This repository has no description
8.6 kB
346 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 imports = [
10 ./security-workarounds.nix
11 # ./binary-cache/client.nix
12 ./gc.nix
13 ./mc.nix
14 ./zsh.nix
15 ./htop.nix
16 ./wiregrill.nix
17 ./tmux.nix
18 ./tor-ssh.nix
19 ./networkd.nix
20 ./pinned-registry.nix
21 ./zerotier.nix
22 ./nether.nix
23 ./spora.nix
24 ./nix.nix
25 self.inputs.stockholm.nixosModules.users
26 self.inputs.stockholm.nixosModules.hosts
27 self.inputs.stockholm.nixosModules.kartei
28 self.inputs.stockholm.nixosModules.build
29 self.inputs.stockholm.nixosModules.dns
30 self.inputs.stockholm.nixosModules.exim
31 self.inputs.stockholm.nixosModules.exim-retiolum
32 self.inputs.stockholm.nixosModules.tinc
33 self.inputs.stockholm.nixosModules.iptables
34 self.inputs.stockholm.nixosModules.power-action
35 self.inputs.stockholm.nixosModules.setuid
36 self.inputs.stockholm.nixosModules.secret
37 self.inputs.stockholm.nixosModules.sitemap
38 self.inputs.stockholm.nixosModules.ssl
39 self.inputs.stockholm.nixosModules.systemd
40 self.inputs.stockholm.nixosModules.xresources
41 self.inputs.stockholm.nixosModules.ssh
42 self.inputs.stockholm.nixosModules.sync-containers3
43 { # nix-index
44 imports = [
45 self.inputs.nix-index-database.nixosModules.nix-index
46 ];
47 programs.nix-index-database.comma.enable = true;
48 }
49 {
50 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
51 users.extraUsers.mainUser.hashedPasswordFile =
52 config.clan.core.vars.generators.password.files.passwordHash.path;
53 users.extraUsers.root.hashedPasswordFile =
54 config.clan.core.vars.generators.password.files.passwordHash.path;
55 boot.initrd.systemd.emergencyAccess = true;
56 clan.core.vars.generators.password = {
57 prompts.password = {
58 description = "Password for the main user";
59 type = "hidden";
60 };
61 files.password.deploy = false;
62 files.passwordHash.neededFor = "users";
63 migrateFact = "password";
64 runtimeInputs = with pkgs; [
65 coreutils
66 mkpasswd
67 ];
68 script = ''
69 cp $prompts/password $out/password
70 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
71 '';
72 };
73 }
74 {
75 services.openssh.enable = true;
76 services.openssh.hostKeys = [
77 {
78 path = config.clanCore.vars.generators.ssh.files."ssh.id_ed25519".path;
79 type = "ed25519";
80 }
81 ];
82 clan.core.vars.generators.ssh = {
83 files."ssh.id_ed25519".secret = true;
84 files."ssh.id_ed25519.pub".secret = false;
85 migrateFact = "ssh";
86 runtimeInputs = with pkgs; [
87 coreutils
88 openssh
89 ];
90 script = ''
91 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
92 '';
93 };
94 }
95 {
96 users.extraUsers = {
97 root = {
98 openssh.authorizedKeys.keys = [
99 config.krebs.users.lass.pubkey
100 ];
101 };
102 mainUser = {
103 name = "lass";
104 uid = 1337;
105 home = "/home/lass";
106 group = "users";
107 createHome = true;
108 useDefaultShell = true;
109 isNormalUser = true;
110 extraGroups = [
111 "audio"
112 "video"
113 "fuse"
114 "wheel"
115 "tor"
116 "dialout"
117 ];
118 openssh.authorizedKeys.keys = [
119 config.krebs.users.lass.pubkey
120 ];
121 };
122 };
123 }
124 (
125 let
126 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
127 in
128 {
129 environment.variables = {
130 CURL_CA_BUNDLE = ca-bundle;
131 GIT_SSL_CAINFO = ca-bundle;
132 SSL_CERT_FILE = ca-bundle;
133 };
134 }
135 )
136 {
137 #for sshuttle
138 environment.systemPackages = [
139 pkgs.python3Packages.python
140 ];
141 }
142 ];
143
144 networking.hostName = config.krebs.build.host.name;
145
146 krebs = {
147 enable = true;
148 build.user = config.krebs.users.lass;
149 ssl.trustIntermediate = true;
150 };
151
152 users.mutableUsers = false;
153
154 # multiple-definition-problem when defining environment.variables.EDITOR
155 environment.extraInit = ''
156 EDITOR=vim
157 '';
158
159 nixpkgs.config.allowUnfree = true;
160
161 environment.systemPackages = with pkgs; [
