saklas: switch back to old vps for now

1 files changed, 388 insertions, 385 deletions

diff --git a/epistemia/systems/saklas.scm b/epistemia/systems/saklas.scm
index 16b52aa..84fb536 100644
--- a/epistemia/systems/saklas.scm
+++ b/epistemia/systems/saklas.scm
@@ -188,181 +188,184 @@ table inet filter {
 
 
 (operating-system
-  (inherit base-system)
-  (host-name "saklas.epistemia")
+ (inherit base-system)
+ (host-name "saklas.epistemia")
 
-  (users (cons* (user-account
-                  (name "vin")
-                  (comment "Vineet")
-                  (shell (file-append bash "/bin/bash"))
-                  (group "users")
-                  (supplementary-groups '("wheel" "git" "torrents")))
-                (user-account
-                  (name "git")
-                  (comment "git account")
-                  (group "git")
-                  (shell (file-append git "/bin/git-shell"))
-                  (home-directory "/data/src/bare")
-                  (system? #t))
-                (user-account
-                  (name "torrents")
-                  (comment "torrenting account")
-                  (group "torrents")
-                  (shell "/dev/null")
-                  (home-directory "/var/empty")
-                  (system? #t))
-                (user-account
-                  (name "vmail")
-                  (comment "virtual mail account")
-                  (group "vmail")
-                  (shell "/dev/null")
-                  (home-directory "/var/vmail")
-                  (system? #t))
-                %base-user-accounts))
-  (groups (cons* (user-group
-                   (name "git"))
-                 (user-group
-                   (name "torrents"))
-                 (user-group
-                   (name "vmail"))
-                 %base-groups))
+ (users (cons* (user-account
+                (name "vin")
+                (comment "Vineet")
+                (shell (file-append bash "/bin/bash"))
+                (group "users")
+                (supplementary-groups '("wheel" "git" "torrents")))
+               (user-account
+                (name "git")
+                (comment "git account")
+                (group "git")
+                (shell (file-append git "/bin/git-shell"))
+                (home-directory "/data/src/bare")
+                (system? #t))
+               (user-account
+                (name "torrents")
+                (comment "torrenting account")
+                (group "torrents")
+                (shell "/dev/null")
+                (home-directory "/var/empty")
+                (system? #t))
+               (user-account
+                (name "vmail")
+                (comment "virtual mail account")
+                (group "vmail")
+                (shell "/dev/null")
+                (home-directory "/var/vmail")
+                (system? #t))
+               %base-user-accounts))
+ (groups (cons* (user-group
+                 (name "git"))
+                (user-group
+                 (name "torrents"))
+                (user-group
+                 (name "vmail"))
+                %base-groups))
 
-  (kernel linux-6.18)
-  (kernel-arguments (list "net.ifnames=0"))
-  (kernel-loadable-modules (list (list zfs-linux "module")))
+ (kernel linux-6.18)
+ (kernel-arguments (list "net.ifnames=0"))
+ (kernel-loadable-modules (list (list zfs-linux "module")))
 
-  (initrd (lambda (file-systems . args)
-            (apply microcode-initrd file-systems
-                   #:initrd epistemia-zfs-initrd
-                   #:zfs-package zfs-linux
-                   args)))
-  (firmware (cons* amdgpu-firmware %base-firmware))
+ (initrd (lambda (file-systems . args)
+           (apply microcode-initrd file-systems
+                  #:initrd epistemia-zfs-initrd
+                  #:zfs-package zfs-linux
+                  args)))
+ (firmware (cons* amdgpu-firmware %base-firmware))
 
-  (bootloader (bootloader-configuration
-                (bootloader grub-zfs-bios)
-                (targets '("/dev/sda"
-                           "/dev/sdb"))))
+ (bootloader (bootloader-configuration
+              (bootloader grub-zfs-bios)
+              (targets '("/dev/sda"))))
 
-  (file-systems (append
-                 (list (file-system
-                         (device "zroot/root")
-                         (mount-point "/")
-                         (type "zfs")
-                         (check? #f)
-                         (needed-for-boot? #t))
-                       (file-system
-                         (device "zroot/gnu")
-                         (mount-point "/gnu")
-                         (type "zfs")
-                         (check? #f)
-                         (needed-for-boot? #t))
-                       (file-system
-                         (device "zroot/var")
-                         (mount-point "/var")
-                         (type "zfs")
-                         (check? #f)
-                         (needed-for-boot? #t))
-                       (file-system
-                         (device "zroot/home")
-                         (mount-point "/home")
-                         (type "zfs")
-                         (check? #f)
-                         (needed-for-boot? #t)))
-                 %base-file-systems))
+ (file-systems (append
+                (list (file-system
+                       (device "zroot/root")
+                       (mount-point "/")
+                       (type "zfs")
+                       (check? #f)
+                       (needed-for-boot? #t))
+                      (file-system
+                       (device "zroot/gnu")
+                       (mount-point "/gnu")
+                       (type "zfs")
+                       (check? #f)
+                       (needed-for-boot? #t))
+                      (file-system
+                       (device "zroot/var")
+                       (mount-point "/var")
+                       (type "zfs")
+                       (check? #f)
+                       (needed-for-boot? #t))
+                      (file-system
+                       (device "zroot/home")
+                       (mount-point "/home")
+                       (type "zfs")
+                       (check? #f)
+                       (needed-for-boot? #t))
+                      (file-system
+                       (device (uuid "0837-6658" 'fat))
+                       (mount-point "/boot/efi")
+                       (type "vfat")))
+                %base-file-systems))
 
-  (packages (append (list emacs-no-x
-                          git
-                          zfs-linux)
-                    %base-packages))
+ (packages (append (list emacs-no-x
+                         git
+                         zfs-linux)
+                   %base-packages))
 
-  (services (modify-services (append (list (service age-secret-service-type
-                                                    (age-secret-configuration
-                                                     (secrets (list
-                                                               (age-secret
-                                                                (name "wg1_saklas")
-                                                                (file (local-file "../secrets/wg1_saklas.age")))
-                                                               (age-secret
-                                                                (name "saklas_smtpd_dkim")
-                                                                (file (local-file "../secrets/saklas_smtpd_dkim.age"))
