forked from
lass.pds.lassul.us/superconfig
This repository has no description
8.1 kB
314 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9 stockholmPkgs = self.inputs.stockholm.packages.${pkgs.stdenv.hostPlatform.system};
10in
11{
12
13 imports = [
14 # Import modules
15 ../modules
16
17 # Import stockholm krebs module
18 self.inputs.stockholm.nixosModules.krebs
19
20 # Import individual configurations
21 ./security-workarounds.nix
22 ./gc.nix
23 ./mc.nix
24 ./zsh.nix
25 ./htop.nix
26 ./tor-ssh.nix
27 ./networkd.nix
28 ./pinned-registry.nix
29 ./nix.nix
30
31 # Import stockholm modules
32 ./kartei.nix
33 self.inputs.stockholm.nixosModules.sitemap
34 self.inputs.stockholm.nixosModules.ssl
35 {
36 # nix-index
37 imports = [
38 self.inputs.nix-index-database.nixosModules.nix-index
39 ];
40 programs.nix-index-database.comma.enable = true;
41 }
42 {
43 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
44 users.extraUsers.mainUser.hashedPasswordFile =
45 config.clan.core.vars.generators.password.files.passwordHash.path;
46 users.extraUsers.root.hashedPasswordFile =
47 config.clan.core.vars.generators.password.files.passwordHash.path;
48 boot.initrd.systemd.emergencyAccess = true;
49 clan.core.vars.generators.password = {
50 prompts.password = {
51 description = "Password for the main user";
52 type = "hidden";
53 };
54 files.password.deploy = false;
55 files.passwordHash.neededFor = "users";
56 runtimeInputs = with pkgs; [
57 coreutils
58 mkpasswd
59 ];
60 script = ''
61 cp $prompts/password $out/password
62 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
63 '';
64 };
65 }
66 {
67 services.openssh.enable = true;
68 services.openssh.settings.PasswordAuthentication = false;
69 services.openssh.hostKeys = [
70 {
71 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
72 type = "ed25519";
73 }
74 ];
75 clan.core.vars.generators.ssh = {
76 files."ssh.id_ed25519" = { };
77 files."ssh.id_ed25519.pub".secret = false;
78 runtimeInputs = with pkgs; [
79 coreutils
80 openssh
81 ];
82 script = ''
83 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
84 '';
85 };
86 }
87 {
88 users.extraUsers = {
89 root = {
90 openssh.authorizedKeys.keys = [
91 self.keys.ssh.barnacle.public
92 self.keys.ssh.yubi_pgp.public
93 self.keys.ssh.termux_massulus.public
94 self.keys.ssh.yubi1.public
95 self.keys.ssh.yubi2.public
96 self.keys.ssh.solo2.public
97 self.keys.ssh.xerxes.public
98 self.keys.ssh.ignavia.public
99 ];
100 };
101 mainUser = {
102 name = "lass";
103 uid = 1337;
104 home = "/home/lass";
105 group = "users";
106 createHome = true;
107 useDefaultShell = true;
108 isNormalUser = true;
109 linger = true;
110 extraGroups = [
111 "audio"
112 "video"
113 "fuse"
114 "wheel"
115 "tor"
116 "dialout"
117 ];
118 openssh.authorizedKeys.keys = [
119 self.keys.ssh.barnacle.public
120 self.keys.ssh.yubi_pgp.public
121 self.keys.ssh.termux_massulus.public
122 self.keys.ssh.yubi1.public
123 self.keys.ssh.yubi2.public
124 self.keys.ssh.solo2.public
125 self.keys.ssh.xerxes.public
126 self.keys.ssh.ignavia.public
127 ];
128 };
129 };
130 }
131 (
132 let
133 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
134 in
135 {
136 environment.variables = {
137 CURL_CA_BUNDLE = ca-bundle;
138 GIT_SSL_CAINFO = ca-bundle;
139 SSL_CERT_FILE = ca-bundle;
140 };
141 }
142 )
143 {
144 #for sshuttle
145 environment.systemPackages = [
146 pkgs.python3Packages.python
147 ];
148 }
149 ];
150
151 networking.hostName = config.clan.core.settings.machine.name;
152
153 krebs = {
154 enable = true;
155 ssl.trustIntermediate = true;
156 };
157
158 users.mutableUsers = false;
159
160 # multiple-definition-problem when defining environment.variables.EDITOR
161 environment.extraInit = ''
162 EDITOR=vim
163 '';
164
165 nixpkgs.config.allowUnfree = true;
