This repository has no description
9.7 kB
380 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 imports = [
10 ./security-workarounds.nix
11 # ./binary-cache/client.nix
12 ./gc.nix
13 ./mc.nix
14 ./zsh.nix
15 ./htop.nix
16 ./wiregrill.nix
17 ./tmux.nix
18 ./tor-ssh.nix
19 ./networkd.nix
20 ./pinned-registry.nix
21 ./zerotier.nix
22 ./nether.nix
23 ./spora.nix
24 ./nix.nix
25 self.inputs.stockholm.nixosModules.users
26 self.inputs.stockholm.nixosModules.hosts
27 self.inputs.stockholm.nixosModules.kartei
28 self.inputs.stockholm.nixosModules.build
29 self.inputs.stockholm.nixosModules.dns
30 self.inputs.stockholm.nixosModules.exim
31 self.inputs.stockholm.nixosModules.exim-retiolum
32 self.inputs.stockholm.nixosModules.tinc
33 self.inputs.stockholm.nixosModules.iptables
34 self.inputs.stockholm.nixosModules.power-action
35 self.inputs.stockholm.nixosModules.setuid
36 self.inputs.stockholm.nixosModules.secret
37 self.inputs.stockholm.nixosModules.sitemap
38 self.inputs.stockholm.nixosModules.ssl
39 self.inputs.stockholm.nixosModules.systemd
40 self.inputs.stockholm.nixosModules.xresources
41 self.inputs.stockholm.nixosModules.ssh
42 self.inputs.stockholm.nixosModules.sync-containers3
43 {
44 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
45 users.extraUsers.mainUser.hashedPasswordFile =
46 config.clan.core.vars.generators.password.files.passwordHash.path;
47 users.extraUsers.root.hashedPasswordFile =
48 config.clan.core.vars.generators.password.files.passwordHash.path;
49 boot.initrd.systemd.emergencyAccess = true;
50 clan.core.vars.generators.password = {
51 prompts.password.description = "Password for the main user";
52 files.password.deploy = false;
53 files.passwordHash.neededForUsers = true;
54 migrateFact = "password";
55 runtimeInputs = with pkgs; [
56 coreutils
57 mkpasswd
58 ];
59 script = ''
60 cp $prompts/password $out/password
61 exit 1
62 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
63 '';
64 };
65 }
66 {
67 # deployment information
68 options.clan.flake-inputs = lib.mkOption {
69 description = ''
70 information about the flake inputs.
71 Used for update tracking.
72 '';
73 type = lib.types.attrsOf (
74 lib.types.attrsOf (
75 lib.types.nullOr (
76 lib.types.oneOf [
77 lib.types.str
78 lib.types.int
79 ]
80 )
81 )
82 );
83 default =
84 let
85 inputs = config.clan.core.clanDir.inputs;
86 cleanSourceInfo = input: {
87 rev = input.rev or null;
88 dirtyRev = input.dirtyRev or null;
89 lastModified = input.lastModified or null;
90 narHash = input.narHash or null;
91 };
92 sourceInfo = lib.mapAttrs (_: input: cleanSourceInfo input) inputs;
93 in
94 sourceInfo
95 // {
96 self = cleanSourceInfo config.clan.core.clanDir.sourceInfo;
97 };
98 };
99 config.environment.etc."flake-inputs.json".text =
100 let
101 text = builtins.unsafeDiscardStringContext (builtins.toJSON config.clan.flake-inputs);
102 in
103 text;
104 }
105 {
106 services.openssh.enable = true;
107 services.openssh.hostKeys = [
108 {
109 path = config.clanCore.vars.generators.ssh.files."ssh.id_ed25519".path;
110 type = "ed25519";
111 }
112 ];
113 clan.core.vars.generators.ssh = {
114 files."ssh.id_ed25519".secret = true;
115 files."ssh.id_ed25519.pub".secret = false;
116 migrateFact = "ssh";
117 runtimeInputs = with pkgs; [
118 coreutils
119 openssh
120 ];
121 script = ''
122 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
123 mv $secrets/ssh.id_ed25519.pub $out/ssh.id_ed25519.pub
124 '';
125 };
126 }
127 {
128 users.extraUsers = {
129 root = {
130 openssh.authorizedKeys.keys = [
131 config.krebs.users.lass.pubkey
132 ];
133 };
134 mainUser = {
135 name = "lass";
136 uid = 1337;
137 home = "/home/lass";
138 group = "users";
139 createHome = true;
140 useDefaultShell = true;