-                                                                (owner "smtpd")
-                                                                (group "nogroup")
-                                                                (mode #o400))
-                                                               (age-secret
-                                                                (name "saklas_smtpd_virtuals")
-                                                                (file (local-file "../secrets/saklas_smtpd_virtuals.age"))
-                                                                (owner "smtpd")
-                                                                (group "nogroup")
-                                                                (mode #o400))
-                                                               (age-secret
-                                                                (name "saklas_smtpd_passwd")
-                                                                (file (local-file "../secrets/saklas_smtpd_passwd.age"))
-                                                                (owner "smtpd")
-                                                                (group "dovecot")
-                                                                (mode #o440))))))
-                                           (simple-service 'zfs-loader
-                                                           kernel-module-loader-service-type
-                                                           '("zfs"))
-                                           (simple-service 'zfs-shepherd-services
-                                                           shepherd-root-service-type
-                                                           zfs-shepherd-services)
-                                           (simple-service 'zfs-shepherd-services-user-processes
-                                                           user-processes-service-type
-                                                           '(zfs-automount))
-                                           (service nftables-service-type
-                                                    (nftables-configuration
-                                                      (ruleset %nftables-ruleset)))
-                                           (service static-networking-service-type
-                                                    (list (static-networking
-                                                            (addresses
-                                                             (list (network-address
-                                                                     (device "eth0")
-                                                                     (value "51.68.181.121/32"))
-                                                                   (network-address
-                                                                     (device "eth0")
-                                                                     (value "2001:41d0:700:1c79::1/128"))))
-                                                            (routes
-                                                             (list (network-route
-                                                                     (destination "default")
-                                                                     (device "eth0")
-                                                                     (gateway "51.68.181.254"))
-                                                                   (network-route
-                                                                     (destination "default")
-                                                                     (device "eth0")
-                                                                     (gateway "2001:41d0:0700:1cff:00ff:00ff:00ff:00ff")))))))
-                                           (simple-service 'resolv-configuration
-                                                           etc-service-type
-                                                           `(("resolv.conf"
-                                                              ,(plain-file "resolv.conf"
-                                                                           (string-append
-                                                                            "nameserver 127.0.0.1\n"
-                                                                            "search epistemia\n")))))
-                                           (service (fail2ban-jail-service
-                                                     openssh-service-type
-                                                     (fail2ban-jail-configuration
-                                                       (name "sshd")
-                                                       (enabled? #t)))
-                                                    (openssh-configuration
-                                                      (permit-root-login 'prohibit-password)
-                                                      (password-authentication? #f)
-                                                      (authorized-keys
-                                                       `(("vin" ,(local-file "/data/ssh/id_ed25519.pub"))
-                                                         ("git" ,(local-file "/data/ssh/id_ed25519.pub"))
-                                                         ("root" ,(local-file "/data/ssh/id_ed25519.pub"))))
-                                                      (extra-content "\
+ (services (modify-services (append (list (service age-secret-service-type
+                                                   (age-secret-configuration
+                                                    (secrets (list
+                                                              (age-secret
+                                                               (name "wg1_saklas")
+                                                               (file (local-file "../secrets/wg1_saklas.age")))
+                                                              (age-secret
+                                                               (name "saklas_smtpd_dkim")
+                                                               (file (local-file "../secrets/saklas_smtpd_dkim.age"))
+                                                               (owner "smtpd")
+                                                               (group "nogroup")
+                                                               (mode #o400))
+                                                              (age-secret
+                                                               (name "saklas_smtpd_virtuals")
+                                                               (file (local-file "../secrets/saklas_smtpd_virtuals.age"))
+                                                               (owner "smtpd")
+                                                               (group "nogroup")
+                                                               (mode #o400))
+                                                              (age-secret
+                                                               (name "saklas_smtpd_passwd")
+                                                               (file (local-file "../secrets/saklas_smtpd_passwd.age"))
+                                                               (owner "smtpd")
