This repository has no description
9.7 kB
373 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 # Clan core configuration
10 clan.core.facts.secretStore = "password-store";
11 clan.core.facts.secretUploadDirectory = lib.mkDefault "/etc/secrets";
12 clan.core.vars.settings.secretStore = "password-store";
13 clan.vars.password-store.passPackage = self.packages.${pkgs.system}.pass;
14 clan.core.networking.targetHost = "root@${config.networking.hostName}";
15
16 # Stockholm configuration
17 krebs.secret.directory = config.clan.core.facts.secretUploadDirectory;
18
19 # Nixpkgs overlays
20 nixpkgs.overlays = [
21 self.inputs.stockholm.overlays.default
22 (import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
23 ];
24
25 imports = [
26 # Import 3modules
27 ../3modules
28
29 # Import stockholm krebs module
30 self.inputs.stockholm.nixosModules.krebs
31
32 # Import individual configurations
33 ./security-workarounds.nix
34 # ./binary-cache/client.nix
35 ./gc.nix
36 ./mc.nix
37 ./zsh.nix
38 ./htop.nix
39 ./wiregrill.nix
40 ./tor-ssh.nix
41 ./networkd.nix
42 ./pinned-registry.nix
43 ./zerotier.nix
44 ./nether.nix
45 ./spora.nix
46 ./nix.nix
47
48 # Import stockholm modules
49 self.inputs.stockholm.nixosModules.users
50 self.inputs.stockholm.nixosModules.hosts
51 self.inputs.stockholm.nixosModules.kartei
52 self.inputs.stockholm.nixosModules.build
53 self.inputs.stockholm.nixosModules.dns
54 self.inputs.stockholm.nixosModules.exim
55 self.inputs.stockholm.nixosModules.exim-retiolum
56 self.inputs.stockholm.nixosModules.tinc
57 self.inputs.stockholm.nixosModules.iptables
58 self.inputs.stockholm.nixosModules.power-action
59 self.inputs.stockholm.nixosModules.setuid
60 self.inputs.stockholm.nixosModules.secret
61 self.inputs.stockholm.nixosModules.sitemap
62 self.inputs.stockholm.nixosModules.ssl
63 self.inputs.stockholm.nixosModules.systemd
64 self.inputs.stockholm.nixosModules.xresources
65 self.inputs.stockholm.nixosModules.ssh
66 self.inputs.stockholm.nixosModules.sync-containers3
67 {
68 # nix-index
69 imports = [
70 self.inputs.nix-index-database.nixosModules.nix-index
71 ];
72 programs.nix-index-database.comma.enable = true;
73 }
74 {
75 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
76 users.extraUsers.mainUser.hashedPasswordFile =
77 config.clan.core.vars.generators.password.files.passwordHash.path;
78 users.extraUsers.root.hashedPasswordFile =
79 config.clan.core.vars.generators.password.files.passwordHash.path;
80 boot.initrd.systemd.emergencyAccess = true;
81 clan.core.vars.generators.password = {
82 prompts.password = {
83 description = "Password for the main user";
84 type = "hidden";
85 };
86 files.password.deploy = false;
87 files.passwordHash.neededFor = "users";
88 migrateFact = "password";
89 runtimeInputs = with pkgs; [
90 coreutils
91 mkpasswd
92 ];
93 script = ''
94 cp $prompts/password $out/password
95 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
96 '';
97 };
98 }
99 {
100 services.openssh.enable = true;
101 services.openssh.hostKeys = [
102 {
103 path = config.clanCore.vars.generators.ssh.files."ssh.id_ed25519".path;
104 type = "ed25519";
105 }
106 ];
107 clan.core.vars.generators.ssh = {
108 files."ssh.id_ed25519".secret = true;
109 files."ssh.id_ed25519.pub".secret = false;
110 migrateFact = "ssh";
111 runtimeInputs = with pkgs; [
112 coreutils
113 openssh
114 ];
115 script = ''
116 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
117 '';
118 };
119 }
120 {
121 users.extraUsers = {
122 root = {
123 openssh.authorizedKeys.keys = [
124 self.keys.ssh.barnacle.public
125 self.keys.ssh.yubi_pgp.public
126 self.keys.ssh.yubi1.public
127 self.keys.ssh.yubi2.public
128 self.keys.ssh.solo2.public
129 ];
130 };
131 mainUser = {
132 name = "lass";
133 uid = 1337;
134 home = "/home/lass";
135 group = "users";
136 createHome = true;
137 useDefaultShell = true;
138 isNormalUser = true;
139 extraGroups = [
140 "audio"
141 "video"
142 "fuse"
143 "wheel"
144 "tor"
145 "dialout"
146 ];
147 openssh.authorizedKeys.keys = [
148 self.keys.ssh.barnacle.public
149 self.keys.ssh.yubi_pgp.public
150 self.keys.ssh.yubi1.public
151 self.keys.ssh.yubi2.public
152 self.keys.ssh.solo2.public
153 ];
154 };
155 };
156 }
157 (
158 let
159 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
160 in
161 {
162 environment.variables = {
163 CURL_CA_BUNDLE = ca-bundle;
164 GIT_SSL_CAINFO = ca-bundle;
