This repository has no description
8.0 kB
322 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 # Stockholm configuration
10 krebs.secret.directory = config.clan.core.vars.password-store.secretLocation;
11
12 # Nixpkgs overlays
13 nixpkgs.overlays = [
14 self.inputs.stockholm.overlays.default
15 (import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
16 ];
17
18 imports = [
19 # Import modules
20 ../modules
21
22 # Import stockholm krebs module
23 self.inputs.stockholm.nixosModules.krebs
24
25 # Import individual configurations
26 ./security-workarounds.nix
27 ./gc.nix
28 ./mc.nix
29 ./zsh.nix
30 ./htop.nix
31 ./tor-ssh.nix
32 ./networkd.nix
33 ./pinned-registry.nix
34 ./nix.nix
35
36 # Import stockholm modules
37 self.inputs.stockholm.nixosModules.secret
38 ./kartei.nix
39 self.inputs.stockholm.nixosModules.iptables
40 self.inputs.stockholm.nixosModules.setuid
41 self.inputs.stockholm.nixosModules.sitemap
42 self.inputs.stockholm.nixosModules.ssl
43 self.inputs.stockholm.nixosModules.systemd
44 {
45 # nix-index
46 imports = [
47 self.inputs.nix-index-database.nixosModules.nix-index
48 ];
49 programs.nix-index-database.comma.enable = true;
50 }
51 {
52 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
53 users.extraUsers.mainUser.hashedPasswordFile =
54 config.clan.core.vars.generators.password.files.passwordHash.path;
55 users.extraUsers.root.hashedPasswordFile =
56 config.clan.core.vars.generators.password.files.passwordHash.path;
57 boot.initrd.systemd.emergencyAccess = true;
58 clan.core.vars.generators.password = {
59 prompts.password = {
60 description = "Password for the main user";
61 type = "hidden";
62 };
63 files.password.deploy = false;
64 files.passwordHash.neededFor = "users";
65 runtimeInputs = with pkgs; [
66 coreutils
67 mkpasswd
68 ];
69 script = ''
70 cp $prompts/password $out/password
71 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
72 '';
73 };
74 }
75 {
76 services.openssh.enable = true;
77 services.openssh.settings.PasswordAuthentication = false;
78 services.openssh.hostKeys = [
79 {
80 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
81 type = "ed25519";
82 }
83 ];
84 clan.core.vars.generators.ssh = {
85 files."ssh.id_ed25519" = { };
86 files."ssh.id_ed25519.pub".secret = false;
87 runtimeInputs = with pkgs; [
88 coreutils
89 openssh
90 ];
91 script = ''
92 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
93 '';
94 };
95 }
96 {
97 users.extraUsers = {
98 root = {
99 openssh.authorizedKeys.keys = [
100 self.keys.ssh.barnacle.public
101 self.keys.ssh.yubi_pgp.public
102 self.keys.ssh.termux_massulus.public
103 self.keys.ssh.yubi1.public
104 self.keys.ssh.yubi2.public
105 self.keys.ssh.solo2.public
106 self.keys.ssh.xerxes.public
107 self.keys.ssh.ignavia.public
108 ];
109 };
110 mainUser = {
111 name = "lass";
112 uid = 1337;
113 home = "/home/lass";
114 group = "users";
115 createHome = true;
116 useDefaultShell = true;
117 isNormalUser = true;
118 linger = true;
119 extraGroups = [
120 "audio"
121 "video"
122 "fuse"
123 "wheel"
124 "tor"
125 "dialout"
126 ];
127 openssh.authorizedKeys.keys = [
128 self.keys.ssh.barnacle.public
129 self.keys.ssh.yubi_pgp.public
130 self.keys.ssh.termux_massulus.public
131 self.keys.ssh.yubi1.public
132 self.keys.ssh.yubi2.public
133 self.keys.ssh.solo2.public
134 self.keys.ssh.xerxes.public
135 self.keys.ssh.ignavia.public
136 ];
137 };
138 };
139 }
140 (
141 let
142 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
143 in
144 {
145 environment.variables = {
146 CURL_CA_BUNDLE = ca-bundle;
147 GIT_SSL_CAINFO = ca-bundle;
148 SSL_CERT_FILE = ca-bundle;
149 };
150 }
151 )
152 {
153 #for sshuttle
