commit fed5ce67f4e9dab2250aa322096a183bd186762f
parent f51db9da12b9f1ce486118b9d7c2129c9223a6ea
Author: Vineet Kumar <git@vineetk.net>
Date: Sat, 9 May 2026 10:23:15 -0400
saklas vps: temporarily remove non-essential services
for installation. the config needs to be synced with the dedi's config
after installation anyways.
Diffstat:
1 file changed, 1 insertion(+), 215 deletions(-)
diff --git a/epistemia/systems/saklas.scm b/epistemia/systems/saklas.scm
@@ -393,221 +393,7 @@ server:
rpz:
name: \"hagezi.ultimate\"
zonefile: \"hagezi.ultimate\"
- url: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt")))
- (simple-service 'rtorrent
- shepherd-root-service-type
- (list
- (shepherd-service
- (provision '(rtorrent))
- (requirement '(user-processes loopback syslogd))
- (start #~(make-forkexec-constructor
- (list #$(file-append rtorrent-xmlrpc "/bin/rtorrent")
- "-n"
- "-b" "157.180.125.215"
- "-p" "51413-51413"
- "-d" "/data/torrents/complete/other"
- "-s" "/data/torrents/rtorrent"
- "-o" (string-append "system.umask.set=0002,"
- "dht.mode.set=disable,"
- "protocol.pex.set=no,"
- "network.scgi.open_port=10.0.13.1:5000,"
- "system.daemon.set=true"))
- #:user "torrents" #:group "torrents"))
- (stop #~(make-kill-destructor))
- (documentation "Run rtorrent in headless mode (only xmlrpc)."))))
- (service wireguard-service-type
- (wireguard-configuration
- (interface "wg1")
- (addresses '("10.0.13.1/24" "fd00:b0ba:cafe:babe::1/64 "))
- (port 51820)
- (bootstrap-private-key? #f)
- (private-key "/run/secrets/wg1_saklas")
- (peers
- (list
- (wireguard-peer
- (name "demiurge.epistemia")
- (public-key "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=")
- (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128"))
- (keep-alive 25))
- (wireguard-peer
- (name "hastur.epistemia")
- (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=")
- (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128"))
- (keep-alive 25))
- (wireguard-peer
- (name "iphonebob.epistemia")
- (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=")
- (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128"))
- (keep-alive 25))
- (wireguard-peer
- (name "lab.epistemia")
- (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=")
- (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128"))
- (keep-alive 25))))))
- (service certbot-service-type
- (certbot-configuration
- (email "postmaster@vineetk.net")
- (certificates
- (list
- (certificate-configuration
- (deploy-hook (program-file
- "import-prosody-certs"
- #~(begin
- (let ((prosodyctl (string-append #$prosody "/bin/prosodyctl")))
- (system* prosodyctl "--root" "cert" "import" "/etc/certs")))))
- (domains '("vineetk.net"
- "git.vineetk.net"
- "mail.vineetk.net"
- "u.vineetk.net"
- "xmpp.vineetk.net"
- )))
- (certificate-configuration
- (domains '("13f0.net"
- "m.13f0.net"
- ;"snac.13f0.net"
- )))
- (certificate-configuration
- (domains '("vinbiz.ca")))))))
- (service nginx-service-type
- (nginx-configuration
- (server-blocks
- (list (nginx-server-configuration
- (server-name '("vineetk.net"))
- (listen '("443 ssl"))
- (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem")
- (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem")
- (root "/var/www/site_vineetk")
- (raw-content (list "include " %nginx-badboi ";")))
- (nginx-server-configuration
- (server-name '("13f0.net"))
- (listen '("443 ssl"))
- (ssl-certificate "/etc/certs/13f0.net/fullchain.pem")
- (ssl-certificate-key "/etc/certs/13f0.net/privkey.pem")
- (root "/var/www/site_13f0")
- (raw-content (list "include " %nginx-badboi ";")))
- (nginx-server-configuration
- (server-name '("vinbiz.ca"))
- (listen '("443 ssl"))
- (ssl-certificate "/etc/certs/vinbiz.ca/fullchain.pem")
