hastur.scm (9306B)
1 (define-module (epistemia systems hastur) 2 #:use-module (gnu) 3 #:use-module (gnu packages admin) 4 #:use-module (gnu packages bash) 5 #:use-module (gnu packages emacs) 6 #:use-module (gnu packages golang-crypto) 7 #:use-module (gnu packages linux) 8 #:use-module (gnu packages version-control) 9 #:use-module (gnu packages vpn) 10 #:use-module (gnu services desktop) 11 #:use-module (gnu services dns) 12 #:use-module (gnu services linux) 13 #:use-module (gnu services pm) 14 #:use-module (gnu services networking) 15 #:use-module (gnu services shepherd) 16 #:use-module (gnu services sound) 17 #:use-module (gnu services ssh) 18 #:use-module (gnu services sysctl) 19 #:use-module (gnu services vpn) 20 #:use-module (gnu services web) 21 #:use-module (gnu system accounts) 22 #:use-module (guix) 23 #:use-module (guix gexp) 24 #:use-module (guix transformations) 25 #:use-module (guix utils) 26 #:use-module (nongnu packages linux) 27 #:use-module (nongnu system linux-initrd) 28 #:use-module (epistemia bootloader) 29 #:use-module (epistemia systems base-system) 30 #:use-module (epistemia systems linux-initrd) 31 #:use-module (epistemia services age-secret) 32 #:use-module (epistemia services zfs) 33 #:use-module (epistemia packages zfs)) 34 35 (operating-system 36 (inherit base-system) 37 (host-name "hastur.epistemia") 38 39 (users (cons (user-account 40 (name "vin") 41 (comment "Vineet") 42 (shell (file-append bash "/bin/bash")) 43 (group "users") 44 (supplementary-groups '("wheel" "audio" "video" "input" "seat" "tty" "kvm"))) 45 %base-user-accounts)) 46 47 (kernel linux-6.18) 48 (kernel-arguments (list "net.ifnames=0" "modprobe.blacklist=snd_hda_intel")) 49 (kernel-loadable-modules (list (list zfs-linux "module"))) 50 51 (initrd (lambda (file-systems . args) 52 (apply microcode-initrd file-systems 53 #:initrd epistemia-zfs-initrd 54 #:zfs-package zfs-linux 55 args))) 56 (firmware (cons* i915-firmware iwlwifi-firmware %base-firmware)) 57 58 (bootloader (bootloader-configuration 59 (bootloader grub-zfs) 60 (targets '("/boot/efi")))) 61 62 (file-systems (append 63 (list (file-system 64 (device "zroot/root") 65 (mount-point "/") 66 (type "zfs") 67 (check? #f) 68 (needed-for-boot? #t)) 69 (file-system 70 (device "zroot/gnu") 71 (mount-point "/gnu") 72 (type "zfs") 73 (check? #f) 74 (needed-for-boot? #t)) 75 (file-system 76 (device "zroot/var") 77 (mount-point "/var") 78 (type "zfs") 79 (check? #f) 80 (needed-for-boot? #t)) 81 (file-system 82 (device "zroot/home") 83 (mount-point "/home") 84 (type "zfs") 85 (check? #f) 86 (needed-for-boot? #t)) 87 (file-system 88 (device (uuid "85DD-DE6D" 'fat)) 89 (mount-point "/boot/efi") 90 (type "vfat")) 91 (file-system 92 (device "none") 93 (mount-point "/home/vin/.local/state/runtime") 94 (type "tmpfs") 95 (options "uid=1000"))) 96 %base-file-systems)) 97 98 (swap-devices (list (swap-space (target (uuid "a9f91237-58fe-452a-b4af-cbd281f5b8ce"))))) 99 100 (packages (append (list emacs-no-x 101 git 102 zfs-linux) 103 %base-packages)) 104 105 (services (modify-services (append (list (service age-secret-service-type 106 (age-secret-configuration 107 (secrets (list 108 (age-secret 109 (name "wpa_supplicant") 110 (file (local-file "../secrets/wpa_supplicant.age"))) 111 (age-secret 112 (name "wg0_hastur") 113 (file (local-file "../secrets/wg0_hastur.age"))) 114 (age-secret 115 (name "wg1_hastur") 116 (file (local-file "../secrets/wg1_hastur.age"))) 117 (age-secret 118 (name "wg2_hastur") 119 (file (local-file "../secrets/wg2_hastur.age"))))))) 120 (simple-service 'zfs-loader 121 kernel-module-loader-service-type 122 '("zfs")) 123 (simple-service 'zfs-shepherd-services 124 shepherd-root-service-type 125 zfs-shepherd-services) 126 (simple-service 'zfs-shepherd-services-user-processes 127 user-processes-service-type 128 '(zfs-automount)) 129 (service seatd-service-type) 130 (service iptables-service-type) 131 (service unbound-service-type 132 (unbound-configuration 133 (server 134 (unbound-server 135 (interface '("::1")) 136 (hide-version #t) 137 (hide-identity #t) 138 (extra-options '((ip-freebind . yes) 139 (aggressive-nsec . no))))) 140 (forward-zone 141 (list 142 (unbound-zone 143 (name ".") 