This repository has no description
8.5 kB
335 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 # Clan core configuration
10 clan.core.vars.settings.secretStore = "password-store";
11
12 # Stockholm configuration
13 krebs.secret.directory = config.clan.core.vars.password-store.secretLocation;
14
15 # Nixpkgs overlays
16 nixpkgs.overlays = [
17 self.inputs.stockholm.overlays.default
18 (import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
19 ];
20
21 imports = [
22 # Import 3modules
23 ../3modules
24
25 # Import stockholm krebs module
26 self.inputs.stockholm.nixosModules.krebs
27
28 # Import individual configurations
29 ./security-workarounds.nix
30 # ./binary-cache/client.nix
31 ./gc.nix
32 ./mc.nix
33 ./zsh.nix
34 ./htop.nix
35 ./tor-ssh.nix
36 ./networkd.nix
37 ./pinned-registry.nix
38 ./zerotier.nix
39 ./nether.nix
40 ./nix.nix
41
42 # Import stockholm modules
43 self.inputs.stockholm.nixosModules.users
44 self.inputs.stockholm.nixosModules.hosts
45 self.inputs.stockholm.nixosModules.kartei
46 self.inputs.stockholm.nixosModules.build
47 self.inputs.stockholm.nixosModules.dns
48 self.inputs.stockholm.nixosModules.exim
49 self.inputs.stockholm.nixosModules.exim-retiolum
50 self.inputs.stockholm.nixosModules.tinc
51 self.inputs.stockholm.nixosModules.iptables
52 self.inputs.stockholm.nixosModules.power-action
53 self.inputs.stockholm.nixosModules.setuid
54 self.inputs.stockholm.nixosModules.secret
55 self.inputs.stockholm.nixosModules.sitemap
56 self.inputs.stockholm.nixosModules.ssl
57 self.inputs.stockholm.nixosModules.systemd
58 self.inputs.stockholm.nixosModules.ssh
59 self.inputs.stockholm.nixosModules.sync-containers3
60 {
61 # nix-index
62 imports = [
63 self.inputs.nix-index-database.nixosModules.nix-index
64 ];
65 programs.nix-index-database.comma.enable = true;
66 }
67 {
68 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
69 users.extraUsers.mainUser.hashedPasswordFile =
70 config.clan.core.vars.generators.password.files.passwordHash.path;
71 users.extraUsers.root.hashedPasswordFile =
72 config.clan.core.vars.generators.password.files.passwordHash.path;
73 boot.initrd.systemd.emergencyAccess = true;
74 clan.core.vars.generators.password = {
75 prompts.password = {
76 description = "Password for the main user";
77 type = "hidden";
78 };
79 files.password.deploy = false;
80 files.passwordHash.neededFor = "users";
81 runtimeInputs = with pkgs; [
82 coreutils
83 mkpasswd
84 ];
85 script = ''
86 cp $prompts/password $out/password
87 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
88 '';
89 };
90 }
91 {
92 services.openssh.enable = true;
93 services.openssh.settings.PasswordAuthentication = false;
94 services.openssh.hostKeys = [
95 {
96 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
97 type = "ed25519";
98 }
99 ];
100 clan.core.vars.generators.ssh = {
101 files."ssh.id_ed25519" = { };
102 files."ssh.id_ed25519.pub".secret = false;
103 runtimeInputs = with pkgs; [
104 coreutils
105 openssh
106 ];
107 script = ''
108 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
109 '';
110 };
111 }
112 {
113 users.extraUsers = {
114 root = {
115 openssh.authorizedKeys.keys = [
116 self.keys.ssh.barnacle.public
117 self.keys.ssh.yubi_pgp.public
118 self.keys.ssh.yubi1.public
119 self.keys.ssh.yubi2.public
120 self.keys.ssh.solo2.public
121 self.keys.ssh.xerxes.public
122 ];
123 };
124 mainUser = {
125 name = "lass";
126 uid = 1337;
127 home = "/home/lass";
128 group = "users";
129 createHome = true;
130 useDefaultShell = true;
131 isNormalUser = true;
132 extraGroups = [
133 "audio"
134 "video"
135 "fuse"
136 "wheel"
137 "tor"
138 "dialout"
139 ];
140 openssh.authorizedKeys.keys = [
141 self.keys.ssh.barnacle.public
142 self.keys.ssh.yubi_pgp.public
143 self.keys.ssh.yubi1.public
144 self.keys.ssh.yubi2.public
145 self.keys.ssh.solo2.public
146 self.keys.ssh.xerxes.public
147 ];
148 };
149 };
