commit a73ccfe31b3aa89ba01ad0738955a2cc575353be
parent 35f0a4330f9e264bc1fdb947011fad16a8ba49ec
Author: Vineet Kumar <git@vineetk.net>
Date: Wed, 13 May 2026 21:09:13 -0400
saklas: reindent
Diffstat:
1 file changed, 174 insertions(+), 174 deletions(-)
diff --git a/epistemia/systems/saklas.scm b/epistemia/systems/saklas.scm
@@ -189,184 +189,184 @@ table inet filter {
(operating-system
- (inherit base-system)
- (host-name "saklas.epistemia")
+ (inherit base-system)
+ (host-name "saklas.epistemia")
- (users (cons* (user-account
- (name "vin")
- (comment "Vineet")
- (shell (file-append bash "/bin/bash"))
- (group "users")
- (supplementary-groups '("wheel" "git" "torrents")))
- (user-account
- (name "git")
- (comment "git account")
- (group "git")
- (shell (file-append git "/bin/git-shell"))
- (home-directory "/data/src/bare")
- (system? #t))
- (user-account
- (name "torrents")
- (comment "torrenting account")
- (group "torrents")
- (shell "/dev/null")
- (home-directory "/var/empty")
- (system? #t))
- (user-account
- (name "vmail")
- (comment "virtual mail account")
- (group "vmail")
- (shell "/dev/null")
- (home-directory "/var/vmail")
- (system? #t))
- %base-user-accounts))
- (groups (cons* (user-group
- (name "git"))
- (user-group
- (name "torrents"))
- (user-group
- (name "vmail"))
- %base-groups))
+ (users (cons* (user-account
+ (name "vin")
+ (comment "Vineet")
+ (shell (file-append bash "/bin/bash"))
+ (group "users")
+ (supplementary-groups '("wheel" "git" "torrents")))
+ (user-account
+ (name "git")
+ (comment "git account")
+ (group "git")
+ (shell (file-append git "/bin/git-shell"))
+ (home-directory "/data/src/bare")
+ (system? #t))
+ (user-account
+ (name "torrents")
+ (comment "torrenting account")
+ (group "torrents")
+ (shell "/dev/null")
+ (home-directory "/var/empty")
+ (system? #t))
+ (user-account
+ (name "vmail")
+ (comment "virtual mail account")
+ (group "vmail")
+ (shell "/dev/null")
+ (home-directory "/var/vmail")
+ (system? #t))
+ %base-user-accounts))
+ (groups (cons* (user-group
+ (name "git"))
+ (user-group
+ (name "torrents"))
+ (user-group
+ (name "vmail"))
+ %base-groups))
- (kernel linux-6.18)
- (kernel-arguments (list "net.ifnames=0"))
- (kernel-loadable-modules (list (list zfs-linux "module")))
+ (kernel linux-6.18)
+ (kernel-arguments (list "net.ifnames=0"))
+ (kernel-loadable-modules (list (list zfs-linux "module")))
- (initrd (lambda (file-systems . args)
- (apply microcode-initrd file-systems
- #:initrd epistemia-zfs-initrd
- #:zfs-package zfs-linux
- args)))
- (firmware (cons* amdgpu-firmware %base-firmware))
+ (initrd (lambda (file-systems . args)
+ (apply microcode-initrd file-systems
+ #:initrd epistemia-zfs-initrd
+ #:zfs-package zfs-linux
+ args)))
+ (firmware (cons* amdgpu-firmware %base-firmware))
- (bootloader (bootloader-configuration
- (bootloader grub-zfs-bios)
- (targets '("/dev/sda"))))
+ (bootloader (bootloader-configuration
+ (bootloader grub-zfs-bios)
+ (targets '("/dev/sda"))))
- (file-systems (append
- (list (file-system
- (device "zroot/root")
- (mount-point "/")
- (type "zfs")
- (check? #f)
- (needed-for-boot? #t))
- (file-system
- (device "zroot/gnu")
- (mount-point "/gnu")
- (type "zfs")
- (check? #f)
