path: root/epistemia/systems/saklas.scm

(define-module (epistemia systems saklas)
  #:use-module (gnu)
  #:use-module (gnu packages bash)
  #:use-module (gnu packages emacs)
  #:use-module (gnu packages golang-crypto)
  #:use-module (gnu packages linux)
  #:use-module (gnu packages mail)
  #:use-module (gnu packages messaging)
  #:use-module (gnu packages rsync)
  #:use-module (gnu packages version-control)
  #:use-module (gnu services certbot)
  #:use-module (gnu services cgit)
  #:use-module (gnu services dns)
  #:use-module (gnu services file-sharing)
  #:use-module (gnu services linux)
  #:use-module (gnu services mail)
  #:use-module (gnu services messaging)
  #:use-module (gnu services networking)
  #:use-module (gnu services security)
  #:use-module (gnu services shepherd)
  #:use-module (gnu services ssh)
  #:use-module (gnu services vpn)
  #:use-module (gnu services web)
  #:use-module (gnu system accounts)
  #:use-module (guix)
  #:use-module (guix gexp)
  #:use-module (guix transformations)
  #:use-module (guix utils)
  #:use-module (nongnu packages linux)
  #:use-module (nongnu system linux-initrd)
  #:use-module (epistemia bootloader)
  #:use-module (epistemia systems base-system)
  #:use-module (epistemia systems linux-initrd)
  #:use-module (epistemia services age-secret)
  #:use-module (epistemia services zfs)
  #:use-module (epistemia packages bittorrent)
  #:use-module (epistemia packages zfs)
  #:use-module (ice-9 format))

(define %nginx-badboi
  (plain-file "nginx-badboi.conf"
	      "\
set $bad_boi 0;
if ($http_user_agent ~* \"(AI2Bot|Ai2Bot\\-Dolma|aiHitBot|Amazonbot|Andibot|anthropic\\-ai|Applebot|Applebot\\-Extended|bedrockbot|Brightbot\\ 1\\.0|Bytespider|CCBot|ChatGPT\\-User|Claude\\-SearchBot|Claude\\-User|Claude\\-Web|ClaudeBot|cohere\\-ai|cohere\\-training\\-data\\-crawler|Cotoyogi|Crawlspace|Diffbot|DuckAssistBot|FacebookBot|Factset_spyderbot|FirecrawlAgent|FriendlyCrawler|Google\\-CloudVertexBot|Google\\-Extended|GoogleOther|GoogleOther\\-Image|GoogleOther\\-Video|GPTBot|iaskspider/2\\.0|ICC\\-Crawler|ImagesiftBot|img2dataset|ISSCyberRiskCrawler|Kangaroo\\ Bot|meta\\-externalagent|Meta\\-ExternalAgent|meta\\-externalfetcher|Meta\\-ExternalFetcher|MistralAI\\-User/1\\.0|NovaAct|OAI\\-SearchBot|omgili|omgilibot|Operator|PanguBot|Panscient|panscient\\.com|Perplexity\\-User|PerplexityBot|PetalBot|PhindBot|QualifiedBot|QuillBot|quillbot\\.com|SBIntuitionsBot|Scrapy|SemrushBot\\-OCOB|SemrushBot\\-SWA|Sidetrade\\ indexer\\ bot|TikTokSpider|Timpibot|VelenPublicWebCrawler|Webzio\\-Extended|wpbot|YandexAdditional|YandexAdditionalBot|YouBot)\") {
    set $bad_boi 1;
}
if ($request_uri = \"/robots.txt\") {
  set $bad_boi 0;
}
if ($bad_boi = 1) {
  return 307 https://planet.openstreetmap.org/pbf/planet-latest.osm.pbf;
}
"))