+                                                               (group "dovecot")
+                                                               (mode #o440))))))
+                                          (simple-service 'zfs-loader
+                                                          kernel-module-loader-service-type
+                                                          '("zfs"))
+                                          (simple-service 'zfs-shepherd-services
+                                                          shepherd-root-service-type
+                                                          zfs-shepherd-services)
+                                          (simple-service 'zfs-shepherd-services-user-processes
+                                                          user-processes-service-type
+                                                          '(zfs-automount))
+                                          (service nftables-service-type
+                                                   (nftables-configuration
+                                                    (ruleset %nftables-ruleset)))
+                                          (service static-networking-service-type
+                                                   (list (static-networking
+                                                          (addresses
+                                                           (list (network-address
+                                                                  (device "eth0")
+                                                                  (value "157.180.125.215/32"))
+                                                                 (network-address
+                                                                  (device "eth0")
+                                                                  (value "2a01:4f9:c013:d07e::1/64"))))
+                                                          (routes
+                                                           (list (network-route
+                                                                  (destination "default")
+                                                                  (device "eth0")
+                                                                  (gateway "172.31.1.1"))
+                                                                 (network-route
+                                                                  (destination "default")
+                                                                  (device "eth0")
+                                                                  (gateway "fe80::1")))))))
+                                          (simple-service 'resolv-configuration
+                                                          etc-service-type
+                                                          `(("resolv.conf"
+                                                             ,(plain-file "resolv.conf"
+                                                                          (string-append
+                                                                           "nameserver 127.0.0.1\n"
+                                                                           "search epistemia\n")))))
+                                          (service (fail2ban-jail-service
+                                                    openssh-service-type
+                                                    (fail2ban-jail-configuration
+                                                     (name "sshd")
+                                                     (enabled? #t)))
+                                                   (openssh-configuration
+                                                    (permit-root-login 'prohibit-password)
+                                                    (password-authentication? #f)
+                                                    (authorized-keys
+                                                     `(("vin" ,(local-file "/data/ssh/id_ed25519.pub"))
+                                                       ("git" ,(local-file "/data/ssh/id_ed25519.pub"))
+                                                       ("root" ,(local-file "/data/ssh/id_ed25519.pub"))))
+                                                    (extra-content "\
                                        ListenAddress 127.0.0.1:22
-                                       ListenAddress 51.68.181.121:22
+                                       ListenAddress 157.180.125.215:22
                                        #ListenAddress 10.0.13.1:22
                                        ")))
-                                           (service unbound-service-type
-                                                    (unbound-configuration
-                                                      (server
-                                                       (unbound-server
-                                                         (interface '("127.0.0.1"
-                                                                      "::1"
-                                                                      "10.0.13.1"))
-                                                         (hide-version #t)
-                                                         (hide-identity #t)))
-                                                      (extra-content "\
+                                          (service unbound-service-type
+                                                   (unbound-configuration
+                                                    (server
+                                                     (unbound-server
+                                                      (interface '("127.0.0.1"
+                                                                   "::1"
+                                                                   "10.0.13.1"))
+                                                      (hide-version #t)
+                                                      (hide-identity #t)))
+                                                    (extra-content "\
 server:
     access-control: 127.0.0.0/8 allow
     access-control: 10.0.13.0/24 allow
@@ -392,224 +395,224 @@ rpz:
     name: \"hagezi.ultimate\"
     zonefile: \"hagezi.ultimate\"
     url: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt")))
-                                           (simple-service 'rtorrent
-                                                           shepherd-root-service-type
-                                                           (list 
-                                                            (shepherd-service
-                                                              (provision '(rtorrent))
-                                                              (requirement '(user-processes loopback syslogd))
-                                                              (start #~(make-forkexec-constructor
-                                                                        (list #$(file-append rtorrent-xmlrpc "/bin/rtorrent")
-                                                                              "-n"
-                                                                              "-b" "51.68.181.121"
-                                                                              "-p" "51413-51413"
-                                                                              "-d" "/data/torrents/complete/other"