- (needed-for-boot? #t))
- (file-system
- (device "zroot/var")
- (mount-point "/var")
- (type "zfs")
- (check? #f)
- (needed-for-boot? #t))
- (file-system
- (device "zroot/home")
- (mount-point "/home")
- (type "zfs")
- (check? #f)
- (needed-for-boot? #t)))
- %base-file-systems))
+ (file-systems (append
+ (list (file-system
+ (device "zroot/root")
+ (mount-point "/")
+ (type "zfs")
+ (check? #f)
+ (needed-for-boot? #t))
+ (file-system
+ (device "zroot/gnu")
+ (mount-point "/gnu")
+ (type "zfs")
+ (check? #f)
+ (needed-for-boot? #t))
+ (file-system
+ (device "zroot/var")
+ (mount-point "/var")
+ (type "zfs")
+ (check? #f)
+ (needed-for-boot? #t))
+ (file-system
+ (device "zroot/home")
+ (mount-point "/home")
+ (type "zfs")
+ (check? #f)
+ (needed-for-boot? #t)))
+ %base-file-systems))
- (packages (append (list emacs-no-x
- git
- rsync
- zfs-linux)
- %base-packages))
+ (packages (append (list emacs-no-x
+ git
+ rsync
+ zfs-linux)
+ %base-packages))
- (services (modify-services (append (list (service age-secret-service-type
- (age-secret-configuration
- (secrets (list
- (age-secret
- (name "wg1_saklas")
- (file (local-file "../secrets/wg1_saklas.age")))
- (age-secret
- (name "saklas_smtpd_dkim")
- (file (local-file "../secrets/saklas_smtpd_dkim.age"))
- (owner "smtpd")
- (group "nogroup")
- (mode #o400))
- (age-secret
- (name "saklas_smtpd_virtuals")
- (file (local-file "../secrets/saklas_smtpd_virtuals.age"))
- (owner "smtpd")
- (group "nogroup")
- (mode #o400))
- (age-secret
- (name "saklas_smtpd_passwd")
- (file (local-file "../secrets/saklas_smtpd_passwd.age"))
- (owner "smtpd")
- (group "dovecot")
- (mode #o440))))))
- (simple-service 'zfs-loader
- kernel-module-loader-service-type
- '("zfs"))
- (simple-service 'zfs-shepherd-services
- shepherd-root-service-type
- zfs-shepherd-services)
- (simple-service 'zfs-shepherd-services-user-processes
- user-processes-service-type
- '(zfs-automount))
- (service nftables-service-type
- (nftables-configuration
- (ruleset %nftables-ruleset)))
- (service static-networking-service-type
- (list (static-networking
- (addresses
- (list (network-address
- (device "eth0")
- (value "141.95.52.111/24"))
- (network-address
- (device "eth0")
- (value "2001:41d0:701:1100::898c/128"))))
- (routes
- (list (network-route
- (destination "default")
- (gateway "141.95.52.1"))
- (network-route
- (destination "2001:41d0:701:1100::1")
- (device "eth0"))
- (network-route
- (destination "default")
- (device "eth0")
- (gateway "2001:41d0:701:1100::1")))))))
- (simple-service 'resolv-configuration
- etc-service-type
- `(("resolv.conf"
- ,(plain-file "resolv.conf"
- (string-append
- ;"nameserver 127.0.0.1\n"
- "nameserver 9.9.9.9\n"
- "search epistemia\n")))))
- (service (fail2ban-jail-service
- openssh-service-type
- (fail2ban-jail-configuration
- (name "sshd")
- (enabled? #t)))
- (openssh-configuration
- (permit-root-login 'prohibit-password)
- (password-authentication? #f)
- (authorized-keys
- `(("vin" ,(local-file "/data/ssh/id_ed25519.pub"))
- ("git" ,(local-file "/data/ssh/id_ed25519.pub"))
- ("root" ,(local-file "/data/ssh/id_ed25519.pub"))))
- (extra-content "\
+ (services (modify-services (append (list (service age-secret-service-type
