This repository has no description
7.5 kB
274 lines
1{ self, config, lib, pkgs, ... }:
2{
3 imports = [
4 ./security-workarounds.nix
5 ./binary-cache/client.nix
6 ./gc.nix
7 ./mc.nix
8 ./zsh.nix
9 ./htop.nix
10 ./wiregrill.nix
11 ./tmux.nix
12 ./tor-ssh.nix
13 ./networkd.nix
14 ./pinned-registry.nix
15 ./zerotier.nix
16 ./nether.nix
17 ./spora.nix
18 self.inputs.stockholm.nixosModules.users
19 self.inputs.stockholm.nixosModules.hosts
20 self.inputs.stockholm.nixosModules.kartei
21 self.inputs.stockholm.nixosModules.build
22 self.inputs.stockholm.nixosModules.dns
23 self.inputs.stockholm.nixosModules.exim
24 self.inputs.stockholm.nixosModules.exim-retiolum
25 self.inputs.stockholm.nixosModules.tinc
26 self.inputs.stockholm.nixosModules.iptables
27 self.inputs.stockholm.nixosModules.power-action
28 self.inputs.stockholm.nixosModules.setuid
29 self.inputs.stockholm.nixosModules.secret
30 self.inputs.stockholm.nixosModules.sitemap
31 self.inputs.stockholm.nixosModules.ssl
32 self.inputs.stockholm.nixosModules.systemd
33 self.inputs.stockholm.nixosModules.xresources
34 self.inputs.stockholm.nixosModules.ssh
35 self.inputs.stockholm.nixosModules.sync-containers3
36 {
37 users.extraUsers.mainUser.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
38 users.extraUsers.root.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
39 clanCore.facts.services.password = {
40 secret.password = { };
41 secret.passwordHash = { };
42 generator.path = with pkgs; [ coreutils xkcdpass mkpasswd ];
43 generator.script = ''
44 xkcdpass -n 4 -d - > $secrets/password
45 cat $secrets/password | mkpasswd -s -m sha-512 > $secrets/passwordHash
46 '';
47 };
48 }
49 {
50 services.openssh.enable = true;
51 services.openssh.hostKeys = [{
52 path = config.clanCore.facts.services.ssh.secret."ssh.id_ed25519".path;
53 type = "ed25519";
54 }];
55 clanCore.facts.services.ssh = {
56 secret."ssh.id_ed25519" = { };
57 public."ssh.id_ed25519.pub" = { };
58 generator.path = with pkgs; [ coreutils openssh ];
59 generator.script = ''
60 ssh-keygen -t ed25519 -N "" -f $secrets/ssh.id_ed25519
61 mv $secrets/ssh.id_ed25519.pub $facts/ssh.id_ed25519.pub
62 '';
63 };
64 }
65 {
66 users.extraUsers = {
67 root = {
68 openssh.authorizedKeys.keys = [
69 config.krebs.users.lass.pubkey
70 ];
71 };
72 mainUser = {
73 name = "lass";
74 uid = 1337;
75 home = "/home/lass";
76 group = "users";
77 createHome = true;
78 useDefaultShell = true;
79 isNormalUser = true;
80 extraGroups = [
81 "audio"
82 "video"
83 "fuse"
84 "wheel"
85 "tor"
86 ];
87 openssh.authorizedKeys.keys = [
88 config.krebs.users.lass.pubkey
89 ];
90 };
91 };
92 }
93 (let ca-bundle = "/etc/ssl/certs/ca-bundle.crt"; in {
94 environment.variables = {
95 CURL_CA_BUNDLE = ca-bundle;
96 GIT_SSL_CAINFO = ca-bundle;
97 SSL_CERT_FILE = ca-bundle;
98 };
99 })
100 {
101 #for sshuttle
102 environment.systemPackages = [
103 pkgs.python3Packages.python
104 ];
105 }
106 ];
107
108 networking.hostName = config.krebs.build.host.name;
109
110 krebs = {
111 enable = true;
112 build.user = config.krebs.users.lass;
113 ssl.trustIntermediate = true;
114 };
115
116 nix.settings.sandbox = true;
117
118 users.mutableUsers = false;
119
120 # multiple-definition-problem when defining environment.variables.EDITOR
121 environment.extraInit = ''
122 EDITOR=vim
123 '';
124
125 nixpkgs.config.allowUnfree = true;
126
127 environment.systemPackages = with pkgs; [
128 self.packages.${pkgs.system}.vim
129
130 #stockholm
131 git
132 git-absorb
133 git-preview
134 gnumake
135 jq
136 nix-output-monitor