154 environment.systemPackages = [
155 pkgs.python3Packages.python
156 ];
157 }
158 ];
159
160 networking.hostName = config.clan.core.settings.machine.name;
161
162 krebs = {
163 enable = true;
164 ssl.trustIntermediate = true;
165 };
166
167 users.mutableUsers = false;
168
169 # multiple-definition-problem when defining environment.variables.EDITOR
170 environment.extraInit = ''
171 EDITOR=vim
172 '';
173
174 nixpkgs.config.allowUnfree = true;
175
176 environment.systemPackages = with pkgs; [
177 self.packages.${pkgs.system}.nvim
178 self.packages.${pkgs.system}.tmux
179 self.packages.${pkgs.system}.s
180
181 git
182 git-absorb
183 gnumake
184 jq
185 nix-output-monitor
186 comma
187
188 #style
189 rxvt-unicode-unwrapped.terminfo
190 alacritty.terminfo
191
192 #monitoring tools
193 htop
194 iotop
195
196 #network
197 iptables
198 iftop
199 tcpdump
200 mosh
201 eternal-terminal
202 self.packages.${pkgs.system}.sshify
203
204 #stuff for dl
205 aria2
206
207 #neat utils
208 file
209 xkcdpass
210 kpaste
211 cyberlocker-tools
212 pciutils
213 pop
214 untilport
215 (pkgs.writeDashBin "urgent" ''
216 printf '\a'
217 '')
218 usbutils
219 goify
220
221 #unpack stuff
222 libarchive
223
224 (pkgs.writeDashBin "sshn" ''
225 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
226 '')
227 ];
228
229 environment.shellAliases = {
230 ll = "ls -l";
231 la = "ls -la";
232 ls = "ls --color";
233 ip = "ip -color=auto";
234 grep = "grep --color=auto";
235 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
236 };
237
238 programs.bash = {
239 completion.enable = true;
240 interactiveShellInit = ''
241 HISTCONTROL='erasedups:ignorespace'
242 HISTSIZE=65536
243 HISTFILESIZE=$HISTSIZE
244
245 shopt -s checkhash
246 shopt -s histappend histreedit histverify
247 shopt -s no_empty_cmd_completion
248 complete -d cd
249 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
250 '';
251 promptInit = ''
252 if test $UID = 0; then
253 PS1='\[\033[1;31m\]\w\[\033[0m\] '
254 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
255 elif test $UID = 1337; then
256 PS1='\[\033[1;32m\]\w\[\033[0m\] '
257 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
258 else
259 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
260 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
261 fi
262 if test -n "$SSH_CLIENT"; then
263 PS1='\[\033[35m\]\h'" $PS1"
264 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
265 fi
266 '';
267 };
268
269 services.journald.settings.Journal = {
270 SystemMaxUse = "1G";
271 RuntimeMaxUse = "128M";
272 Storage = "persistent";
273 };
274
275 krebs.iptables = {
276 enable = true;
277 tables = {
278 filter.INPUT.policy = "DROP";
279 filter.FORWARD.policy = lib.mkDefault "DROP";
280 filter.INPUT.rules = lib.mkMerge [
281 (lib.mkBefore [
282 {
283 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
284 target = "ACCEPT";
285 }
286 {
287 predicate = "-p icmp";
288 target = "ACCEPT";
289 }
290 {
291 predicate = "-p ipv6-icmp";
292 target = "ACCEPT";
293 v4 = false;
294 }
295 {
296 predicate = "-i lo";
297 target = "ACCEPT";
298 }
299 ])
300 ];
301 };
302 };
303
304 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
305 networking.firewall.allowedUDPPortRanges = [
306 {
307 from = 60000;
308 to = 61000;
309 }
310 ]; # mosh
311 networking.extraHosts = ''
312 10.42.0.1 acheron.gg23
313 10.42.0.3 styx.gg23
314 '';
315
316 # use 24:00 time format, the default got sneakily changed around 20.03
317 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
318 time.timeZone = lib.mkDefault "Europe/Berlin";
319
320 # disable doc usually
321 documentation.nixos.enable = lib.mkDefault false;
322}