+ (age-secret-configuration
+ (secrets (list
+ (age-secret
+ (name "wg1_saklas")
+ (file (local-file "../secrets/wg1_saklas.age")))
+ (age-secret
+ (name "saklas_smtpd_dkim")
+ (file (local-file "../secrets/saklas_smtpd_dkim.age"))
+ (owner "smtpd")
+ (group "nogroup")
+ (mode #o400))
+ (age-secret
+ (name "saklas_smtpd_virtuals")
+ (file (local-file "../secrets/saklas_smtpd_virtuals.age"))
+ (owner "smtpd")
+ (group "nogroup")
+ (mode #o400))
+ (age-secret
+ (name "saklas_smtpd_passwd")
+ (file (local-file "../secrets/saklas_smtpd_passwd.age"))
+ (owner "smtpd")
+ (group "dovecot")
+ (mode #o440))))))
+ (simple-service 'zfs-loader
+ kernel-module-loader-service-type
+ '("zfs"))
+ (simple-service 'zfs-shepherd-services
+ shepherd-root-service-type
+ zfs-shepherd-services)
+ (simple-service 'zfs-shepherd-services-user-processes
+ user-processes-service-type
+ '(zfs-automount))
+ (service nftables-service-type
+ (nftables-configuration
+ (ruleset %nftables-ruleset)))
+ (service static-networking-service-type
+ (list (static-networking
+ (addresses
+ (list (network-address
+ (device "eth0")
+ (value "141.95.52.111/24"))
+ (network-address
+ (device "eth0")
+ (value "2001:41d0:701:1100::898c/128"))))
+ (routes
+ (list (network-route
+ (destination "default")
+ (gateway "141.95.52.1"))
+ (network-route
+ (destination "2001:41d0:701:1100::1")
+ (device "eth0"))
+ (network-route
+ (destination "default")
+ (device "eth0")
+ (gateway "2001:41d0:701:1100::1")))))))
+ (simple-service 'resolv-configuration
+ etc-service-type
+ `(("resolv.conf"
+ ,(plain-file "resolv.conf"
+ (string-append
+ ;"nameserver 127.0.0.1\n"
+ "nameserver 9.9.9.9\n"
+ "search epistemia\n")))))
+ (service (fail2ban-jail-service
+ openssh-service-type
+ (fail2ban-jail-configuration
+ (name "sshd")
+ (enabled? #t)))
+ (openssh-configuration
+ (permit-root-login 'prohibit-password)
+ (password-authentication? #f)
+ (authorized-keys
+ `(("vin" ,(local-file "/data/ssh/id_ed25519.pub"))
+ ("git" ,(local-file "/data/ssh/id_ed25519.pub"))
+ ("root" ,(local-file "/data/ssh/id_ed25519.pub"))))
+ (extra-content "\
ListenAddress 127.0.0.1:22
ListenAddress 141.95.52.111:22
#ListenAddress 10.0.13.1:22
")))
- (service unbound-service-type
- (unbound-configuration
- (server
- (unbound-server
- (interface '("127.0.0.1"
- "::1"
- "10.0.13.1"))
- (hide-version #t)
- (hide-identity #t)))
- (extra-content "\
+ (service unbound-service-type
+ (unbound-configuration
+ (server
+ (unbound-server
+ (interface '("127.0.0.1"
+ "::1"
+ "10.0.13.1"))
+ (hide-version #t)
+ (hide-identity #t)))
+ (extra-content "\
server:
access-control: 127.0.0.0/8 allow
access-control: 10.0.13.0/24 allow
@@ -396,10 +396,10 @@ rpz:
name: \"hagezi.ultimate\"
zonefile: \"hagezi.ultimate\"
url: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt"))))
- %base-services)
- (guix-service-type config =>
- (guix-configuration
- (inherit config)
- (authorized-keys
- (append (list (local-file "../../demiurge.pub"))
- %default-authorized-guix-keys)))))))
+ %base-services)
+ (guix-service-type config =>
+ (guix-configuration
+ (inherit config)
+ (authorized-keys
+ (append (list (local-file "../../demiurge.pub"))
+ %default-authorized-guix-keys)))))))
