This repository has no description
8.5 kB
336 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 # Clan core configuration
10 clan.core.vars.settings.secretStore = "password-store";
11
12 # Stockholm configuration
13 krebs.secret.directory = config.clan.core.vars.password-store.secretLocation;
14
15 # Nixpkgs overlays
16 nixpkgs.overlays = [
17 self.inputs.stockholm.overlays.default
18 (import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
19 ];
20
21 imports = [
22 # Import 3modules
23 ../3modules
24
25 # Import stockholm krebs module
26 self.inputs.stockholm.nixosModules.krebs
27
28 # Import individual configurations
29 ./security-workarounds.nix
30 # ./binary-cache/client.nix
31 ./gc.nix
32 ./mc.nix
33 ./zsh.nix
34 ./htop.nix
35 ./tor-ssh.nix
36 ./networkd.nix
37 ./pinned-registry.nix
38 ./zerotier.nix
39 ./nether.nix
40 ./nix.nix
41
42 # Import stockholm modules
43 self.inputs.stockholm.nixosModules.users
44 self.inputs.stockholm.nixosModules.hosts
45 self.inputs.stockholm.nixosModules.kartei
46 self.inputs.stockholm.nixosModules.build
47 self.inputs.stockholm.nixosModules.dns
48 self.inputs.stockholm.nixosModules.exim
49 self.inputs.stockholm.nixosModules.exim-retiolum
50 self.inputs.stockholm.nixosModules.tinc
51 self.inputs.stockholm.nixosModules.iptables
52 self.inputs.stockholm.nixosModules.setuid
53 self.inputs.stockholm.nixosModules.secret
54 self.inputs.stockholm.nixosModules.sitemap
55 self.inputs.stockholm.nixosModules.ssl
56 self.inputs.stockholm.nixosModules.systemd
57 self.inputs.stockholm.nixosModules.ssh
58 self.inputs.stockholm.nixosModules.sync-containers3
59 {
60 # nix-index
61 imports = [
62 self.inputs.nix-index-database.nixosModules.nix-index
63 ];
64 programs.nix-index-database.comma.enable = true;
65 }
66 {
67 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
68 users.extraUsers.mainUser.hashedPasswordFile =
69 config.clan.core.vars.generators.password.files.passwordHash.path;
70 users.extraUsers.root.hashedPasswordFile =
71 config.clan.core.vars.generators.password.files.passwordHash.path;
72 boot.initrd.systemd.emergencyAccess = true;
73 clan.core.vars.generators.password = {
74 prompts.password = {
75 description = "Password for the main user";
76 type = "hidden";
77 };
78 files.password.deploy = false;
79 files.passwordHash.neededFor = "users";
80 runtimeInputs = with pkgs; [
81 coreutils
82 mkpasswd
83 ];
84 script = ''
85 cp $prompts/password $out/password
86 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
87 '';
88 };
89 }
90 {
91 services.openssh.enable = true;
92 services.openssh.settings.PasswordAuthentication = false;
93 services.openssh.hostKeys = [
94 {
95 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
96 type = "ed25519";
97 }
98 ];
99 clan.core.vars.generators.ssh = {
100 files."ssh.id_ed25519" = { };
101 files."ssh.id_ed25519.pub".secret = false;
102 runtimeInputs = with pkgs; [
103 coreutils
104 openssh
105 ];
106 script = ''
107 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
108 '';
109 };
110 }
111 {
112 users.extraUsers = {
113 root = {
114 openssh.authorizedKeys.keys = [
115 self.keys.ssh.barnacle.public
116 self.keys.ssh.yubi_pgp.public
117 self.keys.ssh.yubi1.public
118 self.keys.ssh.yubi2.public
119 self.keys.ssh.solo2.public
120 self.keys.ssh.xerxes.public
121 self.keys.ssh.massulus.public
122 ];
123 };
124 mainUser = {
125 name = "lass";
126 uid = 1337;
127 home = "/home/lass";
128 group = "users";
129 createHome = true;
130 useDefaultShell = true;
131 isNormalUser = true;
132 extraGroups = [
133 "audio"
134 "video"
135 "fuse"
136 "wheel"
137 "tor"
138 "dialout"
139 ];
140 openssh.authorizedKeys.keys = [
141 self.keys.ssh.barnacle.public
142 self.keys.ssh.yubi_pgp.public
143 self.keys.ssh.yubi1.public
144 self.keys.ssh.yubi2.public
145 self.keys.ssh.solo2.public
146 self.keys.ssh.xerxes.public
147 self.keys.ssh.massulus.public
148 ];
149 };