(define %opensmtpd-config
  (mixed-text-file "opensmtpd.conf"
		   "table domains { vineetk.net, 13f0.net, vinbiz.ca }\n"
		   "table virtuals file:/run/secrets/saklas_smtpd_virtuals\n"
		   "table passwd file:/run/secrets/saklas_smtpd_passwd\n"
		   "\n"
		   "pki mail.vineetk.net cert \"/etc/certs/vineetk.net/fullchain.pem\"\n"
		   "pki mail.vineetk.net key \"/etc/certs/vineetk.net/privkey.pem\"\n"
		   "\n"
		   "filter check_dyndns phase connect match rdns regex { '.*\\.dyn\\..*', '.*\\.dsl\\..*' } disconnect \"550 no residential connections\"\n"
		   "filter check_rdns phase connect match !rdns disconnect \"550 no connections without an rDNS\"\n"
		   "filter check_fcrdns phase connect match !fcrdns disconnect \"550 no connections without an FCrDNS\"\n"
		   "#filter sendscore proc-exec \"filter-sendscore -blockBelow 10 -junkBelow 70 -slowFactor 5000\"\n"
		   "filter dkimsign_rsa proc-exec \""
                   (file-append opensmtpd-filter-dkimsign "/libexec/opensmtpd/filter-dkimsign")
                   " -d 13f0.net -d vinbiz.ca -d vineetk.net -s mail -k /run/secrets/saklas_smtpd_dkim\""
                   " user smtpd group nogroup\n"
		   "\n"
		   "listen on socket\n"
		   "listen on eth0 port 25 tls pki mail.vineetk.net filter { check_dyndns, check_rdns, check_fcrdns }\n"
		   "listen on eth0 port 465 smtps pki mail.vineetk.net auth <passwd> filter dkimsign_rsa\n"
		   "\n"
		   "action \"inbound\" lmtp \"/var/run/dovecot/lmtp\" rcpt-to virtual <virtuals>\n"
		   "action \"outbound\" relay helo mail.vineetk.net\n"
		   "\n"
		   "match from local for local action \"inbound\"\n"
		   "match from any for domain <domains> action \"inbound\"\n"
		   "match from local for any action \"outbound\"\n"
		   "match from any auth for any action \"outbound\"\n"))

;; adapted from my pf.conf
(define %nftables-ruleset
  (plain-file "nftables.conf" "\
define ext_if = \"eth0\"
define vpn_if = \"wg0\"

define tcp_ports = {
    http, https,
    smtp, smtps, imaps,
    xmpp-client, xmpp-server, 5281, 5201,
    6060
}

define udp_ports = {
    3478, 5201, 51413, 51820
}

table inet filter {
  set ssh_whitelist_ipv4 {
    type ipv4_addr
    flags interval
    elements = {
        47.201.69.0/24,
        185.157.162.25/24
    }
  }

  set ssh_whitelist_ipv6 {
      type ipv6_addr
      flags interval
      elements = {
          2001:470:d851:b0ba::/64,
          2a07:a880:3101:102a:2b39:4fb9:4975:4c1d
      }
  }

  chain input {
    type filter hook input priority 0; policy drop;

    # set skip on lo
    iifname lo accept
    # drop connections to lo not coming from lo
    iif != lo ip daddr 127.0.0.1/8 drop
    iif != lo ip6 daddr ::1/128 drop

    # early drop of invalid connections
    ct state invalid drop
    # allow established/related connections
    ct state { established, related } accept

    # unblock pings
    ip protocol icmp icmp type echo-request accept
    ip6 nexthdr icmpv6 icmpv6 type { packet-too-big, echo-request } accept
    ip6 nexthdr icmpv6 icmpv6 \
      type { echo-request, nd-router-solicit, nd-router-advert,
             nd-neighbor-solicit, nd-neighbor-advert, nd-redirect } accept

    iifname $ext_if tcp dport $tcp_ports ct state new accept
    iifname $ext_if udp dport $udp_ports ct state new accept

    iifname $vpn_if tcp dport { 9090, 9100 } ct state new accept

    # allow public ssh only to my normal home address and mullvad ips
    iifname $ext_if tcp dport ssh ip saddr @ssh_whitelist_ipv4 ct state new log prefix \"SSH_V4: \" accept
    iifname $ext_if tcp dport ssh ip6 saddr @ssh_whitelist_ipv6 ct state new log prefix \"SSH_V6: \" accept

    iifname wg1 accept

    # reject everything else
    reject with icmpx type port-unreachable
  }

  chain forward {
    type filter hook forward priority 0; policy drop;
  }

  chain output {
    type filter hook output priority 0; policy accept;
  }
}
"))


(operating-system
  (inherit base-system)
  (host-name "saklas.epistemia")

