This repository has no description
7.7 kB
302 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9 selfPkgs = self.packages.${pkgs.stdenv.hostPlatform.system};
10in
11{
12
13 imports = [
14 # Import modules
15 ../modules
16
17 # Import individual configurations
18 ./security-workarounds.nix
19 ./gc.nix
20 ./mc.nix
21 ./zsh.nix
22 ./htop.nix
23 ./tor-ssh.nix
24 ./networkd.nix
25 ./pinned-registry.nix
26 ./nix.nix
27
28 ./kartei.nix
29 {
30 # nix-index
31 imports = [
32 self.inputs.nix-index-database.nixosModules.nix-index
33 ];
34 programs.nix-index-database.comma.enable = true;
35 }
36 {
37 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
38 users.extraUsers.mainUser.hashedPasswordFile =
39 config.clan.core.vars.generators.password.files.passwordHash.path;
40 users.extraUsers.root.hashedPasswordFile =
41 config.clan.core.vars.generators.password.files.passwordHash.path;
42 boot.initrd.systemd.emergencyAccess = true;
43 clan.core.vars.generators.password = {
44 prompts.password = {
45 description = "Password for the main user";
46 type = "hidden";
47 };
48 files.password.deploy = false;
49 files.passwordHash.neededFor = "users";
50 runtimeInputs = with pkgs; [
51 coreutils
52 mkpasswd
53 ];
54 script = ''
55 cp $prompts/password $out/password
56 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
57 '';
58 };
59 }
60 {
61 services.openssh.enable = true;
62 services.openssh.settings.PasswordAuthentication = false;
63 services.openssh.hostKeys = [
64 {
65 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
66 type = "ed25519";
67 }
68 ];
69 clan.core.vars.generators.ssh = {
70 files."ssh.id_ed25519" = { };
71 files."ssh.id_ed25519.pub".secret = false;
72 runtimeInputs = with pkgs; [
73 coreutils
74 openssh
75 ];
76 script = ''
77 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
78 '';
79 };
80 }
81 {
82 users.extraUsers = {
83 root = {
84 openssh.authorizedKeys.keys = [
85 self.keys.ssh.barnacle.public
86 self.keys.ssh.yubi_pgp.public
87 self.keys.ssh.termux_massulus.public
88 self.keys.ssh.yubi1.public
89 self.keys.ssh.yubi2.public
90 self.keys.ssh.solo2.public
91 self.keys.ssh.xerxes.public
92 self.keys.ssh.ignavia.public
93 ];
94 };
95 mainUser = {
96 name = "lass";
97 uid = 1337;
98 home = "/home/lass";
99 group = "users";
100 createHome = true;
101 useDefaultShell = true;
102 isNormalUser = true;
103 linger = true;
104 extraGroups = [
105 "audio"
106 "video"
107 "fuse"
108 "wheel"
109 "tor"
110 "dialout"
111 ];
112 openssh.authorizedKeys.keys = [
113 self.keys.ssh.barnacle.public
114 self.keys.ssh.yubi_pgp.public
115 self.keys.ssh.termux_massulus.public
116 self.keys.ssh.yubi1.public
117 self.keys.ssh.yubi2.public
118 self.keys.ssh.solo2.public
119 self.keys.ssh.xerxes.public
120 self.keys.ssh.ignavia.public
121 ];
122 };
123 };
124 }
125 (
126 let
127 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
128 in
129 {
130 environment.variables = {
131 CURL_CA_BUNDLE = ca-bundle;
132 GIT_SSL_CAINFO = ca-bundle;
133 SSL_CERT_FILE = ca-bundle;
134 };
135 }
136 )
137 {
138 #for sshuttle
139 environment.systemPackages = [
140 pkgs.python3Packages.python
141 ];
142 }
143 ];
144
145 networking.hostName = config.clan.core.settings.machine.name;
146
147 users.mutableUsers = false;
148
149 # multiple-definition-problem when defining environment.variables.EDITOR
150 environment.extraInit = ''
151 EDITOR=vim
152 '';
153
154 nixpkgs.config.allowUnfree = true;
155
156 environment.systemPackages = with pkgs; [
157 self.packages.${pkgs.system}.nvim
158 self.packages.${pkgs.system}.tmux
159 self.packages.${pkgs.system}.s