144 (forward-addr '("10.0.13.1"))) 145 (unbound-zone 146 (name "carcosa.13f0.net.") 147 (forward-addr '("9.9.9.9"))))))) 148 (service dhcpcd-service-type 149 (dhcpcd-configuration 150 (option '("rapid_commit" "interface_mtu")) 151 (no-option '("nd_rdnss" 152 "dhcp6_name_servers" 153 "domain_name_servers" 154 "domain_name" 155 "domain_search")) 156 (static '("domain_name_servers=::1" 157 "domain_search=epistemia")) 158 (no-hook '("hostname")))) 159 (service wpa-supplicant-service-type 160 (wpa-supplicant-configuration 161 (shepherd-requirement '(age-secret kernel-module-loader)) 162 (wpa-supplicant wpa-supplicant-minimal) 163 (dbus? #f) 164 (interface "wlan0") 165 (config-file "/run/secrets/wpa_supplicant"))) 166 (service bluetooth-service-type) 167 (service openssh-service-type 168 (openssh-configuration 169 (permit-root-login #f) 170 (authorized-keys 171 `(("vin" ,(local-file "/data/ssh/id_ed25519.pub")) 172 ("root" ,(local-file "/data/ssh/id_ed25519.pub")))))) 173 (service wireguard-service-type 174 (wireguard-configuration 175 (interface "wg0") 176 (addresses '("172.27.194.145/32" "fd00:0000:1337:cafe:1111:1111:9893:6822/128")) 177 (port 51821) 178 (bootstrap-private-key? #f) 179 (shepherd-requirement '(age-secret wpa-supplicant)) 180 (private-key "/run/secrets/wg0_hastur") 181 (pre-up '("while [ ! -f /run/secrets/wg0_hastur ]; do sleep 1; done" 182 "while [ -z \"$(ip route show default)\" ]; do sleep 1; done" 183 "ip route add 185.157.162.7 via $(ip route show default | cut -d' ' -f3) dev wlan0")) 184 (post-down '("ip route del 185.157.162.7")) 185 (peers 186 (list 187 (wireguard-peer 188 (name "ovpn-ams-29") 189 (public-key "wTlz3u1egzUrx4Ho02cL7Ht1BBa/C8bULzXStn5f+zk=") 190 (allowed-ips '("0.0.0.0/0" "::0/0")) 191 (endpoint "185.157.162.7:9929")))))) 192 (service wireguard-service-type 193 (wireguard-configuration 194 (interface "wg1") 195 (addresses '("10.0.13.3/24" "fd00:b0ba:cafe:babe::3/64")) 196 (port 51820) 197 (bootstrap-private-key? #f) 198 (private-key "/run/secrets/wg1_hastur") 199 (table #f) 200 (shepherd-requirement '(age-secret unbound wpa-supplicant)) 201 (pre-up '("while [ ! -f /run/secrets/wg1_hastur ]; do sleep 1; done" 202 "while [ -z \"$(ip route show default)\" ]; do sleep 1; done")) 203 (peers 204 (list 205 (wireguard-peer 206 (name "saklas.epistemia") 207 (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=") 208 (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128")) 209 (endpoint "141.95.52.111:51820") 210 (keep-alive 25)) 211 (wireguard-peer 212 (name "demiurge.epistemia") 213 (public-key "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=") 214 (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128")) 215 (endpoint "carcosa.13f0.net:51820") 216 (keep-alive 25)))))) 217 (service wireguard-service-type 218 (wireguard-configuration 219 (interface "wg2") 220 (addresses '("10.0.14.2/24")) 221 (port 51822) 222 (bootstrap-private-key? #f) 223 (private-key "/run/secrets/wg2_hastur") 224 (shepherd-requirement '(age-secret wpa-supplicant)) 225 (pre-up '("while [ ! -f /run/secrets/wg2_hastur ]; do sleep 1; done" 226 "while [ -z \"$(ip route show default)\" ]; do sleep 1; done")) 227 (peers 228 (list 229 (wireguard-peer 230 (name "abatur.epistemia") 231 (public-key "OOpc1K4S56FdJkCaqHx3DC4aIO+zQCAo8ACwCboLEjg=") 232 (allowed-ips '("10.0.14.1/32" "100.64.0.0/10")) 233 (endpoint "87.99.141.145:51822") 234 (keep-alive 25)))))) 235 (service pam-limits-service-type 236 (list (pam-limits-entry "@audio" 'both 'rtprio 99) 237 (pam-limits-entry "@audio" 'both 'memlock 'unlimited))) 238 (service powertop-service-type) 239 (service tlp-service-type)) 240 %base-services) 241 (sysctl-service-type config => 242 (sysctl-configuration 243 (settings 244 (append 245 '(("net.ipv4.ip_forward" . "1") 246 ("net.ipv6.conf.all.forwarding" . "1")) 247 %default-sysctl-settings)))))))