forked from
lass.pds.lassul.us/superconfig
This repository has no description
8.9 kB
343 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 # Clan core configuration
10 clan.core.facts.secretStore = "password-store";
11 clan.core.facts.secretUploadDirectory = lib.mkDefault "/etc/secrets";
12 clan.core.vars.settings.secretStore = "password-store";
13 clan.core.vars.password-store.passPackage = self.packages.${pkgs.system}.pass;
14 clan.core.networking.targetHost = "root@${config.networking.hostName}";
15
16 # Stockholm configuration
17 krebs.secret.directory = config.clan.core.facts.secretUploadDirectory;
18
19 # Nixpkgs overlays
20 nixpkgs.overlays = [
21 self.inputs.stockholm.overlays.default
22 (import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
23 ];
24
25 imports = [
26 # Import 3modules
27 ../3modules
28
29 # Import stockholm krebs module
30 self.inputs.stockholm.nixosModules.krebs
31
32 # Import individual configurations
33 ./security-workarounds.nix
34 # ./binary-cache/client.nix
35 ./gc.nix
36 ./mc.nix
37 ./zsh.nix
38 ./htop.nix
39 ./wiregrill.nix
40 ./tor-ssh.nix
41 ./networkd.nix
42 ./pinned-registry.nix
43 ./zerotier.nix
44 ./nether.nix
45 ./nix.nix
46
47 # Import stockholm modules
48 self.inputs.stockholm.nixosModules.users
49 self.inputs.stockholm.nixosModules.hosts
50 self.inputs.stockholm.nixosModules.kartei
51 self.inputs.stockholm.nixosModules.build
52 self.inputs.stockholm.nixosModules.dns
53 self.inputs.stockholm.nixosModules.exim
54 self.inputs.stockholm.nixosModules.exim-retiolum
55 self.inputs.stockholm.nixosModules.tinc
56 self.inputs.stockholm.nixosModules.iptables
57 self.inputs.stockholm.nixosModules.power-action
58 self.inputs.stockholm.nixosModules.setuid
59 self.inputs.stockholm.nixosModules.secret
60 self.inputs.stockholm.nixosModules.sitemap
61 self.inputs.stockholm.nixosModules.ssl
62 self.inputs.stockholm.nixosModules.systemd
63 self.inputs.stockholm.nixosModules.ssh
64 self.inputs.stockholm.nixosModules.sync-containers3
65 {
66 # nix-index
67 imports = [
68 self.inputs.nix-index-database.nixosModules.nix-index
69 ];
70 programs.nix-index-database.comma.enable = true;
71 }
72 {
73 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
74 users.extraUsers.mainUser.hashedPasswordFile =
75 config.clan.core.vars.generators.password.files.passwordHash.path;
76 users.extraUsers.root.hashedPasswordFile =
77 config.clan.core.vars.generators.password.files.passwordHash.path;
78 boot.initrd.systemd.emergencyAccess = true;
79 clan.core.vars.generators.password = {
80 prompts.password = {
81 description = "Password for the main user";
82 type = "hidden";
83 };
84 files.password.deploy = false;
85 files.passwordHash.neededFor = "users";
86 migrateFact = "password";
87 runtimeInputs = with pkgs; [
88 coreutils
89 mkpasswd
90 ];
91 script = ''
92 cp $prompts/password $out/password
93 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
94 '';
95 };
96 }
97 {
98 services.openssh.enable = true;
99 services.openssh.settings.PasswordAuthentication = false;
100 services.openssh.hostKeys = [
101 {
102 path = config.clanCore.vars.generators.ssh.files."ssh.id_ed25519".path;
103 type = "ed25519";
104 }
105 ];
106 clan.core.vars.generators.ssh = {
107 files."ssh.id_ed25519".secret = true;
108 files."ssh.id_ed25519.pub".secret = false;
109 migrateFact = "ssh";
110 runtimeInputs = with pkgs; [
111 coreutils
112 openssh
113 ];
114 script = ''
115 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
116 '';
117 };
118 }
119 {
120 users.extraUsers = {
121 root = {
122 openssh.authorizedKeys.keys = [
123 self.keys.ssh.barnacle.public
124 self.keys.ssh.yubi_pgp.public
125 self.keys.ssh.yubi1.public
126 self.keys.ssh.yubi2.public
127 self.keys.ssh.solo2.public
128 self.keys.ssh.xerxes.public
129 ];
130 };
131 mainUser = {
132 name = "lass";
133 uid = 1337;
134 home = "/home/lass";
135 group = "users";
136 createHome = true;
137 useDefaultShell = true;
138 isNormalUser = true;
139 extraGroups = [
140 "audio"
141 "video"
142 "fuse"
143 "wheel"
144 "tor"
145 "dialout"
146 ];
147 openssh.authorizedKeys.keys = [
148 self.keys.ssh.barnacle.public