-                                                                              "-s" "/data/torrents/rtorrent"
-                                                                              "-o" (string-append "system.umask.set=0002,"
-                                                                                                  "dht.mode.set=disable,"
-                                                                                                  "protocol.pex.set=no,"
-                                                                                                  "network.scgi.open_port=10.0.13.1:5000,"
-                                                                                                  "system.daemon.set=true"))
-                                                                        #:user "torrents" #:group "torrents"))
-                                                              (stop #~(make-kill-destructor))
-                                                              (documentation "Run rtorrent in headless mode (only xmlrpc)."))))
-                                           (service wireguard-service-type
-                                                    (wireguard-configuration
-                                                      (interface "wg1")
-                                                      (addresses '("10.0.13.1/24" "fd00:b0ba:cafe:babe::1/64 "))
-                                                      (port 51820)
-                                                      (bootstrap-private-key? #f)
-                                                      (private-key "/run/secrets/wg1_saklas")
-                                                      (peers
-                                                       (list
-                                                        (wireguard-peer
-                                                          (name "demiurge.epistemia")
-                                                          (public-key "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=")
-                                                          (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128"))
-                                                          (keep-alive 25))
-                                                        (wireguard-peer
-                                                          (name "hastur.epistemia")
-                                                          (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=")
-                                                          (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128"))
-                                                          (keep-alive 25))
-                                                        (wireguard-peer
-                                                          (name "iphonebob.epistemia")
-                                                          (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=")
-                                                          (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128"))
-                                                          (keep-alive 25))
-                                                        (wireguard-peer
-                                                          (name "lab.epistemia")
-                                                          (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=")
-                                                          (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128"))
-                                                          (keep-alive 25))))))
-                                           (service certbot-service-type
-                                                    (certbot-configuration
-                                                      (email "postmaster@vineetk.net")
-                                                      (certificates
-                                                       (list
-                                                        (certificate-configuration
-                                                         (deploy-hook (program-file
-                                                                       "import-prosody-certs"
-                                                                       #~(begin
-                                                                           (let ((prosodyctl (string-append #$prosody "/bin/prosodyctl")))
-                                                                             (system* prosodyctl "--root" "cert" "import" "/etc/certs")))))
-                                                         (domains '("vineetk.net"
-                                                                    "git.vineetk.net"
-                                                                    "mail.vineetk.net"
-                                                                    "u.vineetk.net"
-                                                                    "xmpp.vineetk.net"
-                                                                    )))
-                                                        (certificate-configuration
-                                                         (domains '("13f0.net"
-                                                                    "m.13f0.net"
+                                          (simple-service 'rtorrent
+                                                          shepherd-root-service-type
+                                                          (list 
+                                                           (shepherd-service
+                                                            (provision '(rtorrent))
+                                                            (requirement '(user-processes loopback syslogd))
+                                                            (start #~(make-forkexec-constructor
+                                                                      (list #$(file-append rtorrent-xmlrpc "/bin/rtorrent")
+                                                                            "-n"
+                                                                            "-b" "157.180.125.215"
+                                                                            "-p" "51413-51413"
+                                                                            "-d" "/data/torrents/complete/other"
+                                                                            "-s" "/data/torrents/rtorrent"
+                                                                            "-o" (string-append "system.umask.set=0002,"
+                                                                                                "dht.mode.set=disable,"
+                                                                                                "protocol.pex.set=no,"
+                                                                                                "network.scgi.open_port=10.0.13.1:5000,"
+                                                                                                "system.daemon.set=true"))
+                                                                      #:user "torrents" #:group "torrents"))
+                                                            (stop #~(make-kill-destructor))
+                                                            (documentation "Run rtorrent in headless mode (only xmlrpc)."))))
