forked from
lass.pds.lassul.us/superconfig
This repository has no description
9.4 kB
370 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 # Clan core configuration
10 clan.core.facts.secretStore = "password-store";
11 clan.core.facts.secretUploadDirectory = lib.mkDefault "/etc/secrets";
12 clan.core.vars.settings.secretStore = "password-store";
13 clan.core.networking.targetHost = "root@${config.networking.hostName}";
14
15 # Stockholm configuration
16 krebs.secret.directory = config.clan.core.facts.secretUploadDirectory;
17
18 # Nixpkgs overlays
19 nixpkgs.overlays = [
20 self.inputs.stockholm.overlays.default
21 (import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
22 ];
23
24 imports = [
25 # Import 3modules
26 ../3modules
27
28 # Import stockholm krebs module
29 self.inputs.stockholm.nixosModules.krebs
30
31 # Import individual configurations
32 ./security-workarounds.nix
33 # ./binary-cache/client.nix
34 ./gc.nix
35 ./mc.nix
36 ./zsh.nix
37 ./htop.nix
38 ./wiregrill.nix
39 ./tmux.nix
40 ./tor-ssh.nix
41 ./networkd.nix
42 ./pinned-registry.nix
43 ./zerotier.nix
44 ./nether.nix
45 ./spora.nix
46 ./nix.nix
47
48 # Import stockholm modules
49 self.inputs.stockholm.nixosModules.users
50 self.inputs.stockholm.nixosModules.hosts
51 self.inputs.stockholm.nixosModules.kartei
52 self.inputs.stockholm.nixosModules.build
53 self.inputs.stockholm.nixosModules.dns
54 self.inputs.stockholm.nixosModules.exim
55 self.inputs.stockholm.nixosModules.exim-retiolum
56 self.inputs.stockholm.nixosModules.tinc
57 self.inputs.stockholm.nixosModules.iptables
58 self.inputs.stockholm.nixosModules.power-action
59 self.inputs.stockholm.nixosModules.setuid
60 self.inputs.stockholm.nixosModules.secret
61 self.inputs.stockholm.nixosModules.sitemap
62 self.inputs.stockholm.nixosModules.ssl
63 self.inputs.stockholm.nixosModules.systemd
64 self.inputs.stockholm.nixosModules.xresources
65 self.inputs.stockholm.nixosModules.ssh
66 self.inputs.stockholm.nixosModules.sync-containers3
67 { # nix-index
68 imports = [
69 self.inputs.nix-index-database.nixosModules.nix-index
70 ];
71 programs.nix-index-database.comma.enable = true;
72 }
73 {
74 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
75 users.extraUsers.mainUser.hashedPasswordFile =
76 config.clan.core.vars.generators.password.files.passwordHash.path;
77 users.extraUsers.root.hashedPasswordFile =
78 config.clan.core.vars.generators.password.files.passwordHash.path;
79 boot.initrd.systemd.emergencyAccess = true;
80 clan.core.vars.generators.password = {
81 prompts.password = {
82 description = "Password for the main user";
83 type = "hidden";
84 };
85 files.password.deploy = false;
86 files.passwordHash.neededFor = "users";
87 migrateFact = "password";
88 runtimeInputs = with pkgs; [
89 coreutils
90 mkpasswd
91 ];
92 script = ''
93 cp $prompts/password $out/password
94 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
95 '';
96 };
97 }
98 {
99 services.openssh.enable = true;
100 services.openssh.hostKeys = [
101 {
102 path = config.clanCore.vars.generators.ssh.files."ssh.id_ed25519".path;
103 type = "ed25519";
104 }
105 ];
106 clan.core.vars.generators.ssh = {
107 files."ssh.id_ed25519".secret = true;
108 files."ssh.id_ed25519.pub".secret = false;
109 migrateFact = "ssh";
110 runtimeInputs = with pkgs; [
111 coreutils
112 openssh
113 ];
114 script = ''
115 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
116 '';
117 };
118 }
119 {
120 users.extraUsers = {
121 root = {
122 openssh.authorizedKeys.keys = [
123 config.krebs.users.lass.pubkey
124 ];
125 };
126 mainUser = {
127 name = "lass";
128 uid = 1337;
129 home = "/home/lass";
130 group = "users";
131 createHome = true;
132 useDefaultShell = true;
133 isNormalUser = true;
134 extraGroups = [
135 "audio"
136 "video"
137 "fuse"
138 "wheel"
139 "tor"
140 "dialout"
141 ];
142 openssh.authorizedKeys.keys = [
143 config.krebs.users.lass.pubkey
144 ];
145 };
146 };
147 }
148 (
149 let
150 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
151 in
152 {
153 environment.variables = {
154 CURL_CA_BUNDLE = ca-bundle;
155 GIT_SSL_CAINFO = ca-bundle;
156 SSL_CERT_FILE = ca-bundle;
157 };
158 }
159 )
160 {
161 #for sshuttle
162 environment.systemPackages = [
163 pkgs.python3Packages.python
164 ];
165 }
166 ];
167
