saklas: bring back main services

1 files changed, 194 insertions, 6 deletions

diff --git a/epistemia/systems/saklas.scm b/epistemia/systems/saklas.scm
index 70ca0a1..059eba6 100644
--- a/epistemia/systems/saklas.scm
+++ b/epistemia/systems/saklas.scm
@@ -305,8 +305,7 @@ table inet filter {
                                                            `(("resolv.conf"
                                                               ,(plain-file "resolv.conf"
                                                                            (string-append
-                                        ;"nameserver 127.0.0.1\n"
-                                                                            "nameserver 9.9.9.9\n"
+                                                                            "nameserver 127.0.0.1\n"
                                                                             "search epistemia\n")))))
                                            (service (fail2ban-jail-service
                                                      openssh-service-type
@@ -352,18 +351,207 @@ server:
     local-data: \"hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3\"
     local-data: \"iphonebob.epistemia. 86400 IN A 10.0.13.4\"
     local-data: \"iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4\"
-    local-data: \"lab.epistemia. 86400 IN A 10.0.13.5\"
-    local-data: \"lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5\"
     local-zone: \"saklas.epistemia.\" redirect
     local-zone: \"demiurge.epistemia.\" redirect
     local-zone: \"hastur.epistemia.\" redirect
     local-zone: \"iphonebob.epistemia.\" redirect
-    local-zone: \"lab.epistemia.\" redirect
 
