernel-module-loader-service-type + '("zfs")) + (simple-service 'zfs-shepherd-services + shepherd-root-service-type + zfs-shepherd-services) + (simple-service 'zfs-shepherd-services-user-processes + user-processes-service-type + '(zfs-automount)) + (service nftables-service-type + (nftables-configuration + (ruleset %nftables-ruleset))) + (service static-networking-service-type + (list (static-networking + (addresses + (list (network-address + (device "eth0") + (value "157.180.125.215/32")) + (network-address + (device "eth0") + (value "2a01:4f9:c013:d07e::1/64")))) + (routes + (list (network-route + (destination "default") + (device "eth0") + (gateway "172.31.1.1")) + (network-route + (destination "default") + (device "eth0") + (gateway "fe80::1"))))))) + (simple-service 'resolv-configuration + etc-service-type + `(("resolv.conf" + ,(plain-file "resolv.conf" + (string-append + "nameserver 127.0.0.1\n" + "search epistemia\n"))))) + (service (fail2ban-jail-service + openssh-service-type + (fail2ban-jail-configuration + (name "sshd") + (enabled? #t))) + (openssh-configuration + (permit-root-login 'prohibit-password) + (password-authentication? #f) + (authorized-keys + `(("vin" ,(local-file "/data/ssh/id_ed25519.pub")) + ("git" ,(local-file "/data/ssh/id_ed25519.pub")) + ("root" ,(local-file "/data/ssh/id_ed25519.pub")))) + (extra-content "\ ListenAddress 127.0.0.1:22 - ListenAddress 51.68.181.121:22 + ListenAddress 157.180.125.215:22 #ListenAddress 10.0.13.1:22 "))) - (service unbound-service-type - (unbound-configuration - (server - (unbound-server - (interface '("127.0.0.1" - "::1" - "10.0.13.1")) - (hide-version #t) - (hide-identity #t))) - (extra-content "\ + (service unbound-service-type + (unbound-configuration + (server + (unbound-server + (interface '("127.0.0.1" + "::1" + "10.0.13.1")) + (hide-version #t) + (hide-identity #t))) + (extra-content "\ server: access-control: 127.0.0.0/8 allow access-control: 10.0.13.0/24 allow @@ -392,224 +395,224 @@ rpz: name: \"hagezi.ultimate\" zonefile: \"hagezi.ultimate\" url: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt"))) - (simple-service 'rtorrent - shepherd-root-service-type - (list - (shepherd-service - (provision '(rtorrent)) - (requirement '(user-processes loopback syslogd)) - (start #~(make-forkexec-constructor - (list #$(file-append rtorrent-xmlrpc "/bin/rtorrent") - "-n" - "-b" "51.68.181.121" - "-p" "51413-51413" - "-d" "/data/torrents/complete/other" - "-s" "/data/torrents/rtorrent" - "-o" (string-append "system.umask.set=0002," - "dht.mode.set=disable," - "protocol.pex.set=no," - "network.scgi.open_port=10.0.13.1:5000," - "system.daemon.set=true")) - #:user "torrents" #:group "torrents")) - (stop #~(make-kill-destructor)) - (documentation "Run rtorrent in headless mode (only xmlrpc).")))) - (service wireguard-service-type - (wireguard-configuration - (interface "wg1") - (addresses '("10.0.13.1/24" "fd00:b0ba:cafe:babe::1/64 ")) - (port 51820) - (bootstrap-private-key? #f) - (private-key "/run/secrets/wg1_saklas") - (peers - (list - (wireguard-peer - (name "demiurge.epistemia") - (public-key "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=") - (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128")) - (keep-alive 25)) - (wireguard-peer - (name "hastur.epistemia") - (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=") - (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128")) - (keep-alive 25)) - (wireguard-peer - (name "iphonebob.epistemia") - (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=") - (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128")) - (keep-alive 25)) - (wireguard-peer - (name "lab.epistemia") - (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=") - (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128")) - (keep-alive 25)))))) - (service certbot-service-type - (certbot-configuration - (email "postmaster@vineetk.net") - (certificates - (list - (certificate-configuration - (deploy-hook (program-file - "import-prosody-certs" - #~(begin - (let ((prosodyctl (string-append #$prosody "/bin/prosodyctl"))) - (system* prosodyctl "--root" "cert" "import" "/etc/certs"))))) - (domains '("vineetk.net" - "git.vineetk.net" - "mail.vineetk.net" - "u.vineetk.net" - "xmpp.vineetk.net" - ))) - (certificate-configuration - (domains '("13f0.net" - "m.13f0.net" + (simple-service 'rtorrent + shepherd-root-service-type + (list + (shepherd-service + (provision '(rtorrent)) + (requirement '(user-processes loopback syslogd)) + (start #~(make-forkexec-constructor + (list #$(file-append rtorrent-xmlrpc "/bin/rtorrent") + "-n" + "-b" "157.180.125.215" + "-p" "51413-51413" + "-d" "/data/torrents/complete/other" + "-s" "/data/torrents/rtorrent" + "-o" (string-append "system.umask.set=0002," + "dht.mode.set=disable," + "protocol.pex.set=no," + "network.scgi.open_port=10.0.13.1:5000," + "system.daemon.set=true")) + #:user "torrents" #:group "torrents")) + (stop #~(make-kill-destructor)) + (documentation "Run rtorrent in headless mode (only xmlrpc).")))) + (service wireguard-service-type + (wireguard-configuration + (interface "wg1") + (addresses '("10.0.13.1/24" "fd00:b0ba:cafe:babe::1/64 ")) + (port 51820) + (bootstrap-private-key? #f) + (private-key "/run/secrets/wg1_saklas") + (peers + (list + (wireguard-peer + (name "demiurge.epistemia") + (public-key "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=") + (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128")) + (keep-alive 25)) + (wireguard-peer + (name "hastur.epistemia") + (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=") + (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128")) + (keep-alive 25)) + (wireguard-peer + (name "iphonebob.epistemia") + (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=") + (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128")) + (keep-alive 25)) + (wireguard-peer + (name "lab.epistemia") + (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=") + (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128")) + (keep-alive 25)))))) + (service certbot-service-type + (certbot-configuration + (email "postmaster@vineetk.net") + (certificates + (list + (certificate-configuration + (deploy-hook (program-file + "import-prosody-certs" + #~(begin + (let ((prosodyctl (string-append #$prosody "/bin/prosodyctl"))) + (system* prosodyctl "--root" "cert" "import" "/etc/certs"))))) + (domains '("vineetk.net" + "git.vineetk.net" + "mail.vineetk.net" + "u.vineetk.net" + "xmpp.vineetk.net" + ))) + (certificate-configuration + (domains '("13f0.net" + "m.13f0.net" ;"snac.13f0.net" - ))) - (certificate-configuration - (domains '("vinbiz.ca"))))))) - (service nginx-service-type - (nginx-configuration - (server-blocks - (list (nginx-server-configuration - (server-name '("vineetk.net")) - (listen '("443 ssl")) - (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem") - (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem") - (root "/var/www/site_vineetk") - (raw-content (list "include " %nginx-badboi ";"))) - (nginx-server-configuration - (server-name '("13f0.net")) - (listen '("443 ssl")) - (ssl-certificate "/etc/certs/13f0.net/fullchain.pem") - (ssl-certificate-key "/etc/certs/13f0.net/privkey.pem") - (root "/var/www/site_13f0") - (raw-content (list "include " %nginx-badboi ";"))) - (nginx-server-configuration - (server-name '("vinbiz.ca")) - (listen '("443 ssl")) - (ssl-certificate "/etc/certs/vinbiz.ca/fullchain.pem") - (ssl-certificate-key "/etc/certs/vinbiz.ca/privkey.pem") - (root "/var/www/site_vinbiz") - (raw-content (list "include " %nginx-badboi ";"))))))) - ;; git folder needs to be readable by nginx/cgit, gets reset to 700 on reconfigure otherwise - (simple-service 'git-home-permissions - activation-service-type - #~(when (file-exists? "/data/src/bare") - (chmod "/data/src/bare" #o755))) - (service cgit-service-type - (cgit-configuration - (enable-index-links? #t) - (enable-log-filecount? #t) - (enable-log-linecount? #t) - (enable-git-config? #t) - (remove-suffix? #t) - (root-desc "") - (root-title "Vineet's git repos") - (repository-directory "/data/src/bare") - (section-from-path 1) - (side-by-side-diffs? #t) - (nginx - (list - (nginx-server-configuration - (server-name '("git.vineetk.net")) - (listen '("443 ssl")) - (root cgit) - (try-files (list "$uri" "@cgit")) - (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem") - (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem") - (raw-content (list "include" %nginx-badboi ";")) - (locations - (list - (nginx-location-configuration - (uri "@cgit") - (body '("fastcgi_param SCRIPT_FILENAME $document_root/lib/cgit/cgit.cgi;" - "fastcgi_param PATH_INFO $uri;" - "fastcgi_param QUERY_STRING $args;" - "fastcgi_param HTTP_HOST $server_name;" - "fastcgi_pass 127.0.0.1:9000;")))))))))) - (service prosody-service-type - (prosody-configuration - (admins '("vin@vineetk.net")) - (allow-registration? #f) - (c2s-require-encryption? #t) - (s2s-require-encryption? #t) - (s2s-secure-auth? #t) - (authentication "internal_hashed") - (plugin-paths (list prosody-cloud-notify)) - (modules-enabled - ;; list from https://github.com/monal-im/Monal/wiki/Considerations-for-XMPP-server-admins#prosody - (cons* "sasl_ssdp" - ;; TODO update prosody to 13 - ;; "sasl2" - ;; "sasl2_bind2" - ;; "sasl2_sm" - ;; "sasl2_fast" - "muc_notifications" - "smacks" - "mam" - "csi_simple" - "cloud_notify" - "bookmarks" - %default-modules-enabled)) - ;; I don't want my syslog flooded. can't control changes either in service yet - (log "/var/lib/prosody/prosody.log") - (virtualhosts - (list - (virtualhost-configuration - (domain "vineetk.net")))))) - (service opensmtpd-service-type - (opensmtpd-configuration - (config-file %opensmtpd-config))) - (service dovecot-service-type - (dovecot-configuration - (listen '("*" "::")) - (mail-location "maildir:/var/vmail/%d/%n") - (mail-uid "vmail") - (mail-gid "vmail") - (ssl? "required") - (ssl-cert "</etc/certs/vineetk.net/fullchain.pem") - (ssl-key "</etc/certs/vineetk.net/privkey.pem") - (namespaces - (list (namespace-configuration - (name "inbox") - (inbox? #t) - (location "") - (prefix "") - (mailboxes - (list (mailbox-configuration - (name "Drafts") - (special-use '("\\Drafts"))) - (mailbox-configuration - (name "Junk") - (special-use '("\\Junk"))) - (mailbox-configuration - (name "Sent") - (special-use '("\\Sent"))) - (mailbox-configuration - (name "Trash") - (special-use '("\\Trash")))))))) - (passdbs - (list (passdb-configuration - (driver "passwd-file") - (args '("scheme=CRYPT" "username_format=%u" "/run/secrets/saklas_smtpd_passwd"))))) - (userdbs - (list (userdb-configuration - (driver "static") - (args '("uid=vmail" "gid=vmail" "home=/var/vmail/%d/%n"))))) - (protocols - (list (protocol-configuration (name "imap")) - (protocol-configuration (name "lmtp")))) - (services - (list (service-configuration - (kind "lmtp") - (listeners - (list (unix-listener-configuration - (path "lmtp") - (group "vmail") - (user "vmail")))))))))) - %base-services) - (guix-service-type config => - (guix-configuration - (inherit config) - (authorized-keys - (append (list (local-file "../../demiurge.pub")) - %default-authorized-guix-keys))))))) + ))) + (certificate-configuration + (domains '("vinbiz.ca"))))))) + (service nginx-service-type + (nginx-configuration + (server-blocks + (list (nginx-server-configuration + (server-name '("vineetk.net")) + (listen '("443 ssl")) + (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem") + (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem") + (root "/var/www/site_vineetk") + (raw-content (list "include " %nginx-badboi ";"))) + (nginx-server-configuration + (server-name '("13f0.net")) + (listen '("443 ssl")) + (ssl-certificate "/etc/certs/13f0.net/fullchain.pem") + (ssl-certificate-key "/etc/certs/13f0.net/privkey.pem") + (root "/var/www/site_13f0") + (raw-content (list "include " %nginx-badboi ";"))) + (nginx-server-configuration + (server-name '("vinbiz.ca")) + (listen '("443 ssl")) + (ssl-certificate "/etc/certs/vinbiz.ca/fullchain.pem") + (ssl-certificate-key "/etc/certs/vinbiz.ca/privkey.pem") + (root "/var/www/site_vinbiz") + (raw-content (list "include " %nginx-badboi ";"))))))) + ;; git folder needs to be readable by nginx/cgit, gets reset to 700 on reconfigure otherwise + (simple-service 'git-home-permissions + activation-service-type + #~(when (file-exists? "/data/src/bare") + (chmod "/data/src/bare" #o755))) + (service cgit-service-type + (cgit-configuration + (enable-index-links? #t) + (enable-log-filecount? #t) + (enable-log-linecount? #t) + (enable-git-config? #t) + (remove-suffix? #t) + (root-desc "") + (root-title "Vineet's git repos") + (repository-directory "/data/src/bare") + (section-from-path 1) + (side-by-side-diffs? #t) + (nginx + (list + (nginx-server-configuration + (server-name '("git.vineetk.net")) + (listen '("443 ssl")) + (root cgit) + (try-files (list "$uri" "@cgit")) + (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem") + (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem") + (raw-content (list "include" %nginx-badboi ";")) + (locations + (list + (nginx-location-configuration + (uri "@cgit") + (body '("fastcgi_param SCRIPT_FILENAME $document_root/lib/cgit/cgit.cgi;" + "fastcgi_param PATH_INFO $uri;" + "fastcgi_param QUERY_STRING $args;" + "fastcgi_param HTTP_HOST $server_name;" + "fastcgi_pass 127.0.0.1:9000;")))))))))) + (service prosody-service-type + (prosody-configuration + (admins '("vin@vineetk.net")) + (allow-registration? #f) + (c2s-require-encryption? #t) + (s2s-require-encryption? #t) + (s2s-secure-auth? #t) + (authentication "internal_hashed") + (plugin-paths (list prosody-cloud-notify)) + (modules-enabled + ;; list from https://github.com/monal-im/Monal/wiki/Considerations-for-XMPP-server-admins#prosody + (cons* "sasl_ssdp" + ;; TODO update prosody to 13 + ;; "sasl2" + ;; "sasl2_bind2" + ;; "sasl2_sm" + ;; "sasl2_fast" + "muc_notifications" + "smacks" + "mam" + "csi_simple" + "cloud_notify" + "bookmarks" + %default-modules-enabled)) + ;; I don't want my syslog flooded. can't control changes either in service yet + (log "/var/lib/prosody/prosody.log") + (virtualhosts + (list + (virtualhost-configuration + (domain "vineetk.net")))))) + (service opensmtpd-service-type + (opensmtpd-configuration + (config-file %opensmtpd-config))) + (service dovecot-service-type + (dovecot-configuration + (listen '("*" "::")) + (mail-location "maildir:/var/vmail/%d/%n") + (mail-uid "vmail") + (mail-gid "vmail") + (ssl? "required") + (ssl-cert "</etc/certs/vineetk.net/fullchain.pem") + (ssl-key "</etc/certs/vineetk.net/privkey.pem") + (namespaces + (list (namespace-configuration + (name "inbox") + (inbox? #t) + (location "") + (prefix "") + (mailboxes + (list (mailbox-configuration + (name "Drafts") + (special-use '("\\Drafts"))) + (mailbox-configuration + (name "Junk") + (special-use '("\\Junk"))) + (mailbox-configuration + (name "Sent") + (special-use '("\\Sent"))) + (mailbox-configuration + (name "Trash") + (special-use '("\\Trash")))))))) + (passdbs + (list (passdb-configuration + (driver "passwd-file") + (args '("scheme=CRYPT" "username_format=%u" "/run/secrets/saklas_smtpd_passwd"))))) + (userdbs + (list (userdb-configuration + (driver "static") + (args '("uid=vmail" "gid=vmail" "home=/var/vmail/%d/%n"))))) + (protocols + (list (protocol-configuration (name "imap")) + (protocol-configuration (name "lmtp")))) + (services + (list (service-configuration + (kind "lmtp") + (listeners + (list (unix-listener-configuration + (path "lmtp") + (group "vmail") + (user "vmail")))))))))) + %base-services) + (guix-service-type config => + (guix-configuration + (inherit config) + (authorized-keys + (append (list (local-file "../../demiurge.pub")) + %default-authorized-guix-keys)))))))