149 self.keys.ssh.yubi_pgp.public
150 self.keys.ssh.yubi1.public
151 self.keys.ssh.yubi2.public
152 self.keys.ssh.solo2.public
153 self.keys.ssh.xerxes.public
154 ];
155 };
156 };
157 }
158 (
159 let
160 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
161 in
162 {
163 environment.variables = {
164 CURL_CA_BUNDLE = ca-bundle;
165 GIT_SSL_CAINFO = ca-bundle;
166 SSL_CERT_FILE = ca-bundle;
167 };
168 }
169 )
170 {
171 #for sshuttle
172 environment.systemPackages = [
173 pkgs.python3Packages.python
174 ];
175 }
176 ];
177
178 networking.hostName = config.krebs.build.host.name;
179
180 krebs = {
181 enable = true;
182 build.user = config.krebs.users.lass;
183 ssl.trustIntermediate = true;
184 };
185
186 users.mutableUsers = false;
187
188 # multiple-definition-problem when defining environment.variables.EDITOR
189 environment.extraInit = ''
190 EDITOR=vim
191 '';
192
193 nixpkgs.config.allowUnfree = true;
194
195 environment.systemPackages = with pkgs; [
196 self.packages.${pkgs.system}.nvim
197 self.packages.${pkgs.system}.tmux
198
199 git
200 git-absorb
201 git-preview
202 gnumake
203 jq
204 nix-output-monitor
205 comma
206
207 #style
208 rxvt-unicode-unwrapped.terminfo
209 alacritty.terminfo
210
211 #monitoring tools
212 htop
213 iotop
214
215 #network
216 iptables
217 iftop
218 tcpdump
219 mosh
220 eternal-terminal
221 self.packages.${pkgs.system}.sshify
222
223 #stuff for dl
224 aria2
225
226 #neat utils
227 file
228 hashPassword
229 xkcdpass
230 kpaste
231 cyberlocker-tools
232 pciutils
233 pop
234 q
235 untilport
236 (pkgs.writeDashBin "urgent" ''
237 printf '\a'
238 '')
239 usbutils
240 self.packages.${pkgs.system}.logify
241 goify
242
243 #unpack stuff
244 libarchive
245
246 (pkgs.writeDashBin "sshn" ''
247 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
248 '')
249 ];
250
251 environment.shellAliases = {
252 ll = "ls -l";
253 la = "ls -la";
254 ls = "ls --color";
255 ip = "ip -color=auto";
256 grep = "grep --color=auto";
257 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
258 };
259
260 programs.bash = {
261 completion.enable = true;
262 interactiveShellInit = ''
263 HISTCONTROL='erasedups:ignorespace'
264 HISTSIZE=65536
265 HISTFILESIZE=$HISTSIZE
266
267 shopt -s checkhash
268 shopt -s histappend histreedit histverify
269 shopt -s no_empty_cmd_completion
270 complete -d cd
271 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
272 '';
273 promptInit = ''
274 if test $UID = 0; then
275 PS1='\[\033[1;31m\]\w\[\033[0m\] '
276 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
277 elif test $UID = 1337; then
278 PS1='\[\033[1;32m\]\w\[\033[0m\] '
279 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
280 else
281 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
282 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
283 fi
284 if test -n "$SSH_CLIENT"; then
285 PS1='\[\033[35m\]\h'" $PS1"
286 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
287 fi
288 '';
289 };
290
291 services.journald.extraConfig = ''
292 SystemMaxUse=1G
293 RuntimeMaxUse=128M
294 Storage=persistent
295 '';
296
297 krebs.iptables = {
298 enable = true;
299 tables = {
300 filter.INPUT.policy = "DROP";
301 filter.FORWARD.policy = lib.mkDefault "DROP";
302 filter.INPUT.rules = lib.mkMerge [
303 (lib.mkBefore [
304 {
305 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
306 target = "ACCEPT";
307 }
308 {
309 predicate = "-p icmp";
310 target = "ACCEPT";
311 }
312 {
313 predicate = "-p ipv6-icmp";
314 target = "ACCEPT";
315 v4 = false;
316 }
317 {
318 predicate = "-i lo";
319 target = "ACCEPT";
320 }
321 ])
322 ];
323 };
324 };
325
326 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
327 networking.firewall.allowedUDPPortRanges = [
328 {
329 from = 60000;
330 to = 61000;
331 }
332 ]; # mosh
333 networking.extraHosts = ''
334 10.42.0.1 styx.gg23
335 '';
336
337 # use 24:00 time format, the default got sneakily changed around 20.03
338 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
339 time.timeZone = lib.mkDefault "Europe/Berlin";
340
341 # disable doc usually
342 documentation.nixos.enable = lib.mkDefault false;
343}