This repository has no description
8.4 kB
331 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 # Stockholm configuration
10 krebs.secret.directory = config.clan.core.vars.password-store.secretLocation;
11
12 # Nixpkgs overlays
13 nixpkgs.overlays = [
14 self.inputs.stockholm.overlays.default
15 (import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
16 ];
17
18 imports = [
19 # Import 3modules
20 ../3modules
21
22 # Import stockholm krebs module
23 self.inputs.stockholm.nixosModules.krebs
24
25 # Import individual configurations
26 ./security-workarounds.nix
27 # ./binary-cache/client.nix
28 ./gc.nix
29 ./mc.nix
30 ./zsh.nix
31 ./htop.nix
32 ./tor-ssh.nix
33 ./networkd.nix
34 ./pinned-registry.nix
35 ./zerotier.nix
36 ./nether.nix
37 ./nix.nix
38
39 # Import stockholm modules
40 self.inputs.stockholm.nixosModules.users
41 self.inputs.stockholm.nixosModules.hosts
42 self.inputs.stockholm.nixosModules.kartei
43 self.inputs.stockholm.nixosModules.build
44 self.inputs.stockholm.nixosModules.dns
45 self.inputs.stockholm.nixosModules.exim
46 self.inputs.stockholm.nixosModules.exim-retiolum
47 self.inputs.stockholm.nixosModules.tinc
48 self.inputs.stockholm.nixosModules.iptables
49 self.inputs.stockholm.nixosModules.setuid
50 self.inputs.stockholm.nixosModules.secret
51 self.inputs.stockholm.nixosModules.sitemap
52 self.inputs.stockholm.nixosModules.ssl
53 self.inputs.stockholm.nixosModules.systemd
54 self.inputs.stockholm.nixosModules.ssh
55 {
56 # nix-index
57 imports = [
58 self.inputs.nix-index-database.nixosModules.nix-index
59 ];
60 programs.nix-index-database.comma.enable = true;
61 }
62 {
63 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
64 users.extraUsers.mainUser.hashedPasswordFile =
65 config.clan.core.vars.generators.password.files.passwordHash.path;
66 users.extraUsers.root.hashedPasswordFile =
67 config.clan.core.vars.generators.password.files.passwordHash.path;
68 boot.initrd.systemd.emergencyAccess = true;
69 clan.core.vars.generators.password = {
70 prompts.password = {
71 description = "Password for the main user";
72 type = "hidden";
73 };
74 files.password.deploy = false;
75 files.passwordHash.neededFor = "users";
76 runtimeInputs = with pkgs; [
77 coreutils
78 mkpasswd
79 ];
80 script = ''
81 cp $prompts/password $out/password
82 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
83 '';
84 };
85 }
86 {
87 services.openssh.enable = true;
88 services.openssh.settings.PasswordAuthentication = false;
89 services.openssh.hostKeys = [
90 {
91 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
92 type = "ed25519";
93 }
94 ];
95 clan.core.vars.generators.ssh = {
96 files."ssh.id_ed25519" = { };
97 files."ssh.id_ed25519.pub".secret = false;
98 runtimeInputs = with pkgs; [
99 coreutils
100 openssh
101 ];
102 script = ''
103 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
104 '';
105 };
106 }
107 {
108 users.extraUsers = {
109 root = {
110 openssh.authorizedKeys.keys = [
111 self.keys.ssh.barnacle.public
112 self.keys.ssh.yubi_pgp.public
113 self.keys.ssh.yubi1.public
114 self.keys.ssh.yubi2.public
115 self.keys.ssh.solo2.public
116 self.keys.ssh.xerxes.public
117 self.keys.ssh.massulus.public
118 ];
119 };
120 mainUser = {
121 name = "lass";
122 uid = 1337;
123 home = "/home/lass";
124 group = "users";
125 createHome = true;
126 useDefaultShell = true;
127 isNormalUser = true;
128 extraGroups = [
129 "audio"
130 "video"
131 "fuse"
132 "wheel"
133 "tor"
134 "dialout"
135 ];
136 openssh.authorizedKeys.keys = [
137 self.keys.ssh.barnacle.public
138 self.keys.ssh.yubi_pgp.public
139 self.keys.ssh.yubi1.public
140 self.keys.ssh.yubi2.public
141 self.keys.ssh.solo2.public
142 self.keys.ssh.xerxes.public
143 self.keys.ssh.massulus.public
144 ];
145 };
146 };
147 }
148 (
149 let
150 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