168 networking.hostName = config.krebs.build.host.name;
169
170 krebs = {
171 enable = true;
172 build.user = config.krebs.users.lass;
173 ssl.trustIntermediate = true;
174 };
175
176 users.mutableUsers = false;
177
178 # multiple-definition-problem when defining environment.variables.EDITOR
179 environment.extraInit = ''
180 EDITOR=vim
181 '';
182
183 nixpkgs.config.allowUnfree = true;
184
185 environment.systemPackages = with pkgs; [
186 self.packages.${pkgs.system}.nvim
187
188 git
189 git-absorb
190 git-preview
191 gnumake
192 jq
193 nix-output-monitor
194 comma
195
196 #style
197 rxvt-unicode-unwrapped.terminfo
198 alacritty.terminfo
199
200 #monitoring tools
201 htop
202 iotop
203
204 #network
205 iptables
206 iftop
207 tcpdump
208 mosh
209 eternal-terminal
210 self.packages.${pkgs.system}.sshify
211
212 #stuff for dl
213 aria2
214
215 #neat utils
216 file
217 hashPassword
218 xkcdpass
219 kpaste
220 cyberlocker-tools
221 pciutils
222 pop
223 q
224 untilport
225 (pkgs.writeDashBin "urgent" ''
226 printf '\a'
227 '')
228 usbutils
229 self.packages.${pkgs.system}.logify
230 goify
231
232 #unpack stuff
233 libarchive
234
235 (pkgs.writeDashBin "sshn" ''
236 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
237 '')
238 ];
239
240 environment.shellAliases = {
241 ll = "ls -l";
242 la = "ls -la";
243 ls = "ls --color";
244 ip = "ip -color=auto";
245 grep = "grep --color=auto";
246 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
247 };
248
249 programs.bash = {
250 completion.enable = true;
251 interactiveShellInit = ''
252 HISTCONTROL='erasedups:ignorespace'
253 HISTSIZE=65536
254 HISTFILESIZE=$HISTSIZE
255
256 shopt -s checkhash
257 shopt -s histappend histreedit histverify
258 shopt -s no_empty_cmd_completion
259 complete -d cd
260 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
261 '';
262 promptInit = ''
263 if test $UID = 0; then
264 PS1='\[\033[1;31m\]\w\[\033[0m\] '
265 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
266 elif test $UID = 1337; then
267 PS1='\[\033[1;32m\]\w\[\033[0m\] '
268 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
269 else
270 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
271 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
272 fi
273 if test -n "$SSH_CLIENT"; then
274 PS1='\[\033[35m\]\h'" $PS1"
275 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
276 fi
277 '';
278 };
279
280 services.journald.extraConfig = ''
281 SystemMaxUse=1G
282 RuntimeMaxUse=128M
283 Storage=persistent
284 '';
285
286 krebs.iptables = {
287 enable = true;
288 tables = {
289 filter.INPUT.policy = "DROP";
290 filter.FORWARD.policy = lib.mkDefault "DROP";
291 filter.INPUT.rules = lib.mkMerge [
292 (lib.mkBefore [
293 {
294 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
295 target = "ACCEPT";
296 }
297 {
298 predicate = "-p icmp";
299 target = "ACCEPT";
300 }
301 {
302 predicate = "-p ipv6-icmp";
303 target = "ACCEPT";
304 v4 = false;
305 }
306 {
307 predicate = "-i lo";
308 target = "ACCEPT";
309 }
310 {
311 predicate = "-p tcp --dport 22";
312 target = "ACCEPT";
313 }
314 ])
315 (lib.mkOrder 1000 [
316 {
317 predicate = "-p udp --dport 60000:61000";
318 target = "ACCEPT";
319 } # mosh
320 {
321 predicate = "-i retiolum -p udp -m udp --dport 53";
322 target = "ACCEPT";
323 }
324 {
325 predicate = "-i retiolum -p tcp --dport 19999";
326 target = "ACCEPT";
327 }
328 ])
329 (lib.mkAfter [
330 {
331 predicate = "-p tcp -i retiolum";
332 target = "REJECT --reject-with tcp-reset";
333 }
334 {
335 predicate = "-p udp -i retiolum";
336 target = "REJECT --reject-with icmp-port-unreachable";
337 v6 = false;
338 }
339 {
340 predicate = "-i retiolum";
341 target = "REJECT --reject-with icmp-proto-unreachable";
342 v6 = false;
343 }
344 ])
345 ];
346 };
347 };
348
349
350 networking.extraHosts = ''
351 10.42.0.1 styx.gg23
352 '';
353
354 # use 24:00 time format, the default got sneakily changed around 20.03
355 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
356 time.timeZone = lib.mkDefault "Europe/Berlin";
357
358 # disable doc usually
359 documentation.nixos.enable = lib.mkDefault false;
360
361 # use new rebuild switch
362 system.switch = {
363 enable = false;
364 enableNg = true;
365 };
366
367 # use latest nix to hunt all the bugs
368 nix.package = pkgs.nixVersions.latest;
369
370}