165 SSL_CERT_FILE = ca-bundle;
166 };
167 }
168 )
169 {
170 #for sshuttle
171 environment.systemPackages = [
172 pkgs.python3Packages.python
173 ];
174 }
175 ];
176
177 networking.hostName = config.krebs.build.host.name;
178
179 krebs = {
180 enable = true;
181 build.user = config.krebs.users.lass;
182 ssl.trustIntermediate = true;
183 };
184
185 users.mutableUsers = false;
186
187 # multiple-definition-problem when defining environment.variables.EDITOR
188 environment.extraInit = ''
189 EDITOR=vim
190 '';
191
192 nixpkgs.config.allowUnfree = true;
193
194 environment.systemPackages = with pkgs; [
195 self.packages.${pkgs.system}.nvim
196 self.packages.${pkgs.system}.tmux
197
198 git
199 git-absorb
200 git-preview
201 gnumake
202 jq
203 nix-output-monitor
204 comma
205
206 #style
207 rxvt-unicode-unwrapped.terminfo
208 alacritty.terminfo
209
210 #monitoring tools
211 htop
212 iotop
213
214 #network
215 iptables
216 iftop
217 tcpdump
218 mosh
219 eternal-terminal
220 self.packages.${pkgs.system}.sshify
221
222 #stuff for dl
223 aria2
224
225 #neat utils
226 file
227 hashPassword
228 xkcdpass
229 kpaste
230 cyberlocker-tools
231 pciutils
232 pop
233 q
234 untilport
235 (pkgs.writeDashBin "urgent" ''
236 printf '\a'
237 '')
238 usbutils
239 self.packages.${pkgs.system}.logify
240 goify
241
242 #unpack stuff
243 libarchive
244
245 (pkgs.writeDashBin "sshn" ''
246 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
247 '')
248 ];
249
250 environment.shellAliases = {
251 ll = "ls -l";
252 la = "ls -la";
253 ls = "ls --color";
254 ip = "ip -color=auto";
255 grep = "grep --color=auto";
256 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
257 };
258
259 programs.bash = {
260 completion.enable = true;
261 interactiveShellInit = ''
262 HISTCONTROL='erasedups:ignorespace'
263 HISTSIZE=65536
264 HISTFILESIZE=$HISTSIZE
265
266 shopt -s checkhash
267 shopt -s histappend histreedit histverify
268 shopt -s no_empty_cmd_completion
269 complete -d cd
270 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
271 '';
272 promptInit = ''
273 if test $UID = 0; then
274 PS1='\[\033[1;31m\]\w\[\033[0m\] '
275 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
276 elif test $UID = 1337; then
277 PS1='\[\033[1;32m\]\w\[\033[0m\] '
278 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
279 else
280 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
281 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
282 fi
283 if test -n "$SSH_CLIENT"; then
284 PS1='\[\033[35m\]\h'" $PS1"
285 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
286 fi
287 '';
288 };
289
290 services.journald.extraConfig = ''
291 SystemMaxUse=1G
292 RuntimeMaxUse=128M
293 Storage=persistent
294 '';
295
296 krebs.iptables = {
297 enable = true;
298 tables = {
299 filter.INPUT.policy = "DROP";
300 filter.FORWARD.policy = lib.mkDefault "DROP";
301 filter.INPUT.rules = lib.mkMerge [
302 (lib.mkBefore [
303 {
304 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
305 target = "ACCEPT";
306 }
307 {
308 predicate = "-p icmp";
309 target = "ACCEPT";
310 }
311 {
312 predicate = "-p ipv6-icmp";
313 target = "ACCEPT";
314 v4 = false;
315 }
316 {
317 predicate = "-i lo";
318 target = "ACCEPT";
319 }
320 {
321 predicate = "-p tcp --dport 22";
322 target = "ACCEPT";
323 }
324 ])
325 (lib.mkOrder 1000 [
326 {
327 predicate = "-p udp --dport 60000:61000";
328 target = "ACCEPT";
329 } # mosh
330 {
331 predicate = "-i retiolum -p udp -m udp --dport 53";
332 target = "ACCEPT";
333 }
334 {
335 predicate = "-i retiolum -p tcp --dport 19999";
336 target = "ACCEPT";
337 }
338 ])
339 (lib.mkAfter [
340 {
341 predicate = "-p tcp -i retiolum";
342 target = "REJECT --reject-with tcp-reset";
343 }
344 {
345 predicate = "-p udp -i retiolum";
346 target = "REJECT --reject-with icmp-port-unreachable";
347 v6 = false;
348 }
349 {
350 predicate = "-i retiolum";
351 target = "REJECT --reject-with icmp-proto-unreachable";
352 v6 = false;
353 }
354 ])
355 ];
356 };
357 };
358
359 networking.extraHosts = ''
360 10.42.0.1 styx.gg23
361 '';
362
363 # use 24:00 time format, the default got sneakily changed around 20.03
364 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
365 time.timeZone = lib.mkDefault "Europe/Berlin";
366
367 # disable doc usually
368 documentation.nixos.enable = lib.mkDefault false;
369
370 # use latest nix to hunt all the bugs
371 nix.package = pkgs.nixVersions.latest;
372
373}