151 in
152 {
153 environment.variables = {
154 CURL_CA_BUNDLE = ca-bundle;
155 GIT_SSL_CAINFO = ca-bundle;
156 SSL_CERT_FILE = ca-bundle;
157 };
158 }
159 )
160 {
161 #for sshuttle
162 environment.systemPackages = [
163 pkgs.python3Packages.python
164 ];
165 }
166 ];
167
168 networking.hostName = config.krebs.build.host.name;
169
170 krebs = {
171 enable = true;
172 build.user = config.krebs.users.lass;
173 ssl.trustIntermediate = true;
174 };
175
176 users.mutableUsers = false;
177
178 # multiple-definition-problem when defining environment.variables.EDITOR
179 environment.extraInit = ''
180 EDITOR=vim
181 '';
182
183 nixpkgs.config.allowUnfree = true;
184
185 environment.systemPackages = with pkgs; [
186 self.packages.${pkgs.system}.nvim
187 self.packages.${pkgs.system}.tmux
188
189 git
190 git-absorb
191 git-preview
192 gnumake
193 jq
194 nix-output-monitor
195 comma
196
197 #style
198 rxvt-unicode-unwrapped.terminfo
199 alacritty.terminfo
200
201 #monitoring tools
202 htop
203 iotop
204
205 #network
206 iptables
207 iftop
208 tcpdump
209 mosh
210 eternal-terminal
211 self.packages.${pkgs.system}.sshify
212
213 #stuff for dl
214 aria2
215
216 #neat utils
217 file
218 xkcdpass
219 kpaste
220 cyberlocker-tools
221 pciutils
222 pop
223 q
224 untilport
225 (pkgs.writeDashBin "urgent" ''
226 printf '\a'
227 '')
228 usbutils
229 goify
230
231 #unpack stuff
232 libarchive
233
234 (pkgs.writeDashBin "sshn" ''
235 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
236 '')
237 ];
238
239 environment.shellAliases = {
240 ll = "ls -l";
241 la = "ls -la";
242 ls = "ls --color";
243 ip = "ip -color=auto";
244 grep = "grep --color=auto";
245 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
246 };
247
248 programs.bash = {
249 completion.enable = true;
250 interactiveShellInit = ''
251 HISTCONTROL='erasedups:ignorespace'
252 HISTSIZE=65536
253 HISTFILESIZE=$HISTSIZE
254
255 shopt -s checkhash
256 shopt -s histappend histreedit histverify
257 shopt -s no_empty_cmd_completion
258 complete -d cd
259 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
260 '';
261 promptInit = ''
262 if test $UID = 0; then
263 PS1='\[\033[1;31m\]\w\[\033[0m\] '
264 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
265 elif test $UID = 1337; then
266 PS1='\[\033[1;32m\]\w\[\033[0m\] '
267 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
268 else
269 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
270 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
271 fi
272 if test -n "$SSH_CLIENT"; then
273 PS1='\[\033[35m\]\h'" $PS1"
274 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
275 fi
276 '';
277 };
278
279 services.journald.extraConfig = ''
280 SystemMaxUse=1G
281 RuntimeMaxUse=128M
282 Storage=persistent
283 '';
284
285 krebs.iptables = {
286 enable = true;
287 tables = {
288 filter.INPUT.policy = "DROP";
289 filter.FORWARD.policy = lib.mkDefault "DROP";
290 filter.INPUT.rules = lib.mkMerge [
291 (lib.mkBefore [
292 {
293 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
294 target = "ACCEPT";
295 }
296 {
297 predicate = "-p icmp";
298 target = "ACCEPT";
299 }
300 {
301 predicate = "-p ipv6-icmp";
302 target = "ACCEPT";
303 v4 = false;
304 }
305 {
306 predicate = "-i lo";
307 target = "ACCEPT";
308 }
309 ])
310 ];
311 };
312 };
313
314 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
315 networking.firewall.allowedUDPPortRanges = [
316 {
317 from = 60000;
318 to = 61000;
319 }
320 ]; # mosh
321 networking.extraHosts = ''
322 10.42.0.1 styx.gg23
323 '';
324
325 # use 24:00 time format, the default got sneakily changed around 20.03
326 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
327 time.timeZone = lib.mkDefault "Europe/Berlin";
328
329 # disable doc usually
330 documentation.nixos.enable = lib.mkDefault false;
331}