forked from
lass.pds.lassul.us/superconfig
This repository has no description
8.0 kB
321 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 # Stockholm configuration
10 krebs.secret.directory = config.clan.core.vars.password-store.secretLocation;
11
12 # Nixpkgs overlays
13 nixpkgs.overlays = [
14 self.inputs.stockholm.overlays.default
15 (import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
16 ];
17
18 imports = [
19 # Import modules
20 ../modules
21
22 # Import stockholm krebs module
23 self.inputs.stockholm.nixosModules.krebs
24
25 # Import individual configurations
26 ./security-workarounds.nix
27 ./gc.nix
28 ./mc.nix
29 ./zsh.nix
30 ./htop.nix
31 ./tor-ssh.nix
32 ./networkd.nix
33 ./pinned-registry.nix
34 ./nix.nix
35
36 # Import stockholm modules
37 self.inputs.stockholm.nixosModules.secret
38 ./kartei.nix
39 self.inputs.stockholm.nixosModules.iptables
40 self.inputs.stockholm.nixosModules.setuid
41 self.inputs.stockholm.nixosModules.sitemap
42 self.inputs.stockholm.nixosModules.ssl
43 self.inputs.stockholm.nixosModules.systemd
44 {
45 # nix-index
46 imports = [
47 self.inputs.nix-index-database.nixosModules.nix-index
48 ];
49 programs.nix-index-database.comma.enable = true;
50 }
51 {
52 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
53 users.extraUsers.mainUser.hashedPasswordFile =
54 config.clan.core.vars.generators.password.files.passwordHash.path;
55 users.extraUsers.root.hashedPasswordFile =
56 config.clan.core.vars.generators.password.files.passwordHash.path;
57 boot.initrd.systemd.emergencyAccess = true;
58 clan.core.vars.generators.password = {
59 prompts.password = {
60 description = "Password for the main user";
61 type = "hidden";
62 };
63 files.password.deploy = false;
64 files.passwordHash.neededFor = "users";
65 runtimeInputs = with pkgs; [
66 coreutils
67 mkpasswd
68 ];
69 script = ''
70 cp $prompts/password $out/password
71 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
72 '';
73 };
74 }
75 {
76 services.openssh.enable = true;
77 services.openssh.settings.PasswordAuthentication = false;
78 services.openssh.hostKeys = [
79 {
80 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
81 type = "ed25519";
82 }
83 ];
84 clan.core.vars.generators.ssh = {
85 files."ssh.id_ed25519" = { };
86 files."ssh.id_ed25519.pub".secret = false;
87 runtimeInputs = with pkgs; [
88 coreutils
89 openssh
90 ];
91 script = ''
92 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
93 '';
94 };
95 }
96 {
97 users.extraUsers = {
98 root = {
99 openssh.authorizedKeys.keys = [
100 self.keys.ssh.barnacle.public
101 self.keys.ssh.yubi_pgp.public
102 self.keys.ssh.termux_massulus.public
103 self.keys.ssh.yubi1.public
104 self.keys.ssh.yubi2.public
105 self.keys.ssh.solo2.public
106 self.keys.ssh.xerxes.public
107 self.keys.ssh.ignavia.public
108 ];
109 };
110 mainUser = {
111 name = "lass";
112 uid = 1337;
113 home = "/home/lass";
114 group = "users";
115 createHome = true;
116 useDefaultShell = true;
117 isNormalUser = true;
118 linger = true;
119 extraGroups = [
120 "audio"
121 "video"
122 "fuse"
123 "wheel"
124 "tor"
125 "dialout"
126 ];
127 openssh.authorizedKeys.keys = [
128 self.keys.ssh.barnacle.public
129 self.keys.ssh.yubi_pgp.public
130 self.keys.ssh.termux_massulus.public
131 self.keys.ssh.yubi1.public
132 self.keys.ssh.yubi2.public
133 self.keys.ssh.solo2.public
134 self.keys.ssh.xerxes.public
135 self.keys.ssh.ignavia.public
136 ];
137 };
138 };
139 }
140 (
141 let
142 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
143 in
144 {
145 environment.variables = {
146 CURL_CA_BUNDLE = ca-bundle;
147 GIT_SSL_CAINFO = ca-bundle;
148 SSL_CERT_FILE = ca-bundle;
149 };
150 }
