This repository has no description
7.8 kB
303 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9 selfPkgs = self.packages.${pkgs.stdenv.hostPlatform.system};
10in
11{
12
13 imports = [
14 # Import modules
15 ../modules
16
17 # Import individual configurations
18 ./security-workarounds.nix
19 ./gc.nix
20 ./mc.nix
21 ./zsh.nix
22 ./htop.nix
23 ./tor-ssh.nix
24 ./networkd.nix
25 ./pinned-registry.nix
26 ./nix.nix
27
28 ./kartei.nix
29 {
30 # nix-index
31 imports = [
32 self.inputs.nix-index-database.nixosModules.nix-index
33 ];
34 programs.nix-index-database.comma.enable = true;
35 }
36 {
37 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
38 users.extraUsers.mainUser.hashedPasswordFile =
39 config.clan.core.vars.generators.password.files.passwordHash.path;
40 users.extraUsers.root.hashedPasswordFile =
41 config.clan.core.vars.generators.password.files.passwordHash.path;
42 boot.initrd.systemd.emergencyAccess = true;
43 clan.core.vars.generators.password = {
44 prompts.password = {
45 description = "Password for the main user";
46 type = "hidden";
47 };
48 files.password.deploy = false;
49 files.passwordHash.neededFor = "users";
50 runtimeInputs = with pkgs; [
51 coreutils
52 mkpasswd
53 ];
54 script = ''
55 cp $prompts/password $out/password
56 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
57 '';
58 };
59 }
60 {
61 services.openssh.enable = true;
62 services.openssh.settings.PasswordAuthentication = false;
63 services.openssh.hostKeys = [
64 {
65 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
66 type = "ed25519";
67 }
68 ];
69 clan.core.vars.generators.ssh = {
70 files."ssh.id_ed25519" = { };
71 files."ssh.id_ed25519.pub".secret = false;
72 runtimeInputs = with pkgs; [
73 coreutils
74 openssh
75 ];
76 script = ''
77 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
78 '';
79 };
80 }
81 {
82 users.extraUsers = {
83 root = {
84 openssh.authorizedKeys.keys = [
85 self.keys.ssh.barnacle.public
86 self.keys.ssh.yubi_pgp.public
87 self.keys.ssh.termux_massulus.public
88 self.keys.ssh.yubi1.public
89 self.keys.ssh.yubi2.public
90 self.keys.ssh.solo2.public
91 self.keys.ssh.xerxes.public
92 self.keys.ssh.ignavia.public
93 ];
94 };
95 mainUser = {
96 name = "lass";
97 uid = 1337;
98 home = "/home/lass";
99 group = "users";
100 createHome = true;
101 useDefaultShell = true;
102 isNormalUser = true;
103 linger = true;
104 extraGroups = [
105 "audio"
106 "video"
107 "fuse"
108 "wheel"
109 "tor"
110 "dialout"
111 ];
112 openssh.authorizedKeys.keys = [
113 self.keys.ssh.barnacle.public
114 self.keys.ssh.yubi_pgp.public
115 self.keys.ssh.termux_massulus.public
116 self.keys.ssh.yubi1.public
117 self.keys.ssh.yubi2.public
118 self.keys.ssh.solo2.public
119 self.keys.ssh.xerxes.public
120 self.keys.ssh.ignavia.public
121 ];
122 };
123 };
124 }
125 (
126 let
127 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
128 in
129 {
130 environment.variables = {
131 CURL_CA_BUNDLE = ca-bundle;
132 GIT_SSL_CAINFO = ca-bundle;
133 SSL_CERT_FILE = ca-bundle;
134 };
135 }
136 )
137 {
138 #for sshuttle
139 environment.systemPackages = [
140 pkgs.python3Packages.python
141 ];
142 }
143 ];
144
145 networking.hostName = config.clan.core.settings.machine.name;
146
147 users.mutableUsers = false;
148
149 # multiple-definition-problem when defining environment.variables.EDITOR
150 environment.extraInit = ''
151 EDITOR=vim
152 '';
153
154 nixpkgs.config.allowUnfree = true;
155
156 environment.systemPackages = with pkgs; [
157 self.packages.${pkgs.system}.nvim
158 self.packages.${pkgs.system}.tmux
159 self.packages.${pkgs.system}.s