  (users (cons* (user-account
                  (name "vin")
                  (comment "Vineet")
		  (shell (file-append bash "/bin/bash"))
                  (group "users")
                  (supplementary-groups '("wheel" "git" "torrents")))
		(user-account
		  (name "git")
		  (comment "git account")
		  (group "git")
		  (shell (file-append bash "/bin/bash"))
		  (home-directory "/data/src/bare")
		  (system? #t))
		(user-account
		  (name "torrents")
		  (comment "torrenting account")
		  (group "torrents")
		  (shell "/dev/null")
		  (home-directory "/var/empty")
		  (system? #t))
		(user-account
		  (name "vmail")
		  (comment "virtual mail account")
		  (group "vmail")
		  (shell "/dev/null")
		  (home-directory "/var/vmail")
		  (system? #t))
		%base-user-accounts))
  (groups (cons* (user-group
		   (name "git"))
		 (user-group
		   (name "torrents"))
		 (user-group
		   (name "vmail"))
		 %base-groups))

  (kernel linux-6.18)
  (kernel-arguments (list "net.ifnames=0" "nomodeset"))
  (kernel-loadable-modules (list (list zfs-linux "module")))

  (initrd (lambda (file-systems . args)
            (apply microcode-initrd file-systems
                   #:initrd epistemia-zfs-initrd
                   #:zfs-package zfs-linux
                   args)))
  (firmware (cons* amdgpu-firmware %base-firmware))

  (bootloader (bootloader-configuration
		(bootloader grub-zfs-bios)
		(targets '("/dev/sda"))))

  (file-systems (append
                 (list (file-system
			 (device "zroot/root")
			 (mount-point "/")
			 (type "zfs")
			 (check? #f)
			 (needed-for-boot? #t))
                       (file-system
			 (device "zroot/gnu")
			 (mount-point "/gnu")
			 (type "zfs")
			 (check? #f)
			 (needed-for-boot? #t))
                       (file-system
			 (device "zroot/var")
			 (mount-point "/var")
			 (type "zfs")
			 (check? #f)
			 (needed-for-boot? #t))
                       (file-system
			 (device "zroot/home")
			 (mount-point "/home")
			 (type "zfs")
			 (check? #f)
			 (needed-for-boot? #t)))
                 %base-file-systems))

  (packages (append (list emacs-no-x
			  git
			  rsync
			  zfs-linux)
                    %base-packages))

  (services (modify-services (append (list (service age-secret-service-type
						    (age-secret-configuration
						     (secrets (list
							       (age-secret
								(name "wg1_saklas")
								(file (local-file "../secrets/wg1_saklas.age")))
							       (age-secret
								(name "saklas_smtpd_dkim")
								(file (local-file "../secrets/saklas_smtpd_dkim.age"))
								(owner "smtpd")
								(group "nogroup")
								(mode #o400))
							       (age-secret
								(name "saklas_smtpd_virtuals")
								(file (local-file "../secrets/saklas_smtpd_virtuals.age"))
								(owner "smtpd")
								(group "nogroup")
								(mode #o400))
							       (age-secret
								(name "saklas_smtpd_passwd")
								(file (local-file "../secrets/saklas_smtpd_passwd.age"))
								(owner "smtpd")
								(group "dovecot")
								(mode #o440))))))
					   (simple-service 'zfs-loader
							   kernel-module-loader-service-type
							   '("zfs"))
					   (simple-service 'zfs-shepherd-services
							   shepherd-root-service-type
							   zfs-shepherd-services)
					   (simple-service 'zfs-shepherd-services-user-processes
							   user-processes-service-type
							   '(zfs-automount))
					   (service nftables-service-type
						    (nftables-configuration
						      (ruleset %nftables-ruleset)))
					   (service static-networking-service-type
						    ;; TODO hurricane electric for ipv6 /48. ovh vps only gets /128.
						    (list (static-networking
							    (addresses
							     (list (network-address
								     (device "eth0")
								     (value "141.95.52.111/24"))))
							    (routes
 							     (list (network-route
 								     (destination "default")
								     (gateway "141.95.52.1")))))))
					   (simple-service 'resolv-configuration
							   etc-service-type
							   `(("resolv.conf"
							      ,(plain-file "resolv.conf"
									   (string-append
									    "nameserver 127.0.0.1\n"
									    "search epistemia\n")))))
					   (service openssh-service-type
						    (openssh-configuration
						      (permit-root-login 'prohibit-password)
						      (password-authentication? #f)
						      (authorized-keys
						       `(("vin" ,(local-file "/data/ssh/id_ed25519.pub"))
							 ("git" ,(local-file "/data/ssh/id_ed25519.pub"))
							 ("root" ,(local-file "/data/ssh/id_ed25519.pub"))))))
					   (service unbound-service-type
						    (unbound-configuration
						      (server
						       (unbound-server
							 (interface '("127.0.0.1"
								      "::1"
								      "10.0.13.1"))
							 (hide-version #t)
							 (hide-identity #t)))
						      (extra-content "\
server:
    access-control: 127.0.0.0/8 allow
    access-control: 10.0.13.0/24 allow
    access-control: ::1 allow