 rpz:
     name: \"hagezi.ultimate\"
     zonefile: \"hagezi.ultimate\"
-    url: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt"))))
+    url: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt")))
+                                           (service wireguard-service-type
+                                                    (wireguard-configuration
+                                                      (interface "wg1")
+                                                      (addresses '("10.0.13.1/24" "fd00:b0ba:cafe:babe::1/64 "))
+                                                      (port 51820)
+                                                      (bootstrap-private-key? #f)
+                                                      (private-key "/run/secrets/wg1_saklas")
+                                                      (peers
+                                                       (list
+                                                        (wireguard-peer
+                                                          (name "demiurge.epistemia")
+                                                          (public-key "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=")
+                                                          (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128"))
+                                                          (keep-alive 25))
+                                                        (wireguard-peer
+                                                          (name "hastur.epistemia")
+                                                          (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=")
+                                                          (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128"))
+                                                          (keep-alive 25))
+                                                        (wireguard-peer
+                                                          (name "iphonebob.epistemia")
+                                                          (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=")
+                                                          (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128"))
+                                                          (keep-alive 25))
+                                                        (wireguard-peer
+                                                          (name "lab.epistemia")
+                                                          (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=")
+                                                          (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128"))
+                                                          (keep-alive 25))))))
+                                           (service certbot-service-type
+                                                    (certbot-configuration
+                                                      (email "postmaster@vineetk.net")
+                                                      (certificates
+                                                       (list
+                                                        (certificate-configuration
+                                                         (deploy-hook (program-file
+                                                                       "import-prosody-certs"
+                                                                       #~(begin
+                                                                           (let ((prosodyctl (string-append #$prosody "/bin/prosodyctl")))
+                                                                             (system* prosodyctl "--root" "cert" "import" "/etc/certs")))))
+                                                         (domains '("vineetk.net"
+                                                                    "git.vineetk.net"
+                                                                    "mail.vineetk.net"
+                                                                    "u.vineetk.net"
+                                                                    "xmpp.vineetk.net")))
+                                                        (certificate-configuration
+                                                         (domains '("13f0.net"
+                                                                    "m.13f0.net"
+                                        ;"snac.13f0.net"
+                                                                    )))
+                                                        (certificate-configuration
+                                                         (domains '("vinbiz.ca")))))))
+                                           (service nginx-service-type
+                                                    (nginx-configuration
+                                                      (server-blocks
+                                                       (list (nginx-server-configuration
+                                                               (server-name '("vineetk.net"))
+                                                               (listen '("443 ssl"))
+                                                               (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem")
+                                                               (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem")
+                                                               (root "/var/www/site_vineetk")
+                                                               (raw-content (list "include " %nginx-badboi ";")))
+                                                             (nginx-server-configuration
+                                                               (server-name '("13f0.net"))
+                                                               (listen '("443 ssl"))
+                                                               (ssl-certificate "/etc/certs/13f0.net/fullchain.pem")
+                                                               (ssl-certificate-key "/etc/certs/13f0.net/privkey.pem")
+                                                               (root "/var/www/site_13f0")
+                                                               (raw-content (list "include " %nginx-badboi ";")))
+                                                             (nginx-server-configuration
+                                                               (server-name '("vinbiz.ca"))
+                                                               (listen '("443 ssl"))
+                                                               (ssl-certificate "/etc/certs/vinbiz.ca/fullchain.pem")
+                                                               (ssl-certificate-key "/etc/certs/vinbiz.ca/privkey.pem")
+                                                               (root "/var/www/site_vinbiz")
+                                                               (raw-content (list "include " %nginx-badboi ";")))))))
+                                           ;; git folder needs to be readable by nginx/cgit, gets reset to 700 on reconfigure otherwise
+                                           (simple-service 'git-home-permissions
+                                                           activation-service-type
+                                                           #~(when (file-exists? "/data/src/bare")
+                                                               (chmod "/data/src/bare" #o775)))
+                                           (service cgit-service-type
+                                                    (cgit-configuration
+                                                      (enable-index-links? #t)
+                                                      (enable-log-filecount? #t)
+                                                      (enable-log-linecount? #t)
+                                                      (enable-git-config? #t)
+                                                      (remove-suffix? #t)
+                                                      (root-desc "")
+                                                      (root-title "Vineet's git repos")
+                                                      (repository-directory "/data/src/bare")
+                                                      (section-from-path 1)
+                                                      (side-by-side-diffs? #t)
+                                                      (nginx
+                                                       (list
+                                                        (nginx-server-configuration
+                                                          (server-name '("git.vineetk.net"))
+                                                          (listen '("443 ssl"))
+                                                          (root cgit)
+                                                          (try-files (list "$uri" "@cgit"))
+                                                          (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem")
+                                                          (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem")
+                                                          (raw-content (list "include" %nginx-badboi ";"))
+                                                          (locations
+                                                           (list
+                                                            (nginx-location-configuration
+                                                              (uri "@cgit")
+                                                              (body '("fastcgi_param SCRIPT_FILENAME $document_root/lib/cgit/cgit.cgi;"
+                                                                      "fastcgi_param PATH_INFO $uri;"
+                                                                      "fastcgi_param QUERY_STRING $args;"
+                                                                      "fastcgi_param HTTP_HOST $server_name;"
+                                                                      "fastcgi_pass 127.0.0.1:9000;"))))))))))
+                                           (service prosody-service-type
+                                                    (prosody-configuration
+                                                      (admins '("vin@vineetk.net"))
+                                                      (allow-registration? #f)
+                                                      (c2s-require-encryption? #t)
+                                                      (s2s-require-encryption? #t)
+                                                      (s2s-secure-auth? #t)
+                                                      (authentication "internal_hashed")
+                                                      (plugin-paths (list prosody-cloud-notify))
+                                                      (modules-enabled
+                                                       ;; list from https://github.com/monal-im/Monal/wiki/Considerations-for-XMPP-server-admins#prosody
+                                                       (cons* "sasl_ssdp"
+                                                              ;; TODO update prosody to 13
+                                                              ;; "sasl2"
+                                                              ;; "sasl2_bind2"
+                                                              ;; "sasl2_sm"
+                                                              ;; "sasl2_fast"
+                                                              "muc_notifications"
+                                                              "smacks"
+                                                              "mam"
+                                                              "csi_simple"
+                                                              "cloud_notify"
+                                                              "bookmarks"
+                                                              %default-modules-enabled))
+                                                      ;; I don't want my syslog flooded. can't control changes either in service yet
+                                                      (log "/var/lib/prosody/prosody.log")
+                                                      (virtualhosts
+                                                       (list
+                                                        (virtualhost-configuration
+                                                          (domain "vineetk.net"))))))
+                                           (service opensmtpd-service-type
+                                                    (opensmtpd-configuration
+                                                      (config-file %opensmtpd-config)))
+                                           (service dovecot-service-type
+                                                    (dovecot-configuration
+                                                      (listen '("*" "::"))
+                                                      (mail-location "maildir:/var/vmail/%d/%n")
+                                                      (mail-uid "vmail")
+                                                      (mail-gid "vmail")
+                                                      (ssl? "required")
+                                                      (ssl-cert "</etc/certs/vineetk.net/fullchain.pem")
+                                                      (ssl-key "</etc/certs/vineetk.net/privkey.pem")
+                                                      (namespaces
+                                                       (list (namespace-configuration
+                                                               (name "inbox")
+                                                               (inbox? #t)
+                                                               (location "")
+                                                               (prefix "")
+                                                               (mailboxes
+                                                                (list (mailbox-configuration
+                                                                        (name "Drafts")
+                                                                        (special-use '("\\Drafts")))
+                                                                      (mailbox-configuration
+                                                                        (name "Junk")
+                                                                        (special-use '("\\Junk")))
+                                                                      (mailbox-configuration
+                                                                        (name "Sent")
+                                                                        (special-use '("\\Sent")))
+                                                                      (mailbox-configuration
+                                                                        (name "Trash")
+                                                                        (special-use '("\\Trash"))))))))
+                                                      (passdbs
+                                                       (list (passdb-configuration
+                                                               (driver "passwd-file")
+                                                               (args '("scheme=CRYPT" "username_format=%u" "/run/secrets/saklas_smtpd_passwd")))))
+                                                      (userdbs
+                                                       (list (userdb-configuration
+                                                               (driver "static")
+                                                               (args '("uid=vmail" "gid=vmail" "home=/var/vmail/%d/%n")))))
+                                                      (protocols
+                                                       (list (protocol-configuration (name "imap"))
+                                                             (protocol-configuration (name "lmtp"))))
+                                                      (services
+                                                       (list (service-configuration
+                                                               (kind "lmtp")
+                                                               (listeners
+                                                                (list (unix-listener-configuration
+                                                                        (path "lmtp")
+                                                                        (group "vmail")
+                                                                        (user "vmail"))))))))))
                                      %base-services)
               (guix-service-type config =>
                                  (guix-configuration