+                                          (service wireguard-service-type
+                                                   (wireguard-configuration
+                                                    (interface "wg1")
+                                                    (addresses '("10.0.13.1/24" "fd00:b0ba:cafe:babe::1/64 "))
+                                                    (port 51820)
+                                                    (bootstrap-private-key? #f)
+                                                    (private-key "/run/secrets/wg1_saklas")
+                                                    (peers
+                                                     (list
+                                                      (wireguard-peer
+                                                       (name "demiurge.epistemia")
+                                                       (public-key "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=")
+                                                       (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128"))
+                                                       (keep-alive 25))
+                                                      (wireguard-peer
+                                                       (name "hastur.epistemia")
+                                                       (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=")
+                                                       (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128"))
+                                                       (keep-alive 25))
+                                                      (wireguard-peer
+                                                       (name "iphonebob.epistemia")
+                                                       (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=")
+                                                       (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128"))
+                                                       (keep-alive 25))
+                                                      (wireguard-peer
+                                                       (name "lab.epistemia")
+                                                       (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=")
+                                                       (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128"))
+                                                       (keep-alive 25))))))
+                                          (service certbot-service-type
+                                                   (certbot-configuration
+                                                    (email "postmaster@vineetk.net")
+                                                    (certificates
+                                                     (list
+                                                      (certificate-configuration
+                                                       (deploy-hook (program-file
+                                                                     "import-prosody-certs"
+                                                                     #~(begin
+                                                                         (let ((prosodyctl (string-append #$prosody "/bin/prosodyctl")))
+                                                                           (system* prosodyctl "--root" "cert" "import" "/etc/certs")))))
+                                                       (domains '("vineetk.net"
+                                                                  "git.vineetk.net"
+                                                                  "mail.vineetk.net"
+                                                                  "u.vineetk.net"
+                                                                  "xmpp.vineetk.net"
+                                                                  )))
+                                                      (certificate-configuration
+                                                       (domains '("13f0.net"
+                                                                  "m.13f0.net"
                                         ;"snac.13f0.net"
-                                                                    )))
-                                                        (certificate-configuration
-                                                         (domains '("vinbiz.ca")))))))
-                                           (service nginx-service-type
-                                                    (nginx-configuration
-                                                      (server-blocks
-                                                       (list (nginx-server-configuration
-                                                               (server-name '("vineetk.net"))
-                                                               (listen '("443 ssl"))
-                                                               (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem")
-                                                               (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem")
-                                                               (root "/var/www/site_vineetk")
-                                                               (raw-content (list "include " %nginx-badboi ";")))
-                                                             (nginx-server-configuration
-                                                               (server-name '("13f0.net"))
-                                                               (listen '("443 ssl"))
-                                                               (ssl-certificate "/etc/certs/13f0.net/fullchain.pem")
-                                                               (ssl-certificate-key "/etc/certs/13f0.net/privkey.pem")
-                                                               (root "/var/www/site_13f0")
-                                                               (raw-content (list "include " %nginx-badboi ";")))
-                                                             (nginx-server-configuration
-                                                               (server-name '("vinbiz.ca"))
-                                                               (listen '("443 ssl"))
-                                                               (ssl-certificate "/etc/certs/vinbiz.ca/fullchain.pem")
-                                                               (ssl-certificate-key "/etc/certs/vinbiz.ca/privkey.pem")
-                                                               (root "/var/www/site_vinbiz")
-                                                               (raw-content (list "include " %nginx-badboi ";")))))))
-                                           ;; git folder needs to be readable by nginx/cgit, gets reset to 700 on reconfigure otherwise
-                                           (simple-service 'git-home-permissions
-                                                           activation-service-type
-                                                           #~(when (file-exists? "/data/src/bare")
-                                                               (chmod "/data/src/bare" #o755)))
-                                           (service cgit-service-type
-                                                    (cgit-configuration