166
167 environment.systemPackages = with pkgs; [
168 self.packages.${pkgs.system}.nvim
169 self.packages.${pkgs.system}.tmux
170 self.packages.${pkgs.system}.s
171
172 git
173 git-absorb
174 gnumake
175 jq
176 nix-output-monitor
177 comma
178
179 #style
180 rxvt-unicode-unwrapped.terminfo
181 alacritty.terminfo
182
183 #monitoring tools
184 htop
185 iotop
186
187 #network
188 iptables
189 iftop
190 tcpdump
191 mosh
192 eternal-terminal
193 self.packages.${pkgs.system}.sshify
194
195 #stuff for dl
196 aria2
197
198 #neat utils
199 file
200 xkcdpass
201 stockholmPkgs.kpaste
202 stockholmPkgs.cyberlocker-tools
203 pciutils
204 pop
205 stockholmPkgs.untilport
206 (pkgs.writers.writeDashBin "urgent" ''
207 printf '\a'
208 '')
209 usbutils
210
211 #unpack stuff
212 libarchive
213
214 (pkgs.writers.writeDashBin "sshn" ''
215 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
216 '')
217 ];
218
219 environment.shellAliases = {
220 ll = "ls -l";
221 la = "ls -la";
222 ls = "ls --color";
223 ip = "ip -color=auto";
224 grep = "grep --color=auto";
225 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
226 };
227
228 programs.bash = {
229 completion.enable = true;
230 interactiveShellInit = ''
231 HISTCONTROL='erasedups:ignorespace'
232 HISTSIZE=65536
233 HISTFILESIZE=$HISTSIZE
234
235 shopt -s checkhash
236 shopt -s histappend histreedit histverify
237 shopt -s no_empty_cmd_completion
238 complete -d cd
239 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
240 '';
241 promptInit = ''
242 if test $UID = 0; then
243 PS1='\[\033[1;31m\]\w\[\033[0m\] '
244 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
245 elif test $UID = 1337; then
246 PS1='\[\033[1;32m\]\w\[\033[0m\] '
247 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
248 else
249 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
250 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
251 fi
252 if test -n "$SSH_CLIENT"; then
253 PS1='\[\033[35m\]\h'" $PS1"
254 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
255 fi
256 '';
257 };
258
259 services.journald.settings.Journal = {
260 SystemMaxUse = "1G";
261 RuntimeMaxUse = "128M";
262 Storage = "persistent";
263 };
264
265 # nftables based NixOS firewall. Input and forward drop by default, as
266 # krebs.iptables did; no reverse path filter either, the routers,
267 # container hosts and NAT64 boxes route asymmetrically.
268 networking.nftables = {
269 enable = true;
270 # Defaults to true on machines older than 23.11, which would also wipe
271 # the tables libvirt, podman and jool keep on every reload.
272 flushRuleset = false;
273 # krebs.iptables loaded its rules through iptables-nft into these
274 # tables; nothing removes them when it goes away. Drop once every
275 # machine has switched to nftables.
276 extraDeletions = ''
277 table ip filter
278 delete table ip filter
279 table ip6 filter
280 delete table ip6 filter
281 table ip nat
282 delete table ip nat
283 table ip6 nat
284 delete table ip6 nat
285 '';
286 };
287 networking.firewall = {
288 filterForward = lib.mkDefault true;
289 checkReversePath = false;
290 # all of ICMP, not just echo-request, like krebs.iptables
291 extraInputRules = ''
292 meta l4proto icmp accept
293 '';
294 };
295
296 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
297 networking.firewall.allowedUDPPortRanges = [
298 {
299 from = 60000;
300 to = 61000;
301 }
302 ]; # mosh
303 networking.extraHosts = ''
304 10.42.0.1 acheron.gg23
305 10.42.0.3 styx.gg23
306 '';
307
308 # use 24:00 time format, the default got sneakily changed around 20.03
309 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
310 time.timeZone = lib.mkDefault "Europe/Berlin";
311
312 # disable doc usually
313 documentation.nixos.enable = lib.mkDefault false;
314}