162 self.packages.${pkgs.system}.nvim
163
164 git
165 git-absorb
166 git-preview
167 gnumake
168 jq
169 nix-output-monitor
170 comma
171
172 #style
173 rxvt-unicode-unwrapped.terminfo
174 alacritty.terminfo
175
176 #monitoring tools
177 htop
178 iotop
179
180 #network
181 iptables
182 iftop
183 tcpdump
184 mosh
185 eternal-terminal
186 self.packages.${pkgs.system}.sshify
187
188 #stuff for dl
189 aria2
190
191 #neat utils
192 file
193 hashPassword
194 xkcdpass
195 kpaste
196 cyberlocker-tools
197 pciutils
198 pop
199 q
200 untilport
201 (pkgs.writeDashBin "urgent" ''
202 printf '\a'
203 '')
204 usbutils
205 self.packages.${pkgs.system}.logify
206 goify
207
208 #unpack stuff
209 libarchive
210
211 (pkgs.writeDashBin "sshn" ''
212 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
213 '')
214 ];
215
216 environment.shellAliases = {
217 ll = "ls -l";
218 la = "ls -la";
219 ls = "ls --color";
220 ip = "ip -color=auto";
221 grep = "grep --color=auto";
222 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
223 };
224
225 programs.bash = {
226 completion.enable = true;
227 interactiveShellInit = ''
228 HISTCONTROL='erasedups:ignorespace'
229 HISTSIZE=65536
230 HISTFILESIZE=$HISTSIZE
231
232 shopt -s checkhash
233 shopt -s histappend histreedit histverify
234 shopt -s no_empty_cmd_completion
235 complete -d cd
236 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
237 '';
238 promptInit = ''
239 if test $UID = 0; then
240 PS1='\[\033[1;31m\]\w\[\033[0m\] '
241 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
242 elif test $UID = 1337; then
243 PS1='\[\033[1;32m\]\w\[\033[0m\] '
244 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
245 else
246 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
247 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
248 fi
249 if test -n "$SSH_CLIENT"; then
250 PS1='\[\033[35m\]\h'" $PS1"
251 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
252 fi
253 '';
254 };
255
256 services.journald.extraConfig = ''
257 SystemMaxUse=1G
258 RuntimeMaxUse=128M
259 Storage=persistent
260 '';
261
262 krebs.iptables = {
263 enable = true;
264 tables = {
265 filter.INPUT.policy = "DROP";
266 filter.FORWARD.policy = lib.mkDefault "DROP";
267 filter.INPUT.rules = lib.mkMerge [
268 (lib.mkBefore [
269 {
270 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
271 target = "ACCEPT";
272 }
273 {
274 predicate = "-p icmp";
275 target = "ACCEPT";
276 }
277 {
278 predicate = "-p ipv6-icmp";
279 target = "ACCEPT";
280 v4 = false;
281 }
282 {
283 predicate = "-i lo";
284 target = "ACCEPT";
285 }
286 {
287 predicate = "-p tcp --dport 22";
288 target = "ACCEPT";
289 }
290 ])
291 (lib.mkOrder 1000 [
292 {
293 predicate = "-p udp --dport 60000:61000";
294 target = "ACCEPT";
295 } # mosh
296 {
297 predicate = "-i retiolum -p udp -m udp --dport 53";
298 target = "ACCEPT";
299 }
300 {
301 predicate = "-i retiolum -p tcp --dport 19999";
302 target = "ACCEPT";
303 }
304 ])
305 (lib.mkAfter [
306 {
307 predicate = "-p tcp -i retiolum";
308 target = "REJECT --reject-with tcp-reset";
309 }
310 {
311 predicate = "-p udp -i retiolum";
312 target = "REJECT --reject-with icmp-port-unreachable";
313 v6 = false;
314 }
315 {
316 predicate = "-i retiolum";
317 target = "REJECT --reject-with icmp-proto-unreachable";
318 v6 = false;
319 }
320 ])
321 ];
322 };
323 };
324
325
326 networking.extraHosts = ''
327 10.42.0.1 styx.gg23
328 '';
329
330 # use 24:00 time format, the default got sneakily changed around 20.03
331 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
332 time.timeZone = lib.mkDefault "Europe/Berlin";
333
334 # disable doc usually
335 documentation.nixos.enable = lib.mkDefault false;
336
337 # use new rebuild switch
338 system.switch = {
339 enable = false;
340 enableNg = true;
341 };
342
343 # use latest nix to hunt all the bugs
344 nix.package = pkgs.nixVersions.latest;
345
346}