150 };
151 }
152 (
153 let
154 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
155 in
156 {
157 environment.variables = {
158 CURL_CA_BUNDLE = ca-bundle;
159 GIT_SSL_CAINFO = ca-bundle;
160 SSL_CERT_FILE = ca-bundle;
161 };
162 }
163 )
164 {
165 #for sshuttle
166 environment.systemPackages = [
167 pkgs.python3Packages.python
168 ];
169 }
170 ];
171
172 networking.hostName = config.krebs.build.host.name;
173
174 krebs = {
175 enable = true;
176 build.user = config.krebs.users.lass;
177 ssl.trustIntermediate = true;
178 };
179
180 users.mutableUsers = false;
181
182 # multiple-definition-problem when defining environment.variables.EDITOR
183 environment.extraInit = ''
184 EDITOR=vim
185 '';
186
187 nixpkgs.config.allowUnfree = true;
188
189 environment.systemPackages = with pkgs; [
190 self.packages.${pkgs.system}.nvim
191 self.packages.${pkgs.system}.tmux
192
193 git
194 git-absorb
195 git-preview
196 gnumake
197 jq
198 nix-output-monitor
199 comma
200
201 #style
202 rxvt-unicode-unwrapped.terminfo
203 alacritty.terminfo
204
205 #monitoring tools
206 htop
207 iotop
208
209 #network
210 iptables
211 iftop
212 tcpdump
213 mosh
214 eternal-terminal
215 self.packages.${pkgs.system}.sshify
216
217 #stuff for dl
218 aria2
219
220 #neat utils
221 file
222 hashPassword
223 xkcdpass
224 kpaste
225 cyberlocker-tools
226 pciutils
227 pop
228 q
229 untilport
230 (pkgs.writeDashBin "urgent" ''
231 printf '\a'
232 '')
233 usbutils
234 goify
235
236 #unpack stuff
237 libarchive
238
239 (pkgs.writeDashBin "sshn" ''
240 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
241 '')
242 ];
243
244 environment.shellAliases = {
245 ll = "ls -l";
246 la = "ls -la";
247 ls = "ls --color";
248 ip = "ip -color=auto";
249 grep = "grep --color=auto";
250 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
251 };
252
253 programs.bash = {
254 completion.enable = true;
255 interactiveShellInit = ''
256 HISTCONTROL='erasedups:ignorespace'
257 HISTSIZE=65536
258 HISTFILESIZE=$HISTSIZE
259
260 shopt -s checkhash
261 shopt -s histappend histreedit histverify
262 shopt -s no_empty_cmd_completion
263 complete -d cd
264 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
265 '';
266 promptInit = ''
267 if test $UID = 0; then
268 PS1='\[\033[1;31m\]\w\[\033[0m\] '
269 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
270 elif test $UID = 1337; then
271 PS1='\[\033[1;32m\]\w\[\033[0m\] '
272 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
273 else
274 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
275 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
276 fi
277 if test -n "$SSH_CLIENT"; then
278 PS1='\[\033[35m\]\h'" $PS1"
279 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
280 fi
281 '';
282 };
283
284 services.journald.extraConfig = ''
285 SystemMaxUse=1G
286 RuntimeMaxUse=128M
287 Storage=persistent
288 '';
289
290 krebs.iptables = {
291 enable = true;
292 tables = {
293 filter.INPUT.policy = "DROP";
294 filter.FORWARD.policy = lib.mkDefault "DROP";
295 filter.INPUT.rules = lib.mkMerge [
296 (lib.mkBefore [
297 {
298 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
299 target = "ACCEPT";
300 }
301 {
302 predicate = "-p icmp";
303 target = "ACCEPT";
304 }
305 {
306 predicate = "-p ipv6-icmp";
307 target = "ACCEPT";
308 v4 = false;
309 }
310 {
311 predicate = "-i lo";
312 target = "ACCEPT";
313 }
314 ])
315 ];
316 };
317 };
318
319 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
320 networking.firewall.allowedUDPPortRanges = [
321 {
322 from = 60000;
323 to = 61000;
324 }
325 ]; # mosh
326 networking.extraHosts = ''
327 10.42.0.1 styx.gg23
328 '';
329
330 # use 24:00 time format, the default got sneakily changed around 20.03
331 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
332 time.timeZone = lib.mkDefault "Europe/Berlin";
333
334 # disable doc usually
335 documentation.nixos.enable = lib.mkDefault false;
336}