commit ed28410f93c86f809e639c6090b36f415d85c67e parent 748b880ec1dc54028f017769539171b3e8bbc4ec Author: Vineet Kumar <git@vineetk.net> Date: Thu, 2 Apr 2026 12:10:57 -0400 hastur: add initial config based on demiurge Diffstat:
| A | epistemia/systems/hastur.scm | | | 228 | +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ |
1 file changed, 228 insertions(+), 0 deletions(-)
diff --git a/epistemia/systems/hastur.scm b/epistemia/systems/hastur.scm @@ -0,0 +1,228 @@ +(define-module (epistemia systems hastur) + #:use-module (gnu) + #:use-module (gnu packages bash) + #:use-module (gnu packages emacs) + #:use-module (gnu packages golang-crypto) + #:use-module (gnu packages linux) + #:use-module (gnu packages version-control) + #:use-module (gnu packages vpn) + #:use-module (gnu services dbus) ; temp + #:use-module (gnu services desktop) + #:use-module (gnu services dns) + #:use-module (gnu services containers) ; temp + #:use-module (gnu services linux) + #:use-module (gnu services networking) + #:use-module (gnu services shepherd) + #:use-module (gnu services sound) + #:use-module (gnu services ssh) + #:use-module (gnu services sysctl) + #:use-module (gnu services vpn) + #:use-module (gnu services web) + #:use-module (gnu system accounts) + #:use-module (guix) + #:use-module (guix gexp) + #:use-module (guix transformations) + #:use-module (guix utils) + #:use-module (nongnu packages linux) + #:use-module (nongnu system linux-initrd) + #:use-module (epistemia bootloader) + #:use-module (epistemia systems base-system) + #:use-module (epistemia systems linux-initrd) + #:use-module (epistemia services age-secret) + #:use-module (epistemia services zfs) + #:use-module (epistemia packages zfs)) + +(operating-system + (inherit base-system) + (host-name "hastur.epistemia") + + (users (cons (user-account + (name "vin") + (comment "Vineet") + (shell (file-append bash "/bin/bash")) + (group "users") + (supplementary-groups '("wheel" "audio" "video" "input" "seat" "tty" "cgroup"))) ;; TODO remove docker + %base-user-accounts)) + + (kernel linux-6.18) + (kernel-arguments (list "net.ifnames=0" "modprobe.blacklist=snd_hda_intel")) + (kernel-loadable-modules (list (list zfs-linux "module"))) + + (initrd (lambda (file-systems . args) + (apply microcode-initrd file-systems + #:initrd epistemia-zfs-initrd + #:zfs-package zfs-linux + args))) + (firmware (cons* amdgpu-firmware %base-firmware)) + + (bootloader (bootloader-configuration + (bootloader grub-zfs) + (targets '("/boot/efi")))) + + (file-systems (append + (list (file-system + (device "zroot/root") + (mount-point "/") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device "zroot/gnu") + (mount-point "/gnu") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device "zroot/var") + (mount-point "/var") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device "zroot/home") + (mount-point "/home") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device (uuid "F618-FA9F" 'fat)) + (mount-point "/boot/efi") + (type "vfat"))) + %base-file-systems)) + + (packages (append (list emacs-no-x + git + zfs-linux) + %base-packages)) + + (services (append (list (service age-secret-service-type + (age-secret-configuration + (secrets (list + (age-secret + (name "wg0_hastur") + (file (local-file "../secrets/wg0_hastur.age"))) + (age-secret + (name "wg1_hastur") + (file (local-file "../secrets/wg1_hastur.age"))))))) + (simple-service 'zfs-loader + kernel-module-loader-service-type + '("zfs")) + (simple-service 'zfs-shepherd-services + shepherd-root-service-type + zfs-shepherd-services) + (simple-service 'zfs-shepherd-services-user-processes + user-processes-service-type + '(zfs-automount)) + (service seatd-service-type) + (service iptables-service-type) + (service static-networking-service-type + (list (static-networking + (addresses + (list (network-address + (device "eth0") + (value "192.168.1.2/24")))) + (routes + (list (network-route + (destination "default") + (gateway "192.168.1.1"))))))) + (simple-service 'resolv-configuration + etc-service-type + `(("resolv.conf" + ,(plain-file "epistemia_resolv.conf" + (string-append + "nameserver 10.0.13.2\n" + "search epistemia\n"))))) + (service openssh-service-type + (openssh-configuration + (permit-root-login #f) + (authorized-keys + `(("vin" ,(local-file "/data/ssh/id_ed25519.pub")) + ("root" ,(local-file "/data/ssh/id_ed25519.pub")))) + (extra-content "\ + ListenAddress 127.0.0.1:22 + ListenAddress 192.168.1.2:22 + ListenAddress 10.0.13.3:22"))) + (service wireguard-service-type + (wireguard-configuration + (interface "wg0") + (addresses '("10.68.117.111/32" "fc00:bbbb:bbbb:bb01::5:756e/128")) + (port 51821) + (bootstrap-private-key? #f) + (private-key "/run/secrets/wg0_hastur") + (pre-up '("while [ ! -f /run/secrets/wg0_hastur ]; do sleep 1; done" + "ip route replace 79.127.222.207 via 192.168.1.1 dev eth0")) + (post-up + (list "ip rule add fwmark 0x1 table 100 priority 100" + "ip rule add fwmark 51820 table 100 priority 100" + "ip route add default via 192.168.1.1 dev eth0 table 100" + #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1") + #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -j CONNMARK --restore-mark") + #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark"))) + (post-down + (list "ip route del 79.127.222.207 via 192.168.1.1 dev eth0" + "ip rule del fwmark 0x1 table 100" + "ip rule del fwmark 51820 table 100" + "ip route flush table 100" + #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1") + #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D PREROUTING -i eth0 -j CONNMARK --restore-mark") + #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark"))) + (peers + (list + (wireguard-peer + (name "mullvad-fi-hel-wg-003") + (public-key "FKodo9V6BehkNphL+neI0g4/G/cjbZyYhoptSWf3Si4=") + (allowed-ips '("0.0.0.0/0" "::0/0")) + (endpoint "185.204.1.219:51820")))))) + (service wireguard-service-type + (wireguard-configuration + (interface "wg1") + (addresses '("10.0.13.3/24" "fd00:b0ba:cafe:babe::3/64 ")) + (port 51820) + (bootstrap-private-key? #f) + (private-key "/run/secrets/wg1_hastur") + (table #f) + (shepherd-requirement '(age-secret)) + (pre-up '("while [ ! -f /run/secrets/wg1_hastur ]; do sleep 1; done")) + (peers + (list + (wireguard-peer + (name "saklas.epistemia") + (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=") + (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128")) + (endpoint "162.55.242.220:51820") + (keep-alive 25)) + (wireguard-peer + (name "demiurge.epistemia") + (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=") + (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128")) + (keep-alive 25)) + (wireguard-peer + (name "iphonebob.epistemia") + (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=") + (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128")) + (keep-alive 25)) + (wireguard-peer + (name "lab.epistemia") + (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=") + (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128")) + (keep-alive 25)))))) + (simple-service 'wireguard-route-timer + shepherd-root-service-type + (list (shepherd-timer + '(wg1-route-updater) + "* * * * *" + #~("/data_hdd/wireguard-endpoint-route") + #:requirement '(wireguard-wg1) + #:documentation "Update Wireguard routes every minute."))) + (service pam-limits-service-type + (list (pam-limits-entry "@audio" 'both 'rtprio 99) + (pam-limits-entry "@audio" 'both 'memlock 'unlimited))) + ;; netx three temporary + (service dbus-root-service-type) + (service rootless-podman-service-type + (rootless-podman-configuration + (subgids + (list (subid-range (name "vin")))) + (subuids + (list (subid-range (name "vin"))))))) + %base-services)))