137
138 #style
139 rxvt-unicode-unwrapped.terminfo
140 alacritty.terminfo
141
142 #monitoring tools
143 htop
144 iotop
145
146 #network
147 iptables
148 iftop
149 tcpdump
150 mosh
151 eternal-terminal
152 self.packages.${pkgs.system}.sshify
153
154 #stuff for dl
155 aria2
156
157 #neat utils
158 file
159 hashPassword
160 kpaste
161 cyberlocker-tools
162 pciutils
163 pop
164 q
165 rs
166 untilport
167 (pkgs.writeDashBin "urgent" ''
168 printf '\a'
169 '')
170 usbutils
171 self.packages.${pkgs.system}.logify
172 goify
173
174 #unpack stuff
175 libarchive
176
177 (pkgs.writeDashBin "sshn" ''
178 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
179 '')
180 ];
181
182 environment.shellAliases = {
183 ll = "ls -l";
184 la = "ls -la";
185 ls = "ls --color";
186 ip = "ip -color=auto";
187 grep = "grep --color=auto";
188 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
189 };
190
191 programs.bash = {
192 enableCompletion = true;
193 interactiveShellInit = ''
194 HISTCONTROL='erasedups:ignorespace'
195 HISTSIZE=65536
196 HISTFILESIZE=$HISTSIZE
197
198 shopt -s checkhash
199 shopt -s histappend histreedit histverify
200 shopt -s no_empty_cmd_completion
201 complete -d cd
202 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
203 '';
204 promptInit = ''
205 if test $UID = 0; then
206 PS1='\[\033[1;31m\]\w\[\033[0m\] '
207 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
208 elif test $UID = 1337; then
209 PS1='\[\033[1;32m\]\w\[\033[0m\] '
210 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
211 else
212 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
213 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
214 fi
215 if test -n "$SSH_CLIENT"; then
216 PS1='\[\033[35m\]\h'" $PS1"
217 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
218 fi
219 '';
220 };
221
222 services.journald.extraConfig = ''
223 SystemMaxUse=1G
224 RuntimeMaxUse=128M
225 Storage=persistent
226 '';
227
228 krebs.iptables = {
229 enable = true;
230 tables = {
231 filter.INPUT.policy = "DROP";
232 filter.FORWARD.policy = lib.mkDefault "DROP";
233 filter.INPUT.rules = lib.mkMerge [
234 (lib.mkBefore [
235 { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
236 { predicate = "-p icmp"; target = "ACCEPT"; }
237 { predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; }
238 { predicate = "-i lo"; target = "ACCEPT"; }
239 { predicate = "-p tcp --dport 22"; target = "ACCEPT"; }
240 ])
241 (lib.mkOrder 1000 [
242 { predicate = "-p udp --dport 60000:61000"; target = "ACCEPT"; } # mosh
243 { predicate = "-i retiolum -p udp -m udp --dport 53"; target = "ACCEPT"; }
244 { predicate = "-i retiolum -p tcp --dport 19999"; target = "ACCEPT"; }
245 ])
246 (lib.mkAfter [
247 { predicate = "-p tcp -i retiolum"; target = "REJECT --reject-with tcp-reset"; }
248 { predicate = "-p udp -i retiolum"; target = "REJECT --reject-with icmp-port-unreachable"; v6 = false; }
249 { predicate = "-i retiolum"; target = "REJECT --reject-with icmp-proto-unreachable"; v6 = false; }
250 ])
251 ];
252 };
253 };
254
255 networking.dhcpcd.extraConfig = ''
256 noipv4ll
257 '';
258
259 networking.extraHosts = ''
260 10.42.0.1 styx.gg23
261 '';
262
263 nix.settings.experimental-features = [
264 "nix-command"
265 "flakes"
266 ];
267
268 # use 24:00 time format, the default got sneakily changed around 20.03
269 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
270 time.timeZone = lib.mkDefault"Europe/Berlin";
271
272 # disable doc usually
273 documentation.nixos.enable = lib.mkDefault false;
274}