forked from
lass.pds.lassul.us/superconfig
This repository has no description
7.8 kB
315 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 # Nixpkgs overlays
10 nixpkgs.overlays = [
11 self.inputs.stockholm.overlays.default
12 (import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
13 ];
14
15 imports = [
16 # Import modules
17 ../modules
18
19 # Import stockholm krebs module
20 self.inputs.stockholm.nixosModules.krebs
21
22 # Import individual configurations
23 ./security-workarounds.nix
24 ./gc.nix
25 ./mc.nix
26 ./zsh.nix
27 ./htop.nix
28 ./tor-ssh.nix
29 ./networkd.nix
30 ./pinned-registry.nix
31 ./nix.nix
32
33 # Import stockholm modules
34 ./kartei.nix
35 self.inputs.stockholm.nixosModules.iptables
36 self.inputs.stockholm.nixosModules.sitemap
37 self.inputs.stockholm.nixosModules.ssl
38 {
39 # nix-index
40 imports = [
41 self.inputs.nix-index-database.nixosModules.nix-index
42 ];
43 programs.nix-index-database.comma.enable = true;
44 }
45 {
46 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
47 users.extraUsers.mainUser.hashedPasswordFile =
48 config.clan.core.vars.generators.password.files.passwordHash.path;
49 users.extraUsers.root.hashedPasswordFile =
50 config.clan.core.vars.generators.password.files.passwordHash.path;
51 boot.initrd.systemd.emergencyAccess = true;
52 clan.core.vars.generators.password = {
53 prompts.password = {
54 description = "Password for the main user";
55 type = "hidden";
56 };
57 files.password.deploy = false;
58 files.passwordHash.neededFor = "users";
59 runtimeInputs = with pkgs; [
60 coreutils
61 mkpasswd
62 ];
63 script = ''
64 cp $prompts/password $out/password
65 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
66 '';
67 };
68 }
69 {
70 services.openssh.enable = true;
71 services.openssh.settings.PasswordAuthentication = false;
72 services.openssh.hostKeys = [
73 {
74 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
75 type = "ed25519";
76 }
77 ];
78 clan.core.vars.generators.ssh = {
79 files."ssh.id_ed25519" = { };
80 files."ssh.id_ed25519.pub".secret = false;
81 runtimeInputs = with pkgs; [
82 coreutils
83 openssh
84 ];
85 script = ''
86 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
87 '';
88 };
89 }
90 {
91 users.extraUsers = {
92 root = {
93 openssh.authorizedKeys.keys = [
94 self.keys.ssh.barnacle.public
95 self.keys.ssh.yubi_pgp.public
96 self.keys.ssh.termux_massulus.public
97 self.keys.ssh.yubi1.public
98 self.keys.ssh.yubi2.public
99 self.keys.ssh.solo2.public
100 self.keys.ssh.xerxes.public
101 self.keys.ssh.ignavia.public
102 ];
103 };
104 mainUser = {
105 name = "lass";
106 uid = 1337;
107 home = "/home/lass";
108 group = "users";
109 createHome = true;
110 useDefaultShell = true;
111 isNormalUser = true;
112 linger = true;
113 extraGroups = [
114 "audio"
115 "video"
116 "fuse"
117 "wheel"
118 "tor"
119 "dialout"
120 ];
121 openssh.authorizedKeys.keys = [
122 self.keys.ssh.barnacle.public
123 self.keys.ssh.yubi_pgp.public
124 self.keys.ssh.termux_massulus.public
125 self.keys.ssh.yubi1.public
126 self.keys.ssh.yubi2.public
127 self.keys.ssh.solo2.public
128 self.keys.ssh.xerxes.public
129 self.keys.ssh.ignavia.public
130 ];
131 };
132 };
133 }
134 (
135 let
136 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
137 in
138 {
139 environment.variables = {
140 CURL_CA_BUNDLE = ca-bundle;
141 GIT_SSL_CAINFO = ca-bundle;
142 SSL_CERT_FILE = ca-bundle;
143 };
144 }
145 )
146 {
147 #for sshuttle
148 environment.systemPackages = [
149 pkgs.python3Packages.python
150 ];
151 }
152 ];
153
