forked from
lass.pds.lassul.us/superconfig
This repository has no description
9.6 kB
382 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 imports = [
10 ./security-workarounds.nix
11 ./binary-cache/client.nix
12 ./gc.nix
13 ./mc.nix
14 ./zsh.nix
15 ./htop.nix
16 ./wiregrill.nix
17 ./tmux.nix
18 ./tor-ssh.nix
19 ./networkd.nix
20 ./pinned-registry.nix
21 ./zerotier.nix
22 ./nether.nix
23 ./spora.nix
24 self.inputs.stockholm.nixosModules.users
25 self.inputs.stockholm.nixosModules.hosts
26 self.inputs.stockholm.nixosModules.kartei
27 self.inputs.stockholm.nixosModules.build
28 self.inputs.stockholm.nixosModules.dns
29 self.inputs.stockholm.nixosModules.exim
30 self.inputs.stockholm.nixosModules.exim-retiolum
31 self.inputs.stockholm.nixosModules.tinc
32 self.inputs.stockholm.nixosModules.iptables
33 self.inputs.stockholm.nixosModules.power-action
34 self.inputs.stockholm.nixosModules.setuid
35 self.inputs.stockholm.nixosModules.secret
36 self.inputs.stockholm.nixosModules.sitemap
37 self.inputs.stockholm.nixosModules.ssl
38 self.inputs.stockholm.nixosModules.systemd
39 self.inputs.stockholm.nixosModules.xresources
40 self.inputs.stockholm.nixosModules.ssh
41 self.inputs.stockholm.nixosModules.sync-containers3
42 {
43 users.extraUsers.mainUser.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
44 users.extraUsers.root.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
45 clanCore.facts.services.password = {
46 secret.password = { };
47 secret.passwordHash = { };
48 generator.path = with pkgs; [
49 coreutils
50 xkcdpass
51 mkpasswd
52 ];
53 generator.script = ''
54 xkcdpass -n 4 -d - > $secrets/password
55 cat $secrets/password | mkpasswd -s -m sha-512 > $secrets/passwordHash
56 '';
57 };
58 }
59 {
60 # deployment information
61 options.clan.flake-inputs = lib.mkOption {
62 description = ''
63 information about the flake inputs.
64 Used for update tracking.
65 '';
66 type = lib.types.attrsOf (
67 lib.types.attrsOf (
68 lib.types.nullOr (
69 lib.types.oneOf [
70 lib.types.str
71 lib.types.int
72 ]
73 )
74 )
75 );
76 default =
77 let
78 inputs = config.clan.core.clanDir.inputs;
79 cleanSourceInfo = input: {
80 rev = input.rev or null;
81 dirtyRev = input.dirtyRev or null;
82 lastModified = input.lastModified or null;
83 narHash = input.narHash or null;
84 };
85 sourceInfo = lib.mapAttrs (_: input: cleanSourceInfo input) inputs;
86 in
87 sourceInfo
88 // {
89 self = cleanSourceInfo config.clan.core.clanDir.sourceInfo;
90 };
91 };
92 config.environment.etc."flake-inputs.json".text =
93 let
94 text = builtins.unsafeDiscardStringContext (builtins.toJSON config.clan.flake-inputs);
95 in
96 text;
97 }
98 {
99 services.openssh.enable = true;
100 services.openssh.hostKeys = [
101 {
102 path = config.clanCore.facts.services.ssh.secret."ssh.id_ed25519".path;
103 type = "ed25519";
104 }
105 ];
106 clanCore.facts.services.ssh = {
107 secret."ssh.id_ed25519" = { };
108 public."ssh.id_ed25519.pub" = { };
109 generator.path = with pkgs; [
110 coreutils
111 openssh
112 ];
113 generator.script = ''
114 ssh-keygen -t ed25519 -N "" -f $secrets/ssh.id_ed25519
115 mv $secrets/ssh.id_ed25519.pub $facts/ssh.id_ed25519.pub
116 '';
117 };
118 }
119 {
120 users.extraUsers = {
121 root = {
122 openssh.authorizedKeys.keys = [
123 config.krebs.users.lass.pubkey
124 ];
125 };
126 mainUser = {
127 name = "lass";
128 uid = 1337;
129 home = "/home/lass";
130 group = "users";
131 createHome = true;
132 useDefaultShell = true;
133 isNormalUser = true;
134 extraGroups = [
135 "audio"
136 "video"
137 "fuse"
138 "wheel"
139 "tor"
140 ];
141 openssh.authorizedKeys.keys = [
142 config.krebs.users.lass.pubkey
143 ];
144 };
145 };
146 }
147 (
148 let
149 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
150 in
151 {
152 environment.variables = {
153 CURL_CA_BUNDLE = ca-bundle;
154 GIT_SSL_CAINFO = ca-bundle;
155 SSL_CERT_FILE = ca-bundle;
156 };
157 }
158 )
159 {
160 #for sshuttle
161 environment.systemPackages = [
162 pkgs.python3Packages.python
163 ];
164 }
165 ];
166
167 networking.hostName = config.krebs.build.host.name;
168
169 krebs = {
170 enable = true;
171 build.user = config.krebs.users.lass;
172 ssl.trustIntermediate = true;
173 };
174
175 nix.settings.sandbox = true;
176
177 users.mutableUsers = false;
178
179 # multiple-definition-problem when defining environment.variables.EDITOR
