This repository has no description
9.6 kB
371 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 # Clan core configuration
10 clan.core.facts.secretStore = "password-store";
11 clan.core.facts.secretUploadDirectory = lib.mkDefault "/etc/secrets";
12 clan.core.vars.settings.secretStore = "password-store";
13 clan.core.vars.password-store.passPackage = self.packages.${pkgs.system}.pass;
14 clan.core.networking.targetHost = "root@${config.networking.hostName}";
15
16 # Stockholm configuration
17 krebs.secret.directory = config.clan.core.facts.secretUploadDirectory;
18
19 # Nixpkgs overlays
20 nixpkgs.overlays = [
21 self.inputs.stockholm.overlays.default
22 (import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
23 ];
24
25 imports = [
26 # Import 3modules
27 ../3modules
28
29 # Import stockholm krebs module
30 self.inputs.stockholm.nixosModules.krebs
31
32 # Import individual configurations
33 ./security-workarounds.nix
34 # ./binary-cache/client.nix
35 ./gc.nix
36 ./mc.nix
37 ./zsh.nix
38 ./htop.nix
39 ./wiregrill.nix
40 ./tor-ssh.nix
41 ./networkd.nix
42 ./pinned-registry.nix
43 ./zerotier.nix
44 ./nether.nix
45 ./nix.nix
46
47 # Import stockholm modules
48 self.inputs.stockholm.nixosModules.users
49 self.inputs.stockholm.nixosModules.hosts
50 self.inputs.stockholm.nixosModules.kartei
51 self.inputs.stockholm.nixosModules.build
52 self.inputs.stockholm.nixosModules.dns
53 self.inputs.stockholm.nixosModules.exim
54 self.inputs.stockholm.nixosModules.exim-retiolum
55 self.inputs.stockholm.nixosModules.tinc
56 self.inputs.stockholm.nixosModules.iptables
57 self.inputs.stockholm.nixosModules.power-action
58 self.inputs.stockholm.nixosModules.setuid
59 self.inputs.stockholm.nixosModules.secret
60 self.inputs.stockholm.nixosModules.sitemap
61 self.inputs.stockholm.nixosModules.ssl
62 self.inputs.stockholm.nixosModules.systemd
63 self.inputs.stockholm.nixosModules.ssh
64 self.inputs.stockholm.nixosModules.sync-containers3
65 {
66 # nix-index
67 imports = [
68 self.inputs.nix-index-database.nixosModules.nix-index
69 ];
70 programs.nix-index-database.comma.enable = true;
71 }
72 {
73 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
74 users.extraUsers.mainUser.hashedPasswordFile =
75 config.clan.core.vars.generators.password.files.passwordHash.path;
76 users.extraUsers.root.hashedPasswordFile =
77 config.clan.core.vars.generators.password.files.passwordHash.path;
78 boot.initrd.systemd.emergencyAccess = true;
79 clan.core.vars.generators.password = {
80 prompts.password = {
81 description = "Password for the main user";
82 type = "hidden";
83 };
84 files.password.deploy = false;
85 files.passwordHash.neededFor = "users";
86 migrateFact = "password";
87 runtimeInputs = with pkgs; [
88 coreutils
89 mkpasswd
90 ];
91 script = ''
92 cp $prompts/password $out/password
93 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
94 '';
95 };
96 }
97 {
98 services.openssh.enable = true;
99 services.openssh.hostKeys = [
100 {
101 path = config.clanCore.vars.generators.ssh.files."ssh.id_ed25519".path;
102 type = "ed25519";
103 }
104 ];
105 clan.core.vars.generators.ssh = {
106 files."ssh.id_ed25519".secret = true;
107 files."ssh.id_ed25519.pub".secret = false;
108 migrateFact = "ssh";
109 runtimeInputs = with pkgs; [
110 coreutils
111 openssh
112 ];
113 script = ''
114 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
115 '';
116 };
117 }
118 {
119 users.extraUsers = {
120 root = {
121 openssh.authorizedKeys.keys = [
122 self.keys.ssh.barnacle.public
123 self.keys.ssh.yubi_pgp.public
124 self.keys.ssh.yubi1.public
125 self.keys.ssh.yubi2.public
126 self.keys.ssh.solo2.public
127 ];
128 };
129 mainUser = {
130 name = "lass";
131 uid = 1337;
132 home = "/home/lass";
133 group = "users";
134 createHome = true;
135 useDefaultShell = true;
136 isNormalUser = true;
137 extraGroups = [
138 "audio"
139 "video"
140 "fuse"
141 "wheel"
142 "tor"
143 "dialout"
144 ];
145 openssh.authorizedKeys.keys = [
146 self.keys.ssh.barnacle.public
147 self.keys.ssh.yubi_pgp.public
148 self.keys.ssh.yubi1.public
149 self.keys.ssh.yubi2.public
150 self.keys.ssh.solo2.public
151 ];
152 };
153 };
154 }
155 (
156 let
157 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
158 in
159 {
160 environment.variables = {
161 CURL_CA_BUNDLE = ca-bundle;
162 GIT_SSL_CAINFO = ca-bundle;
163 SSL_CERT_FILE = ca-bundle;
164 };
165 }