151 )
152 {
153 #for sshuttle
154 environment.systemPackages = [
155 pkgs.python3Packages.python
156 ];
157 }
158 ];
159
160 networking.hostName = config.clan.core.settings.machine.name;
161
162 krebs = {
163 enable = true;
164 ssl.trustIntermediate = true;
165 };
166
167 users.mutableUsers = false;
168
169 # multiple-definition-problem when defining environment.variables.EDITOR
170 environment.extraInit = ''
171 EDITOR=vim
172 '';
173
174 nixpkgs.config.allowUnfree = true;
175
176 environment.systemPackages = with pkgs; [
177 self.packages.${pkgs.system}.nvim
178 self.packages.${pkgs.system}.tmux
179 self.packages.${pkgs.system}.s
180
181 git
182 git-absorb
183 gnumake
184 jq
185 nix-output-monitor
186 comma
187
188 #style
189 rxvt-unicode-unwrapped.terminfo
190 alacritty.terminfo
191
192 #monitoring tools
193 htop
194 iotop
195
196 #network
197 iptables
198 iftop
199 tcpdump
200 mosh
201 eternal-terminal
202 self.packages.${pkgs.system}.sshify
203
204 #stuff for dl
205 aria2
206
207 #neat utils
208 file
209 xkcdpass
210 kpaste
211 cyberlocker-tools
212 pciutils
213 pop
214 untilport
215 (pkgs.writeDashBin "urgent" ''
216 printf '\a'
217 '')
218 usbutils
219
220 #unpack stuff
221 libarchive
222
223 (pkgs.writeDashBin "sshn" ''
224 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
225 '')
226 ];
227
228 environment.shellAliases = {
229 ll = "ls -l";
230 la = "ls -la";
231 ls = "ls --color";
232 ip = "ip -color=auto";
233 grep = "grep --color=auto";
234 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
235 };
236
237 programs.bash = {
238 completion.enable = true;
239 interactiveShellInit = ''
240 HISTCONTROL='erasedups:ignorespace'
241 HISTSIZE=65536
242 HISTFILESIZE=$HISTSIZE
243
244 shopt -s checkhash
245 shopt -s histappend histreedit histverify
246 shopt -s no_empty_cmd_completion
247 complete -d cd
248 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
249 '';
250 promptInit = ''
251 if test $UID = 0; then
252 PS1='\[\033[1;31m\]\w\[\033[0m\] '
253 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
254 elif test $UID = 1337; then
255 PS1='\[\033[1;32m\]\w\[\033[0m\] '
256 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
257 else
258 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
259 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
260 fi
261 if test -n "$SSH_CLIENT"; then
262 PS1='\[\033[35m\]\h'" $PS1"
263 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
264 fi
265 '';
266 };
267
268 services.journald.settings.Journal = {
269 SystemMaxUse = "1G";
270 RuntimeMaxUse = "128M";
271 Storage = "persistent";
272 };
273
274 krebs.iptables = {
275 enable = true;
276 tables = {
277 filter.INPUT.policy = "DROP";
278 filter.FORWARD.policy = lib.mkDefault "DROP";
279 filter.INPUT.rules = lib.mkMerge [
280 (lib.mkBefore [
281 {
282 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
283 target = "ACCEPT";
284 }
285 {
286 predicate = "-p icmp";
287 target = "ACCEPT";
288 }
289 {
290 predicate = "-p ipv6-icmp";
291 target = "ACCEPT";
292 v4 = false;
293 }
294 {
295 predicate = "-i lo";
296 target = "ACCEPT";
297 }
298 ])
299 ];
300 };
301 };
302
303 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
304 networking.firewall.allowedUDPPortRanges = [
305 {
306 from = 60000;
307 to = 61000;
308 }
309 ]; # mosh
310 networking.extraHosts = ''
311 10.42.0.1 acheron.gg23
312 10.42.0.3 styx.gg23
313 '';
314
315 # use 24:00 time format, the default got sneakily changed around 20.03
316 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
317 time.timeZone = lib.mkDefault "Europe/Berlin";
318
319 # disable doc usually
320 documentation.nixos.enable = lib.mkDefault false;
321}