commit fa2b2eddde202d142ae6d0c9e8e4b98f12d6d697 parent 86527a01cda8b077d09219787ac457bf4377e172 Author: Vineet Kumar <git@vineetk.net> Date: Fri, 26 Dec 2025 01:01:31 -0500 indent demiurge.scm Diffstat:
| M | epistemia/systems/demiurge.scm | | | 352 | ++++++++++++++++++++++++++++++++++++++++---------------------------------------- |
1 file changed, 176 insertions(+), 176 deletions(-)
diff --git a/epistemia/systems/demiurge.scm b/epistemia/systems/demiurge.scm @@ -24,109 +24,109 @@ #:use-module (epistemia packages zfs)) (operating-system - (inherit base-system) - (host-name "demiurge") + (inherit base-system) + (host-name "demiurge") - (kernel linux-6.17) - (kernel-arguments (list "net.ifnames=0")) - (kernel-loadable-modules (list (list zfs-linux "module"))) + (kernel linux-6.17) + (kernel-arguments (list "net.ifnames=0")) + (kernel-loadable-modules (list (list zfs-linux "module"))) - (initrd (lambda (file-systems . args) - (apply microcode-initrd file-systems - #:initrd epistemia-zfs-initrd - #:zfs-package zfs-linux - args))) - (firmware (cons* amdgpu-firmware %base-firmware)) + (initrd (lambda (file-systems . args) + (apply microcode-initrd file-systems + #:initrd epistemia-zfs-initrd + #:zfs-package zfs-linux + args))) + (firmware (cons* amdgpu-firmware %base-firmware)) - (bootloader (bootloader-configuration - (bootloader grub-zfs) - (targets '("/boot/efi")))) + (bootloader (bootloader-configuration + (bootloader grub-zfs) + (targets '("/boot/efi")))) - (file-systems (append - (list (file-system - (device "zroot/root") - (mount-point "/") - (type "zfs") - (check? #f) - (needed-for-boot? #t)) - (file-system - (device "zroot/gnu") - (mount-point "/gnu") - (type "zfs") - (check? #f) - (needed-for-boot? #t)) - (file-system - (device "zroot/var") - (mount-point "/var") - (type "zfs") - (check? #f) - (needed-for-boot? #t)) - (file-system - (device "zroot/home") - (mount-point "/home") - (type "zfs") - (check? #f) - (needed-for-boot? #t)) - (file-system - (device (uuid "F618-FA9F" 'fat)) - (mount-point "/boot/efi") - (type "vfat"))) - %base-file-systems)) + (file-systems (append + (list (file-system + (device "zroot/root") + (mount-point "/") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device "zroot/gnu") + (mount-point "/gnu") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device "zroot/var") + (mount-point "/var") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device "zroot/home") + (mount-point "/home") + (type "zfs") + (check? #f) + (needed-for-boot? #t)) + (file-system + (device (uuid "F618-FA9F" 'fat)) + (mount-point "/boot/efi") + (type "vfat"))) + %base-file-systems)) - (packages (append (list emacs-no-x - git - zfs-linux) - %base-packages)) + (packages (append (list emacs-no-x + git + zfs-linux) + %base-packages)) - (services (append (list (simple-service 'zfs-loader - kernel-module-loader-service-type - '("zfs")) - (simple-service 'zfs-shepherd-services - shepherd-root-service-type - zfs-shepherd-services) - (simple-service 'zfs-shepherd-services-user-processes - user-processes-service-type - '(zfs-automount)) - (service seatd-service-type) - (service iptables-service-type) - (service static-networking-service-type - (list (static-networking - (addresses - (list (network-address - (device "eth0") - (value "192.168.1.2/24")))) - (routes - (list (network-route - (destination "default") - (gateway "192.168.1.1"))))))) - (simple-service 'resolv-configuration - etc-service-type - `(("resolv.conf" - ,(plain-file "resolv.conf" - (string-append - "nameserver 127.0.0.1\n" - "search epistemia\n"))))) - (service openssh-service-type - (openssh-configuration - (extra-content "\ + (services (append (list (simple-service 'zfs-loader + kernel-module-loader-service-type + '("zfs")) + (simple-service 'zfs-shepherd-services + shepherd-root-service-type + zfs-shepherd-services) + (simple-service 'zfs-shepherd-services-user-processes + user-processes-service-type + '(zfs-automount)) + (service seatd-service-type) + (service iptables-service-type) + (service static-networking-service-type + (list (static-networking + (addresses + (list (network-address + (device "eth0") + (value "192.168.1.2/24")))) + (routes + (list (network-route + (destination "default") + (gateway "192.168.1.1"))))))) + (simple-service 'resolv-configuration + etc-service-type + `(("resolv.conf" + ,(plain-file "resolv.conf" + (string-append + "nameserver 127.0.0.1\n" + "search epistemia\n"))))) + (service openssh-service-type + (openssh-configuration + (extra-content "\ ListenAddress 127.0.0.1:22 ListenAddress 192.168.1.2:22 ListenAddress 10.0.13.2:22"))) - (service unbound-service-type - (unbound-configuration - (server - (unbound-server - (interface '("127.0.0.1" - "::1" - "10.0.13.2")) - (hide-version #t) - (hide-identity #t))) - (forward-zone - (list - (unbound-zone - (name ".") - (forward-addr '("192.168.1.1"))))) - (extra-content "\ + (service unbound-service-type + (unbound-configuration + (server + (unbound-server + (interface '("127.0.0.1" + "::1" + "10.0.13.2")) + (hide-version #t) + (hide-identity #t))) + (forward-zone + (list + (unbound-zone + (name ".") + (forward-addr '("192.168.1.1"))))) + (extra-content "\ server: access-control: 127.0.0.0/8 allow access-control: 10.0.13.0/24 allow @@ -156,89 +156,89 @@ rpz: name: \"hagezi.ultimate\" zonefile: \"hagezi.ultimate\" url: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt"))) - (service wireguard-service-type - (wireguard-configuration - (interface "wg0") - (addresses '("10.68.117.111/32" "fc00:bbbb:bbbb:bb01::5:756e/128")) - (port 51821) - (bootstrap-private-key? #f) - (private-key - #~(string-append "<(" - #$(file-append age "/bin/age -d -i /data/ssh/id_ed25519") - " /data/src/public/guixsd-config/epistemia/secrets/wg0_demiurge.age)")) - (pre-up '("ip route replace 45.134.142.206 via 192.168.1.1 dev eth0")) - (post-down '("ip route del 45.134.142.206 via 192.168.1.1 dev eth0")) - (peers - (list - (wireguard-peer - (name "mullvad-us-mia-wg-002") - (public-key "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=") - (allowed-ips '("0.0.0.0/0" "::0/0")) - (endpoint "45.134.142.206:51820")))))) - (service wireguard-service-type - (wireguard-configuration - (interface "wg1") - (addresses '("10.0.13.2/24" "fd00:b0ba:cafe:babe::2/64 ")) - (port 51820) - (bootstrap-private-key? #f) - (private-key - #~(string-append "<(" - #$(file-append age "/bin/age -d -i /data/ssh/id_ed25519") - " /data/src/public/guixsd-config/epistemia/secrets/wg1_demiurge.age)")) - (table #f) - (post-up - ;; IPv4 and IPv6 NAT - (list #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -I POSTROUTING 1 -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE") - #~(string-append #$(file-append iptables "/sbin/iptables") " -N WG1-FWD") + (service wireguard-service-type + (wireguard-configuration + (interface "wg0") + (addresses '("10.68.117.111/32" "fc00:bbbb:bbbb:bb01::5:756e/128")) + (port 51821) + (bootstrap-private-key? #f) + (private-key + #~(string-append "<(" + #$(file-append age "/bin/age -d -i /data/ssh/id_ed25519") + " /data/src/public/guixsd-config/epistemia/secrets/wg0_demiurge.age)")) + (pre-up '("ip route replace 45.134.142.206 via 192.168.1.1 dev eth0")) + (post-down '("ip route del 45.134.142.206 via 192.168.1.1 dev eth0")) + (peers + (list + (wireguard-peer + (name "mullvad-us-mia-wg-002") + (public-key "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=") + (allowed-ips '("0.0.0.0/0" "::0/0")) + (endpoint "45.134.142.206:51820")))))) + (service wireguard-service-type + (wireguard-configuration + (interface "wg1") + (addresses '("10.0.13.2/24" "fd00:b0ba:cafe:babe::2/64 ")) + (port 51820) + (bootstrap-private-key? #f) + (private-key + #~(string-append "<(" + #$(file-append age "/bin/age -d -i /data/ssh/id_ed25519") + " /data/src/public/guixsd-config/epistemia/secrets/wg1_demiurge.age)")) + (table #f) + (post-up + ;; IPv4 and IPv6 NAT + (list #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -I POSTROUTING 1 -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE") + #~(string-append #$(file-append iptables "/sbin/iptables") " -N WG1-FWD") - ;; IPv4 Forwarding Chain - #~(string-append #$(file-append iptables "/sbin/iptables") " -I FORWARD 1 -j WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT") - #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT") - #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT") + ;; IPv4 Forwarding Chain + #~(string-append #$(file-append iptables "/sbin/iptables") " -I FORWARD 1 -j WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT") + #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT") + #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT") - ;; IPv6 Forwarding Chain - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -N WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -I FORWARD 1 -j WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT"))) - (pre-down - ;; IPv4 and IPv6 NAT - (list #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -D POSTROUTING -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE") + ;; IPv6 Forwarding Chain + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -N WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -I FORWARD 1 -j WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT"))) + (pre-down + ;; IPv4 and IPv6 NAT + (list #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -D POSTROUTING -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE") - ;; IPv4 Forwarding Chain - #~(string-append #$(file-append iptables "/sbin/iptables") " -D FORWARD -j WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/iptables") " -F WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/iptables") " -X WG1-FWD") + ;; IPv4 Forwarding Chain + #~(string-append #$(file-append iptables "/sbin/iptables") " -D FORWARD -j WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/iptables") " -F WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/iptables") " -X WG1-FWD") - ;; IPv6 Forwarding Chain - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -D FORWARD -j WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -F WG1-FWD") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -X WG1-FWD"))) - (peers - (list - (wireguard-peer - (name "saklas.epistemia") - (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=") - (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128")) - (endpoint "157.180.125.215:51820") - (keep-alive 25)) - (wireguard-peer - (name "hastur.epistemia") - (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=") - (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128")) - (keep-alive 25)) - (wireguard-peer - (name "iphonebob.epistemia") - (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=") - (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128")) - (keep-alive 25)) - (wireguard-peer - (name "lab.epistemia") - (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=") - (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128")) - (keep-alive 25))))))) - %base-services))) + ;; IPv6 Forwarding Chain + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -D FORWARD -j WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -F WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -X WG1-FWD"))) + (peers + (list + (wireguard-peer + (name "saklas.epistemia") + (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=") + (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128")) + (endpoint "157.180.125.215:51820") + (keep-alive 25)) + (wireguard-peer + (name "hastur.epistemia") + (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=") + (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128")) + (keep-alive 25)) + (wireguard-peer + (name "iphonebob.epistemia") + (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=") + (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128")) + (keep-alive 25)) + (wireguard-peer + (name "lab.epistemia") + (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=") + (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128")) + (keep-alive 25))))))) + %base-services)))