    ip-freebind: yes
    aggressive-nsec: no
    module-config: \"respip validator iterator\"

    local-data: \"saklas.epistemia. 86400 IN A 10.0.13.1\"
    local-data: \"saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1\"
    local-data: \"demiurge.epistemia. 86400 IN A 10.0.13.2\"
    local-data: \"demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2\"
    local-data: \"hastur.epistemia. 86400 IN A 10.0.13.3\"
    local-data: \"hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3\"
    local-data: \"iphonebob.epistemia. 86400 IN A 10.0.13.4\"
    local-data: \"iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4\"
    local-zone: \"saklas.epistemia.\" redirect
    local-zone: \"demiurge.epistemia.\" redirect
    local-zone: \"hastur.epistemia.\" redirect
    local-zone: \"iphonebob.epistemia.\" redirect

rpz:
    name: \"hagezi.ultimate\"
    zonefile: \"hagezi.ultimate\"
    url: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt")))
					   (service wireguard-service-type
						    (wireguard-configuration
						      (interface "wg1")
						      (addresses '("10.0.13.1/24" "fd00:b0ba:cafe:babe::1/64 "))
						      (port 51820)
						      (bootstrap-private-key? #f)
						      (private-key "/run/secrets/wg1_saklas")
						      (peers
						       (list
							(wireguard-peer
							  (name "demiurge.epistemia")
							  (public-key "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=")
							  (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128"))
							  (keep-alive 25))
							(wireguard-peer
							  (name "hastur.epistemia")
							  (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=")
							  (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128"))
							  (keep-alive 25))
							(wireguard-peer
							  (name "iphonebob.epistemia")
							  (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=")
							  (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128"))
							  (keep-alive 25))
							(wireguard-peer
							  (name "lab.epistemia")
							  (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=")
							  (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128"))
							  (keep-alive 25))))))
					   (service certbot-service-type
						    (certbot-configuration
						      (email "postmaster@vineetk.net")
						      (certificates
						       (list
							(certificate-configuration
							 (deploy-hook (program-file
								       "import-prosody-certs"
								       #~(begin
									   (let ((prosodyctl (string-append #$prosody "/bin/prosodyctl")))
									     (system* prosodyctl "--root" "cert" "import" "/etc/certs")))))
							 (domains '("vineetk.net"
								    "git.vineetk.net"
								    "mail.vineetk.net"
								    "u.vineetk.net"
								    "xmpp.vineetk.net")))
							(certificate-configuration
							 (domains '("13f0.net"
								    "m.13f0.net"
					;"snac.13f0.net"
								    )))
							(certificate-configuration
							 (domains '("vinbiz.ca")))))))
					   (service nginx-service-type
						    (nginx-configuration
						      (server-blocks
						       (list (nginx-server-configuration
							       (server-name '("vineetk.net"))
							       (listen '("443 ssl"))
							       (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem")
							       (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem")
							       (root "/var/www/site_vineetk")
							       (raw-content (list "include " %nginx-badboi ";")))
							     (nginx-server-configuration
							       (server-name '("13f0.net"))
							       (listen '("443 ssl"))
							       (ssl-certificate "/etc/certs/13f0.net/fullchain.pem")
							       (ssl-certificate-key "/etc/certs/13f0.net/privkey.pem")
							       (root "/var/www/site_13f0")
							       (raw-content (list "include " %nginx-badboi ";")))
							     (nginx-server-configuration
							       (server-name '("vinbiz.ca"))
							       (listen '("443 ssl"))
							       (ssl-certificate "/etc/certs/vinbiz.ca/fullchain.pem")
							       (ssl-certificate-key "/etc/certs/vinbiz.ca/privkey.pem")
							       (root "/var/www/site_vinbiz")
							       (raw-content (list "include " %nginx-badboi ";")))))))
					   ;; git folder needs to be readable by nginx/cgit, gets reset to 700 on reconfigure otherwise
					   (simple-service 'git-home-permissions
							   activation-service-type
							   #~(when (file-exists? "/data/src/bare")
							       (chmod "/data/src/bare" #o775)))