- (ssl-certificate-key "/etc/certs/vinbiz.ca/privkey.pem")
- (root "/var/www/site_vinbiz")
- (raw-content (list "include " %nginx-badboi ";")))))))
- ;; git folder needs to be readable by nginx/cgit, gets reset to 700 on reconfigure otherwise
- (simple-service 'git-home-permissions
- activation-service-type
- #~(when (file-exists? "/data/src/bare")
- (chmod "/data/src/bare" #o755)))
- (service cgit-service-type
- (cgit-configuration
- (enable-index-links? #t)
- (enable-log-filecount? #t)
- (enable-log-linecount? #t)
- (enable-git-config? #t)
- (remove-suffix? #t)
- (root-desc "")
- (root-title "Vineet's git repos")
- (repository-directory "/data/src/bare")
- (section-from-path 1)
- (side-by-side-diffs? #t)
- (nginx
- (list
- (nginx-server-configuration
- (server-name '("git.vineetk.net"))
- (listen '("443 ssl"))
- (root cgit)
- (try-files (list "$uri" "@cgit"))
- (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem")
- (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem")
- (raw-content (list "include" %nginx-badboi ";"))
- (locations
- (list
- (nginx-location-configuration
- (uri "@cgit")
- (body '("fastcgi_param SCRIPT_FILENAME $document_root/lib/cgit/cgit.cgi;"
- "fastcgi_param PATH_INFO $uri;"
- "fastcgi_param QUERY_STRING $args;"
- "fastcgi_param HTTP_HOST $server_name;"
- "fastcgi_pass 127.0.0.1:9000;"))))))))))
- (service prosody-service-type
- (prosody-configuration
- (admins '("vin@vineetk.net"))
- (allow-registration? #f)
- (c2s-require-encryption? #t)
- (s2s-require-encryption? #t)
- (s2s-secure-auth? #t)
- (authentication "internal_hashed")
- (plugin-paths (list prosody-cloud-notify))
- (modules-enabled
- ;; list from https://github.com/monal-im/Monal/wiki/Considerations-for-XMPP-server-admins#prosody
- (cons* "sasl_ssdp"
- ;; TODO update prosody to 13
- ;; "sasl2"
- ;; "sasl2_bind2"
- ;; "sasl2_sm"
- ;; "sasl2_fast"
- "muc_notifications"
- "smacks"
- "mam"
- "csi_simple"
- "cloud_notify"
- "bookmarks"
- %default-modules-enabled))
- ;; I don't want my syslog flooded. can't control changes either in service yet
- (log "/var/lib/prosody/prosody.log")
- (virtualhosts
- (list
- (virtualhost-configuration
- (domain "vineetk.net"))))))
- (service opensmtpd-service-type
- (opensmtpd-configuration
- (config-file %opensmtpd-config)))
- (service dovecot-service-type
- (dovecot-configuration
- (listen '("*" "::"))
- (mail-location "maildir:/var/vmail/%d/%n")
- (mail-uid "vmail")
- (mail-gid "vmail")
- (ssl? "required")
- (ssl-cert "</etc/certs/vineetk.net/fullchain.pem")
- (ssl-key "</etc/certs/vineetk.net/privkey.pem")
- (namespaces
- (list (namespace-configuration
- (name "inbox")
- (inbox? #t)
- (location "")
- (prefix "")
- (mailboxes
- (list (mailbox-configuration
- (name "Drafts")
- (special-use '("\\Drafts")))
- (mailbox-configuration
- (name "Junk")
- (special-use '("\\Junk")))
- (mailbox-configuration
- (name "Sent")
- (special-use '("\\Sent")))
- (mailbox-configuration
- (name "Trash")
- (special-use '("\\Trash"))))))))
- (passdbs
- (list (passdb-configuration
- (driver "passwd-file")
- (args '("scheme=CRYPT" "username_format=%u" "/run/secrets/saklas_smtpd_passwd")))))
- (userdbs
- (list (userdb-configuration
- (driver "static")
- (args '("uid=vmail" "gid=vmail" "home=/var/vmail/%d/%n")))))
- (protocols
- (list (protocol-configuration (name "imap"))
- (protocol-configuration (name "lmtp"))))
- (services
- (list (service-configuration
- (kind "lmtp")
- (listeners
- (list (unix-listener-configuration
- (path "lmtp")
- (group "vmail")
- (user "vmail"))))))))))
+ url: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt"))))
%base-services)
(guix-service-type config =>
(guix-configuration