180 environment.extraInit = ''
181 EDITOR=vim
182 '';
183
184 nixpkgs.config.allowUnfree = true;
185
186 environment.systemPackages = with pkgs; [
187 self.packages.${pkgs.system}.nvim
188
189 git
190 git-absorb
191 git-preview
192 gnumake
193 jq
194 nix-output-monitor
195
196 #style
197 rxvt-unicode-unwrapped.terminfo
198 alacritty.terminfo
199
200 #monitoring tools
201 htop
202 iotop
203
204 #network
205 iptables
206 iftop
207 tcpdump
208 mosh
209 eternal-terminal
210 self.packages.${pkgs.system}.sshify
211
212 #stuff for dl
213 aria2
214
215 #neat utils
216 file
217 hashPassword
218 xkcdpass
219 kpaste
220 cyberlocker-tools
221 pciutils
222 pop
223 q
224 rs
225 untilport
226 (pkgs.writeDashBin "urgent" ''
227 printf '\a'
228 '')
229 usbutils
230 self.packages.${pkgs.system}.logify
231 goify
232
233 #unpack stuff
234 libarchive
235
236 (pkgs.writeDashBin "sshn" ''
237 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
238 '')
239 ];
240
241 environment.shellAliases = {
242 ll = "ls -l";
243 la = "ls -la";
244 ls = "ls --color";
245 ip = "ip -color=auto";
246 grep = "grep --color=auto";
247 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
248 };
249
250 programs.bash = {
251 enableCompletion = true;
252 interactiveShellInit = ''
253 HISTCONTROL='erasedups:ignorespace'
254 HISTSIZE=65536
255 HISTFILESIZE=$HISTSIZE
256
257 shopt -s checkhash
258 shopt -s histappend histreedit histverify
259 shopt -s no_empty_cmd_completion
260 complete -d cd
261 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
262 '';
263 promptInit = ''
264 if test $UID = 0; then
265 PS1='\[\033[1;31m\]\w\[\033[0m\] '
266 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
267 elif test $UID = 1337; then
268 PS1='\[\033[1;32m\]\w\[\033[0m\] '
269 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
270 else
271 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
272 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
273 fi
274 if test -n "$SSH_CLIENT"; then
275 PS1='\[\033[35m\]\h'" $PS1"
276 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
277 fi
278 '';
279 };
280
281 services.journald.extraConfig = ''
282 SystemMaxUse=1G
283 RuntimeMaxUse=128M
284 Storage=persistent
285 '';
286
287 krebs.iptables = {
288 enable = true;
289 tables = {
290 filter.INPUT.policy = "DROP";
291 filter.FORWARD.policy = lib.mkDefault "DROP";
292 filter.INPUT.rules = lib.mkMerge [
293 (lib.mkBefore [
294 {
295 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
296 target = "ACCEPT";
297 }
298 {
299 predicate = "-p icmp";
300 target = "ACCEPT";
301 }
302 {
303 predicate = "-p ipv6-icmp";
304 target = "ACCEPT";
305 v4 = false;
306 }
307 {
308 predicate = "-i lo";
309 target = "ACCEPT";
310 }
311 {
312 predicate = "-p tcp --dport 22";
313 target = "ACCEPT";
314 }
315 ])
316 (lib.mkOrder 1000 [
317 {
318 predicate = "-p udp --dport 60000:61000";
319 target = "ACCEPT";
320 } # mosh
321 {
322 predicate = "-i retiolum -p udp -m udp --dport 53";
323 target = "ACCEPT";
324 }
325 {
326 predicate = "-i retiolum -p tcp --dport 19999";
327 target = "ACCEPT";
328 }
329 ])
330 (lib.mkAfter [
331 {
332 predicate = "-p tcp -i retiolum";
333 target = "REJECT --reject-with tcp-reset";
334 }
335 {
336 predicate = "-p udp -i retiolum";
337 target = "REJECT --reject-with icmp-port-unreachable";
338 v6 = false;
339 }
340 {
341 predicate = "-i retiolum";
342 target = "REJECT --reject-with icmp-proto-unreachable";
343 v6 = false;
344 }
345 ])
346 ];
347 };
348 };
349
350 networking.dhcpcd.extraConfig = ''
351 noipv4ll
352 '';
353
354 networking.extraHosts = ''
355 10.42.0.1 styx.gg23
356 '';
357
358 nix.settings.experimental-features = [
359 "nix-command"
360 "flakes"
361 ];
362
363 # use 24:00 time format, the default got sneakily changed around 20.03
364 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
365 time.timeZone = lib.mkDefault "Europe/Berlin";
366
367 # disable doc usually
368 documentation.nixos.enable = lib.mkDefault false;
369
370 # use new rebuild switch
371 system.switch = {
372 enable = false;
373 enableNg = true;
374 };
375
376 # use latest nix to hunt all the bugs
377 nix.package = pkgs.nixVersions.latest;
378
379 # workaround for systemd freezing up when suspending
380 # https://github.com/systemd/systemd/issues/33083
381 environment.variables.SYSTEMD_SLEEP_FREEZE_USER_SESSIONS = "false";
382}