-                                                      (enable-index-links? #t)
-                                                      (enable-log-filecount? #t)
-                                                      (enable-log-linecount? #t)
-                                                      (enable-git-config? #t)
-                                                      (remove-suffix? #t)
-                                                      (root-desc "")
-                                                      (root-title "Vineet's git repos")
-                                                      (repository-directory "/data/src/bare")
-                                                      (section-from-path 1)
-                                                      (side-by-side-diffs? #t)
-                                                      (nginx
-                                                       (list
-                                                        (nginx-server-configuration
-                                                          (server-name '("git.vineetk.net"))
-                                                          (listen '("443 ssl"))
-                                                          (root cgit)
-                                                          (try-files (list "$uri" "@cgit"))
-                                                          (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem")
-                                                          (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem")
-                                                          (raw-content (list "include" %nginx-badboi ";"))
-                                                          (locations
-                                                           (list
-                                                            (nginx-location-configuration
-                                                              (uri "@cgit")
-                                                              (body '("fastcgi_param SCRIPT_FILENAME $document_root/lib/cgit/cgit.cgi;"
-                                                                      "fastcgi_param PATH_INFO $uri;"
-                                                                      "fastcgi_param QUERY_STRING $args;"
-                                                                      "fastcgi_param HTTP_HOST $server_name;"
-                                                                      "fastcgi_pass 127.0.0.1:9000;"))))))))))
-                                           (service prosody-service-type
-                                                    (prosody-configuration
-                                                      (admins '("vin@vineetk.net"))
-                                                      (allow-registration? #f)
-                                                      (c2s-require-encryption? #t)
-                                                      (s2s-require-encryption? #t)
-                                                      (s2s-secure-auth? #t)
-                                                      (authentication "internal_hashed")
-                                                      (plugin-paths (list prosody-cloud-notify))
-                                                      (modules-enabled
-                                                       ;; list from https://github.com/monal-im/Monal/wiki/Considerations-for-XMPP-server-admins#prosody
-                                                       (cons* "sasl_ssdp"
-                                                              ;; TODO update prosody to 13
-                                                              ;; "sasl2"
-                                                              ;; "sasl2_bind2"
-                                                              ;; "sasl2_sm"
-                                                              ;; "sasl2_fast"
-                                                              "muc_notifications"
-                                                              "smacks"
-                                                              "mam"
-                                                              "csi_simple"
-                                                              "cloud_notify"
-                                                              "bookmarks"
-                                                              %default-modules-enabled))
-                                                      ;; I don't want my syslog flooded. can't control changes either in service yet
-                                                      (log "/var/lib/prosody/prosody.log")
-                                                      (virtualhosts
-                                                       (list
-                                                        (virtualhost-configuration
-                                                          (domain "vineetk.net"))))))
-                                           (service opensmtpd-service-type
-                                                    (opensmtpd-configuration
-                                                      (config-file %opensmtpd-config)))
-                                           (service dovecot-service-type
-                                                    (dovecot-configuration
-                                                      (listen '("*" "::"))
-                                                      (mail-location "maildir:/var/vmail/%d/%n")
-                                                      (mail-uid "vmail")
-                                                      (mail-gid "vmail")
-                                                      (ssl? "required")
-                                                      (ssl-cert "</etc/certs/vineetk.net/fullchain.pem")
-                                                      (ssl-key "</etc/certs/vineetk.net/privkey.pem")
-                                                      (namespaces
-                                                       (list (namespace-configuration
-                                                               (name "inbox")
-                                                               (inbox? #t)
-                                                               (location "")
-                                                               (prefix "")
-                                                               (mailboxes
-                                                                (list (mailbox-configuration
-                                                                        (name "Drafts")
-                                                                        (special-use '("\\Drafts")))
-                                                                      (mailbox-configuration
-                                                                        (name "Junk")
-                                                                        (special-use '("\\Junk")))
-                                                                      (mailbox-configuration
-                                                                        (name "Sent")
-                                                                        (special-use '("\\Sent")))
-                                                                      (mailbox-configuration