150 }
151 (
152 let
153 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
154 in
155 {
156 environment.variables = {
157 CURL_CA_BUNDLE = ca-bundle;
158 GIT_SSL_CAINFO = ca-bundle;
159 SSL_CERT_FILE = ca-bundle;
160 };
161 }
162 )
163 {
164 #for sshuttle
165 environment.systemPackages = [
166 pkgs.python3Packages.python
167 ];
168 }
169 ];
170
171 networking.hostName = config.krebs.build.host.name;
172
173 krebs = {
174 enable = true;
175 build.user = config.krebs.users.lass;
176 ssl.trustIntermediate = true;
177 };
178
179 users.mutableUsers = false;
180
181 # multiple-definition-problem when defining environment.variables.EDITOR
182 environment.extraInit = ''
183 EDITOR=vim
184 '';
185
186 nixpkgs.config.allowUnfree = true;
187
188 environment.systemPackages = with pkgs; [
189 self.packages.${pkgs.system}.nvim
190 self.packages.${pkgs.system}.tmux
191
192 git
193 git-absorb
194 git-preview
195 gnumake
196 jq
197 nix-output-monitor
198 comma
199
200 #style
201 rxvt-unicode-unwrapped.terminfo
202 alacritty.terminfo
203
204 #monitoring tools
205 htop
206 iotop
207
208 #network
209 iptables
210 iftop
211 tcpdump
212 mosh
213 eternal-terminal
214 self.packages.${pkgs.system}.sshify
215
216 #stuff for dl
217 aria2
218
219 #neat utils
220 file
221 hashPassword
222 xkcdpass
223 kpaste
224 cyberlocker-tools
225 pciutils
226 pop
227 q
228 untilport
229 (pkgs.writeDashBin "urgent" ''
230 printf '\a'
231 '')
232 usbutils
233 goify
234
235 #unpack stuff
236 libarchive
237
238 (pkgs.writeDashBin "sshn" ''
239 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
240 '')
241 ];
242
243 environment.shellAliases = {
244 ll = "ls -l";
245 la = "ls -la";
246 ls = "ls --color";
247 ip = "ip -color=auto";
248 grep = "grep --color=auto";
249 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
250 };
251
252 programs.bash = {
253 completion.enable = true;
254 interactiveShellInit = ''
255 HISTCONTROL='erasedups:ignorespace'
256 HISTSIZE=65536
257 HISTFILESIZE=$HISTSIZE
258
259 shopt -s checkhash
260 shopt -s histappend histreedit histverify
261 shopt -s no_empty_cmd_completion
262 complete -d cd
263 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
264 '';
265 promptInit = ''
266 if test $UID = 0; then
267 PS1='\[\033[1;31m\]\w\[\033[0m\] '
268 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
269 elif test $UID = 1337; then
270 PS1='\[\033[1;32m\]\w\[\033[0m\] '
271 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
272 else
273 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
274 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
275 fi
276 if test -n "$SSH_CLIENT"; then
277 PS1='\[\033[35m\]\h'" $PS1"
278 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
279 fi
280 '';
281 };
282
283 services.journald.extraConfig = ''
284 SystemMaxUse=1G
285 RuntimeMaxUse=128M
286 Storage=persistent
287 '';
288
289 krebs.iptables = {
290 enable = true;
291 tables = {
292 filter.INPUT.policy = "DROP";
293 filter.FORWARD.policy = lib.mkDefault "DROP";
294 filter.INPUT.rules = lib.mkMerge [
295 (lib.mkBefore [
296 {
297 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
298 target = "ACCEPT";
299 }
300 {
301 predicate = "-p icmp";
302 target = "ACCEPT";
303 }
304 {
305 predicate = "-p ipv6-icmp";
306 target = "ACCEPT";
307 v4 = false;
308 }
309 {
310 predicate = "-i lo";
311 target = "ACCEPT";
312 }
313 ])
314 ];
315 };
316 };
317
318 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
319 networking.firewall.allowedUDPPortRanges = [
320 {
321 from = 60000;
322 to = 61000;
323 }
324 ]; # mosh
325 networking.extraHosts = ''
326 10.42.0.1 styx.gg23
327 '';
328
329 # use 24:00 time format, the default got sneakily changed around 20.03
330 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
331 time.timeZone = lib.mkDefault "Europe/Berlin";
332
333 # disable doc usually
334 documentation.nixos.enable = lib.mkDefault false;
335}