160
161 git
162 git-absorb
163 gnumake
164 jq
165 nix-output-monitor
166 comma
167
168 #style
169 rxvt-unicode-unwrapped.terminfo
170 alacritty.terminfo
171
172 #monitoring tools
173 htop
174 iotop
175
176 #network
177 iptables
178 iftop
179 tcpdump
180 mosh
181 eternal-terminal
182 self.packages.${pkgs.system}.sshify
183
184 #stuff for dl
185 aria2
186
187 #neat utils
188 file
189 xkcdpass
190 selfPkgs.kpaste
191 selfPkgs.cyberlocker-tools
192 pciutils
193 pop
194 selfPkgs.untilport
195 (pkgs.writers.writeDashBin "urgent" ''
196 printf '\a'
197 '')
198 usbutils
199
200 #unpack stuff
201 libarchive
202
203 (pkgs.writers.writeDashBin "sshn" ''
204 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
205 '')
206 ];
207
208 environment.shellAliases = {
209 ll = "ls -l";
210 la = "ls -la";
211 ls = "ls --color";
212 ip = "ip -color=auto";
213 grep = "grep --color=auto";
214 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
215 };
216
217 programs.bash = {
218 completion.enable = true;
219 interactiveShellInit = ''
220 HISTCONTROL='erasedups:ignorespace'
221 HISTSIZE=65536
222 HISTFILESIZE=$HISTSIZE
223
224 shopt -s checkhash
225 shopt -s histappend histreedit histverify
226 shopt -s no_empty_cmd_completion
227 complete -d cd
228 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
229 '';
230 promptInit = ''
231 if test $UID = 0; then
232 PS1='\[\033[1;31m\]\w\[\033[0m\] '
233 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
234 elif test $UID = 1337; then
235 PS1='\[\033[1;32m\]\w\[\033[0m\] '
236 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
237 else
238 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
239 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
240 fi
241 if test -n "$SSH_CLIENT"; then
242 PS1='\[\033[35m\]\h'" $PS1"
243 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
244 fi
245 '';
246 };
247
248 services.journald.settings.Journal = {
249 SystemMaxUse = "1G";
250 RuntimeMaxUse = "128M";
251 Storage = "persistent";
252 };
253
254 # nftables based NixOS firewall. Input and forward drop by default, as
255 # krebs.iptables did; no reverse path filter either, the routers,
256 # container hosts and NAT64 boxes route asymmetrically.
257 networking.nftables = {
258 enable = true;
259 # Defaults to true on machines older than 23.11, which would also wipe
260 # the tables libvirt, podman and jool keep on every reload.
261 flushRuleset = false;
262 # krebs.iptables loaded its rules through iptables-nft into these
263 # tables; nothing removes them when it goes away. Drop once every
264 # machine has switched to nftables.
265 extraDeletions = ''
266 table ip filter
267 delete table ip filter
268 table ip6 filter
269 delete table ip6 filter
270 table ip nat
271 delete table ip nat
272 table ip6 nat
273 delete table ip6 nat
274 '';
275 };
276 networking.firewall = {
277 filterForward = lib.mkDefault true;
278 checkReversePath = false;
279 # all of ICMP, not just echo-request, like krebs.iptables
280 extraInputRules = ''
281 meta l4proto icmp accept
282 '';
283 };
284
285 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
286 networking.firewall.allowedUDPPortRanges = [
287 {
288 from = 60000;
289 to = 61000;
290 }
291 ]; # mosh
292 networking.extraHosts = ''
293 10.42.0.1 acheron.gg23
294 10.42.0.3 styx.gg23
295 '';
296
297 # use 24:00 time format, the default got sneakily changed around 20.03
298 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
299 time.timeZone = lib.mkDefault "Europe/Berlin";
300
301 # disable doc usually
302 documentation.nixos.enable = lib.mkDefault false;
303}