-                                                                        (name "Trash")
-                                                                        (special-use '("\\Trash"))))))))
-                                                      (passdbs
-                                                       (list (passdb-configuration
-                                                               (driver "passwd-file")
-                                                               (args '("scheme=CRYPT" "username_format=%u" "/run/secrets/saklas_smtpd_passwd")))))
-                                                      (userdbs
-                                                       (list (userdb-configuration
-                                                               (driver "static")
-                                                               (args '("uid=vmail" "gid=vmail" "home=/var/vmail/%d/%n")))))
-                                                      (protocols
-                                                       (list (protocol-configuration (name "imap"))
-                                                             (protocol-configuration (name "lmtp"))))
-                                                      (services
-                                                       (list (service-configuration
-                                                               (kind "lmtp")
-                                                               (listeners
-                                                                (list (unix-listener-configuration
-                                                                        (path "lmtp")
-                                                                        (group "vmail")
-                                                                        (user "vmail"))))))))))
-                                     %base-services)
-              (guix-service-type config =>
-                                 (guix-configuration
-                                   (inherit config)
-                                   (authorized-keys
-                                    (append (list (local-file "../../demiurge.pub"))
-                                            %default-authorized-guix-keys)))))))
+                                                                  )))
+                                                      (certificate-configuration
+                                                       (domains '("vinbiz.ca")))))))
+                                          (service nginx-service-type
+                                                   (nginx-configuration
+                                                    (server-blocks
+                                                     (list (nginx-server-configuration
+                                                            (server-name '("vineetk.net"))
+                                                            (listen '("443 ssl"))
+                                                            (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem")
+                                                            (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem")
+                                                            (root "/var/www/site_vineetk")
+                                                            (raw-content (list "include " %nginx-badboi ";")))
+                                                           (nginx-server-configuration
+                                                            (server-name '("13f0.net"))
+                                                            (listen '("443 ssl"))
+                                                            (ssl-certificate "/etc/certs/13f0.net/fullchain.pem")
+                                                            (ssl-certificate-key "/etc/certs/13f0.net/privkey.pem")
+                                                            (root "/var/www/site_13f0")
+                                                            (raw-content (list "include " %nginx-badboi ";")))
+                                                           (nginx-server-configuration
+                                                            (server-name '("vinbiz.ca"))
+                                                            (listen '("443 ssl"))
+                                                            (ssl-certificate "/etc/certs/vinbiz.ca/fullchain.pem")
+                                                            (ssl-certificate-key "/etc/certs/vinbiz.ca/privkey.pem")
+                                                            (root "/var/www/site_vinbiz")
+                                                            (raw-content (list "include " %nginx-badboi ";")))))))
+                                          ;; git folder needs to be readable by nginx/cgit, gets reset to 700 on reconfigure otherwise
+                                          (simple-service 'git-home-permissions
+                                                          activation-service-type
+                                                          #~(when (file-exists? "/data/src/bare")
+                                                              (chmod "/data/src/bare" #o755)))
+                                          (service cgit-service-type
+                                                   (cgit-configuration
+                                                    (enable-index-links? #t)
+                                                    (enable-log-filecount? #t)
+                                                    (enable-log-linecount? #t)
+                                                    (enable-git-config? #t)
+                                                    (remove-suffix? #t)
+                                                    (root-desc "")
+                                                    (root-title "Vineet's git repos")
+                                                    (repository-directory "/data/src/bare")
+                                                    (section-from-path 1)
+                                                    (side-by-side-diffs? #t)
+                                                    (nginx
+                                                     (list
+                                                      (nginx-server-configuration
+                                                       (server-name '("git.vineetk.net"))
+                                                       (listen '("443 ssl"))
+                                                       (root cgit)
+                                                       (try-files (list "$uri" "@cgit"))
+                                                       (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem")
+                                                       (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem")
+                                                       (raw-content (list "include" %nginx-badboi ";"))
+                                                       (locations
+                                                        (list
+                                                         (nginx-location-configuration
+                                                          (uri "@cgit")
+                                                          (body '("fastcgi_param SCRIPT_FILENAME $document_root/lib/cgit/cgit.cgi;"