					   (service cgit-service-type
						    (cgit-configuration
						      (enable-index-links? #t)
						      (enable-log-filecount? #t)
						      (enable-log-linecount? #t)
						      (enable-git-config? #t)
						      (remove-suffix? #t)
						      (root-desc "")
						      (root-title "Vineet's git repos")
						      (repository-directory "/data/src/bare")
						      (section-from-path 1)
						      (side-by-side-diffs? #t)
						      (nginx
						       (list
							(nginx-server-configuration
							  (server-name '("git.vineetk.net"))
							  (listen '("443 ssl"))
							  (root cgit)
							  (try-files (list "$uri" "@cgit"))
							  (ssl-certificate "/etc/certs/vineetk.net/fullchain.pem")
							  (ssl-certificate-key "/etc/certs/vineetk.net/privkey.pem")
							  (raw-content (list "include" %nginx-badboi ";"))
							  (locations
							   (list
							    (nginx-location-configuration
							      (uri "@cgit")
							      (body '("fastcgi_param SCRIPT_FILENAME $document_root/lib/cgit/cgit.cgi;"
								      "fastcgi_param PATH_INFO $uri;"
								      "fastcgi_param QUERY_STRING $args;"
								      "fastcgi_param HTTP_HOST $server_name;"
								      "fastcgi_pass 127.0.0.1:9000;"))))))))))
					   (service prosody-service-type
						    (prosody-configuration
						      (admins '("vin@vineetk.net"))
						      (allow-registration? #f)
						      (c2s-require-encryption? #t)
						      (s2s-require-encryption? #t)
						      (s2s-secure-auth? #t)
						      (authentication "internal_hashed")
						      (plugin-paths (list prosody-cloud-notify))
						      (modules-enabled
						       ;; list from https://github.com/monal-im/Monal/wiki/Considerations-for-XMPP-server-admins#prosody
						       (cons* "sasl_ssdp"
							      ;; TODO update prosody to 13
							      ;; "sasl2"
							      ;; "sasl2_bind2"
							      ;; "sasl2_sm"
							      ;; "sasl2_fast"
							      "muc_notifications"
							      "smacks"
							      "mam"
							      "csi_simple"
							      "cloud_notify"
							      "bookmarks"
							      %default-modules-enabled))
						      ;; I don't want my syslog flooded. can't control changes either in service yet
						      (log "/var/lib/prosody/prosody.log")
						      (virtualhosts
						       (list
							(virtualhost-configuration
							  (domain "vineetk.net"))))))
					   (service opensmtpd-service-type
						    (opensmtpd-configuration
						      (config-file %opensmtpd-config)))
					   (service dovecot-service-type
						    (dovecot-configuration
						      (listen '("*" "::"))
						      (mail-location "maildir:/var/vmail/%d/%n")
						      (mail-uid "vmail")
						      (mail-gid "vmail")
						      (ssl? "required")
						      (ssl-cert "</etc/certs/vineetk.net/fullchain.pem")
						      (ssl-key "</etc/certs/vineetk.net/privkey.pem")
						      (namespaces
						       (list (namespace-configuration
							       (name "inbox")
							       (inbox? #t)
							       (location "")
							       (prefix "")
							       (mailboxes
								(list (mailbox-configuration
									(name "Drafts")
									(special-use '("\\Drafts")))
								      (mailbox-configuration
									(name "Junk")
									(special-use '("\\Junk")))
								      (mailbox-configuration
									(name "Sent")
									(special-use '("\\Sent")))
								      (mailbox-configuration
									(name "Trash")
									(special-use '("\\Trash"))))))))
						      (passdbs
						       (list (passdb-configuration
							       (driver "passwd-file")
							       (args '("scheme=CRYPT" "username_format=%u" "/run/secrets/saklas_smtpd_passwd")))))
						      (userdbs
						       (list (userdb-configuration
							       (driver "static")
							       (args '("uid=vmail" "gid=vmail" "home=/var/vmail/%d/%n")))))
						      (protocols
						       (list (protocol-configuration (name "imap"))
							     (protocol-configuration (name "lmtp"))))
						      (services
						       (list (service-configuration
							       (kind "lmtp")
							       (listeners
								(list (unix-listener-configuration
									(path "lmtp")
									(group "vmail")
									(user "vmail"))))))))))
				     %base-services)
	      (guix-service-type config =>
				 (guix-configuration
				   (inherit config)
				   (authorized-keys
				    (append (list (local-file "../../demiurge.pub"))
					    %default-authorized-guix-keys)))))))