166 )
167 {
168 #for sshuttle
169 environment.systemPackages = [
170 pkgs.python3Packages.python
171 ];
172 }
173 ];
174
175 networking.hostName = config.krebs.build.host.name;
176
177 krebs = {
178 enable = true;
179 build.user = config.krebs.users.lass;
180 ssl.trustIntermediate = true;
181 };
182
183 users.mutableUsers = false;
184
185 # multiple-definition-problem when defining environment.variables.EDITOR
186 environment.extraInit = ''
187 EDITOR=vim
188 '';
189
190 nixpkgs.config.allowUnfree = true;
191
192 environment.systemPackages = with pkgs; [
193 self.packages.${pkgs.system}.nvim
194 self.packages.${pkgs.system}.tmux
195
196 git
197 git-absorb
198 git-preview
199 gnumake
200 jq
201 nix-output-monitor
202 comma
203
204 #style
205 rxvt-unicode-unwrapped.terminfo
206 alacritty.terminfo
207
208 #monitoring tools
209 htop
210 iotop
211
212 #network
213 iptables
214 iftop
215 tcpdump
216 mosh
217 eternal-terminal
218 self.packages.${pkgs.system}.sshify
219
220 #stuff for dl
221 aria2
222
223 #neat utils
224 file
225 hashPassword
226 xkcdpass
227 kpaste
228 cyberlocker-tools
229 pciutils
230 pop
231 q
232 untilport
233 (pkgs.writeDashBin "urgent" ''
234 printf '\a'
235 '')
236 usbutils
237 self.packages.${pkgs.system}.logify
238 goify
239
240 #unpack stuff
241 libarchive
242
243 (pkgs.writeDashBin "sshn" ''
244 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
245 '')
246 ];
247
248 environment.shellAliases = {
249 ll = "ls -l";
250 la = "ls -la";
251 ls = "ls --color";
252 ip = "ip -color=auto";
253 grep = "grep --color=auto";
254 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
255 };
256
257 programs.bash = {
258 completion.enable = true;
259 interactiveShellInit = ''
260 HISTCONTROL='erasedups:ignorespace'
261 HISTSIZE=65536
262 HISTFILESIZE=$HISTSIZE
263
264 shopt -s checkhash
265 shopt -s histappend histreedit histverify
266 shopt -s no_empty_cmd_completion
267 complete -d cd
268 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
269 '';
270 promptInit = ''
271 if test $UID = 0; then
272 PS1='\[\033[1;31m\]\w\[\033[0m\] '
273 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
274 elif test $UID = 1337; then
275 PS1='\[\033[1;32m\]\w\[\033[0m\] '
276 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
277 else
278 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
279 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
280 fi
281 if test -n "$SSH_CLIENT"; then
282 PS1='\[\033[35m\]\h'" $PS1"
283 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
284 fi
285 '';
286 };
287
288 services.journald.extraConfig = ''
289 SystemMaxUse=1G
290 RuntimeMaxUse=128M
291 Storage=persistent
292 '';
293
294 krebs.iptables = {
295 enable = true;
296 tables = {
297 filter.INPUT.policy = "DROP";
298 filter.FORWARD.policy = lib.mkDefault "DROP";
299 filter.INPUT.rules = lib.mkMerge [
300 (lib.mkBefore [
301 {
302 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
303 target = "ACCEPT";
304 }
305 {
306 predicate = "-p icmp";
307 target = "ACCEPT";
308 }
309 {
310 predicate = "-p ipv6-icmp";
311 target = "ACCEPT";
312 v4 = false;
313 }
314 {
315 predicate = "-i lo";
316 target = "ACCEPT";
317 }
318 {
319 predicate = "-p tcp --dport 22";
320 target = "ACCEPT";
321 }
322 ])
323 (lib.mkOrder 1000 [
324 {
325 predicate = "-p udp --dport 60000:61000";
326 target = "ACCEPT";
327 } # mosh
328 {
329 predicate = "-i retiolum -p udp -m udp --dport 53";
330 target = "ACCEPT";
331 }
332 {
333 predicate = "-i retiolum -p tcp --dport 19999";
334 target = "ACCEPT";
335 }
336 ])
337 (lib.mkAfter [
338 {
339 predicate = "-p tcp -i retiolum";
340 target = "REJECT --reject-with tcp-reset";
341 }
342 {
343 predicate = "-p udp -i retiolum";
344 target = "REJECT --reject-with icmp-port-unreachable";
345 v6 = false;
346 }
347 {
348 predicate = "-i retiolum";
349 target = "REJECT --reject-with icmp-proto-unreachable";
350 v6 = false;
351 }
352 ])
353 ];
354 };
355 };
356
357 networking.extraHosts = ''
358 10.42.0.1 styx.gg23
359 '';
360
361 # use 24:00 time format, the default got sneakily changed around 20.03
362 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
363 time.timeZone = lib.mkDefault "Europe/Berlin";
364
365 # disable doc usually
366 documentation.nixos.enable = lib.mkDefault false;
367
368 # use latest nix to hunt all the bugs
369 nix.package = pkgs.nixVersions.latest;
370
371}