+                                                                  "fastcgi_param PATH_INFO $uri;"
+                                                                  "fastcgi_param QUERY_STRING $args;"
+                                                                  "fastcgi_param HTTP_HOST $server_name;"
+                                                                  "fastcgi_pass 127.0.0.1:9000;"))))))))))
+                                          (service prosody-service-type
+                                                   (prosody-configuration
+                                                    (admins '("vin@vineetk.net"))
+                                                    (allow-registration? #f)
+                                                    (c2s-require-encryption? #t)
+                                                    (s2s-require-encryption? #t)
+                                                    (s2s-secure-auth? #t)
+                                                    (authentication "internal_hashed")
+                                                    (plugin-paths (list prosody-cloud-notify))
+                                                    (modules-enabled
+                                                     ;; list from https://github.com/monal-im/Monal/wiki/Considerations-for-XMPP-server-admins#prosody
+                                                     (cons* "sasl_ssdp"
+                                                            ;; TODO update prosody to 13
+                                                            ;; "sasl2"
+                                                            ;; "sasl2_bind2"
+                                                            ;; "sasl2_sm"
+                                                            ;; "sasl2_fast"
+                                                            "muc_notifications"
+                                                            "smacks"
+                                                            "mam"
+                                                            "csi_simple"
+                                                            "cloud_notify"
+                                                            "bookmarks"
+                                                            %default-modules-enabled))
+                                                    ;; I don't want my syslog flooded. can't control changes either in service yet
+                                                    (log "/var/lib/prosody/prosody.log")
+                                                    (virtualhosts
+                                                     (list
+                                                      (virtualhost-configuration
+                                                       (domain "vineetk.net"))))))
+                                          (service opensmtpd-service-type
+                                                   (opensmtpd-configuration
+                                                    (config-file %opensmtpd-config)))
+                                          (service dovecot-service-type
+                                                   (dovecot-configuration
+                                                    (listen '("*" "::"))
+                                                    (mail-location "maildir:/var/vmail/%d/%n")
+                                                    (mail-uid "vmail")
+                                                    (mail-gid "vmail")
+                                                    (ssl? "required")
+                                                    (ssl-cert "</etc/certs/vineetk.net/fullchain.pem")
+                                                    (ssl-key "</etc/certs/vineetk.net/privkey.pem")
+                                                    (namespaces
+                                                     (list (namespace-configuration
+                                                            (name "inbox")
+                                                            (inbox? #t)
+                                                            (location "")
+                                                            (prefix "")
+                                                            (mailboxes
+                                                             (list (mailbox-configuration
+                                                                    (name "Drafts")
+                                                                    (special-use '("\\Drafts")))
+                                                                   (mailbox-configuration
+                                                                    (name "Junk")
+                                                                    (special-use '("\\Junk")))
+                                                                   (mailbox-configuration
+                                                                    (name "Sent")
+                                                                    (special-use '("\\Sent")))
+                                                                   (mailbox-configuration
+                                                                    (name "Trash")
+                                                                    (special-use '("\\Trash"))))))))
+                                                    (passdbs
+                                                     (list (passdb-configuration
+                                                            (driver "passwd-file")
+                                                            (args '("scheme=CRYPT" "username_format=%u" "/run/secrets/saklas_smtpd_passwd")))))
+                                                    (userdbs
+                                                     (list (userdb-configuration
+                                                            (driver "static")
+                                                            (args '("uid=vmail" "gid=vmail" "home=/var/vmail/%d/%n")))))
+                                                    (protocols
+                                                     (list (protocol-configuration (name "imap"))
+                                                           (protocol-configuration (name "lmtp"))))
+                                                    (services
+                                                     (list (service-configuration
+                                                            (kind "lmtp")
+                                                            (listeners
+                                                             (list (unix-listener-configuration
+                                                                    (path "lmtp")
+                                                                    (group "vmail")
+                                                                    (user "vmail"))))))))))
+                                    %base-services)
+                            (guix-service-type config =>
+                                               (guix-configuration
+                                                (inherit config)
+                                                (authorized-keys
+                                                 (append (list (local-file "../../demiurge.pub"))
+                                                         %default-authorized-guix-keys)))))))