154 networking.hostName = config.clan.core.settings.machine.name;
155
156 krebs = {
157 enable = true;
158 ssl.trustIntermediate = true;
159 };
160
161 users.mutableUsers = false;
162
163 # multiple-definition-problem when defining environment.variables.EDITOR
164 environment.extraInit = ''
165 EDITOR=vim
166 '';
167
168 nixpkgs.config.allowUnfree = true;
169
170 environment.systemPackages = with pkgs; [
171 self.packages.${pkgs.system}.nvim
172 self.packages.${pkgs.system}.tmux
173 self.packages.${pkgs.system}.s
174
175 git
176 git-absorb
177 gnumake
178 jq
179 nix-output-monitor
180 comma
181
182 #style
183 rxvt-unicode-unwrapped.terminfo
184 alacritty.terminfo
185
186 #monitoring tools
187 htop
188 iotop
189
190 #network
191 iptables
192 iftop
193 tcpdump
194 mosh
195 eternal-terminal
196 self.packages.${pkgs.system}.sshify
197
198 #stuff for dl
199 aria2
200
201 #neat utils
202 file
203 xkcdpass
204 kpaste
205 cyberlocker-tools
206 pciutils
207 pop
208 untilport
209 (pkgs.writers.writeDashBin "urgent" ''
210 printf '\a'
211 '')
212 usbutils
213
214 #unpack stuff
215 libarchive
216
217 (pkgs.writers.writeDashBin "sshn" ''
218 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
219 '')
220 ];
221
222 environment.shellAliases = {
223 ll = "ls -l";
224 la = "ls -la";
225 ls = "ls --color";
226 ip = "ip -color=auto";
227 grep = "grep --color=auto";
228 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
229 };
230
231 programs.bash = {
232 completion.enable = true;
233 interactiveShellInit = ''
234 HISTCONTROL='erasedups:ignorespace'
235 HISTSIZE=65536
236 HISTFILESIZE=$HISTSIZE
237
238 shopt -s checkhash
239 shopt -s histappend histreedit histverify
240 shopt -s no_empty_cmd_completion
241 complete -d cd
242 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
243 '';
244 promptInit = ''
245 if test $UID = 0; then
246 PS1='\[\033[1;31m\]\w\[\033[0m\] '
247 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
248 elif test $UID = 1337; then
249 PS1='\[\033[1;32m\]\w\[\033[0m\] '
250 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
251 else
252 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
253 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
254 fi
255 if test -n "$SSH_CLIENT"; then
256 PS1='\[\033[35m\]\h'" $PS1"
257 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
258 fi
259 '';
260 };
261
262 services.journald.settings.Journal = {
263 SystemMaxUse = "1G";
264 RuntimeMaxUse = "128M";
265 Storage = "persistent";
266 };
267
268 krebs.iptables = {
269 enable = true;
270 tables = {
271 filter.INPUT.policy = "DROP";
272 filter.FORWARD.policy = lib.mkDefault "DROP";
273 filter.INPUT.rules = lib.mkMerge [
274 (lib.mkBefore [
275 {
276 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
277 target = "ACCEPT";
278 }
279 {
280 predicate = "-p icmp";
281 target = "ACCEPT";
282 }
283 {
284 predicate = "-p ipv6-icmp";
285 target = "ACCEPT";
286 v4 = false;
287 }
288 {
289 predicate = "-i lo";
290 target = "ACCEPT";
291 }
292 ])
293 ];
294 };
295 };
296
297 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
298 networking.firewall.allowedUDPPortRanges = [
299 {
300 from = 60000;
301 to = 61000;
302 }
303 ]; # mosh
304 networking.extraHosts = ''
305 10.42.0.1 acheron.gg23
306 10.42.0.3 styx.gg23
307 '';
308
309 # use 24:00 time format, the default got sneakily changed around 20.03
310 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
311 time.timeZone = lib.mkDefault "Europe/Berlin";
312
313 # disable doc usually
314 documentation.nixos.enable = lib.mkDefault false;
315}