160
161 git
162 git-absorb
163 gnumake
164 jq
165 nix-output-monitor
166 comma
167
168 #style
169 rxvt-unicode-unwrapped.terminfo
170 alacritty.terminfo
171
172 #monitoring tools
173 htop
174 iotop
175
176 #network
177 iptables
178 iftop
179 tcpdump
180 mosh
181 self.packages.${pkgs.system}.sshify
182
183 #stuff for dl
184 aria2
185
186 #neat utils
187 file
188 xkcdpass
189 selfPkgs.kpaste
190 selfPkgs.cyberlocker-tools
191 pciutils
192 pop
193 selfPkgs.untilport
194 (pkgs.writers.writeDashBin "urgent" ''
195 printf '\a'
196 '')
197 usbutils
198
199 #unpack stuff
200 libarchive
201
202 (pkgs.writers.writeDashBin "sshn" ''
203 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
204 '')
205 ];
206
207 environment.shellAliases = {
208 ll = "ls -l";
209 la = "ls -la";
210 ls = "ls --color";
211 ip = "ip -color=auto";
212 grep = "grep --color=auto";
213 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
214 };
215
216 programs.bash = {
217 completion.enable = true;
218 interactiveShellInit = ''
219 HISTCONTROL='erasedups:ignorespace'
220 HISTSIZE=65536
221 HISTFILESIZE=$HISTSIZE
222
223 shopt -s checkhash
224 shopt -s histappend histreedit histverify
225 shopt -s no_empty_cmd_completion
226 complete -d cd
227 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
228 '';
229 promptInit = ''
230 if test $UID = 0; then
231 PS1='\[\033[1;31m\]\w\[\033[0m\] '
232 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
233 elif test $UID = 1337; then
234 PS1='\[\033[1;32m\]\w\[\033[0m\] '
235 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
236 else
237 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
238 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
239 fi
240 if test -n "$SSH_CLIENT"; then
241 PS1='\[\033[35m\]\h'" $PS1"
242 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
243 fi
244 '';
245 };
246
247 services.journald.settings.Journal = {
248 SystemMaxUse = "1G";
249 RuntimeMaxUse = "128M";
250 Storage = "persistent";
251 };
252
253 # nftables based NixOS firewall. Input and forward drop by default, as
254 # krebs.iptables did; no reverse path filter either, the routers,
255 # container hosts and NAT64 boxes route asymmetrically.
256 networking.nftables = {
257 enable = true;
258 # Defaults to true on machines older than 23.11, which would also wipe
259 # the tables libvirt, podman and jool keep on every reload.
260 flushRuleset = false;
261 # krebs.iptables loaded its rules through iptables-nft into these
262 # tables; nothing removes them when it goes away. Drop once every
263 # machine has switched to nftables.
264 extraDeletions = ''
265 table ip filter
266 delete table ip filter
267 table ip6 filter
268 delete table ip6 filter
269 table ip nat
270 delete table ip nat
271 table ip6 nat
272 delete table ip6 nat
273 '';
274 };
275 networking.firewall = {
276 filterForward = lib.mkDefault true;
277 checkReversePath = false;
278 # all of ICMP, not just echo-request, like krebs.iptables
279 extraInputRules = ''
280 meta l4proto icmp accept
281 '';
282 };
283
284 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
285 networking.firewall.allowedUDPPortRanges = [
286 {
287 from = 60000;
288 to = 61000;
289 }
290 ]; # mosh
291 networking.extraHosts = ''
292 10.42.0.1 acheron.gg23
293 10.42.0.3 styx.gg23
294 '';
295
296 # use 24:00 time format, the default got sneakily changed around 20.03
297 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
298 time.timeZone = lib.mkDefault "Europe/Berlin";
299
300 # disable doc usually
301 documentation.nixos.enable = lib.mkDefault false;
302}