141 isNormalUser = true;
142 extraGroups = [
143 "audio"
144 "video"
145 "fuse"
146 "wheel"
147 "tor"
148 ];
149 openssh.authorizedKeys.keys = [
150 config.krebs.users.lass.pubkey
151 ];
152 };
153 };
154 }
155 (
156 let
157 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
158 in
159 {
160 environment.variables = {
161 CURL_CA_BUNDLE = ca-bundle;
162 GIT_SSL_CAINFO = ca-bundle;
163 SSL_CERT_FILE = ca-bundle;
164 };
165 }
166 )
167 {
168 #for sshuttle
169 environment.systemPackages = [
170 pkgs.python3Packages.python
171 ];
172 }
173 ];
174
175 networking.hostName = config.krebs.build.host.name;
176
177 krebs = {
178 enable = true;
179 build.user = config.krebs.users.lass;
180 ssl.trustIntermediate = true;
181 };
182
183 users.mutableUsers = false;
184
185 # multiple-definition-problem when defining environment.variables.EDITOR
186 environment.extraInit = ''
187 EDITOR=vim
188 '';
189
190 nixpkgs.config.allowUnfree = true;
191
192 environment.systemPackages = with pkgs; [
193 self.packages.${pkgs.system}.nvim
194
195 git
196 git-absorb
197 git-preview
198 gnumake
199 jq
200 nix-output-monitor
201
202 #style
203 rxvt-unicode-unwrapped.terminfo
204 alacritty.terminfo
205
206 #monitoring tools
207 htop
208 iotop
209
210 #network
211 iptables
212 iftop
213 tcpdump
214 mosh
215 eternal-terminal
216 self.packages.${pkgs.system}.sshify
217
218 #stuff for dl
219 aria2
220
221 #neat utils
222 file
223 hashPassword
224 xkcdpass
225 kpaste
226 cyberlocker-tools
227 pciutils
228 pop
229 q
230 rs
231 untilport
232 (pkgs.writeDashBin "urgent" ''
233 printf '\a'
234 '')
235 usbutils
236 self.packages.${pkgs.system}.logify
237 goify
238
239 #unpack stuff
240 libarchive
241
242 (pkgs.writeDashBin "sshn" ''
243 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
244 '')
245 ];
246
247 environment.shellAliases = {
248 ll = "ls -l";
249 la = "ls -la";
250 ls = "ls --color";
251 ip = "ip -color=auto";
252 grep = "grep --color=auto";
253 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
254 };
255
256 programs.bash = {
257 enableCompletion = true;
258 interactiveShellInit = ''
259 HISTCONTROL='erasedups:ignorespace'
260 HISTSIZE=65536
261 HISTFILESIZE=$HISTSIZE
262
263 shopt -s checkhash
264 shopt -s histappend histreedit histverify
265 shopt -s no_empty_cmd_completion
266 complete -d cd
267 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
268 '';
269 promptInit = ''
270 if test $UID = 0; then
271 PS1='\[\033[1;31m\]\w\[\033[0m\] '
272 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
273 elif test $UID = 1337; then
274 PS1='\[\033[1;32m\]\w\[\033[0m\] '
275 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
276 else
277 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
278 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
279 fi
280 if test -n "$SSH_CLIENT"; then
281 PS1='\[\033[35m\]\h'" $PS1"
282 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
283 fi
284 '';
285 };
286
287 services.journald.extraConfig = ''
288 SystemMaxUse=1G
289 RuntimeMaxUse=128M
290 Storage=persistent
291 '';
292
293 krebs.iptables = {
294 enable = true;
295 tables = {
296 filter.INPUT.policy = "DROP";
297 filter.FORWARD.policy = lib.mkDefault "DROP";
298 filter.INPUT.rules = lib.mkMerge [
299 (lib.mkBefore [
300 {
301 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
302 target = "ACCEPT";
303 }
304 {
305 predicate = "-p icmp";
306 target = "ACCEPT";
307 }
308 {
309 predicate = "-p ipv6-icmp";
310 target = "ACCEPT";
311 v4 = false;
312 }
313 {
314 predicate = "-i lo";
315 target = "ACCEPT";
316 }
317 {
318 predicate = "-p tcp --dport 22";
319 target = "ACCEPT";
320 }
321 ])
322 (lib.mkOrder 1000 [
323 {
324 predicate = "-p udp --dport 60000:61000";
325 target = "ACCEPT";
326 } # mosh
327 {
328 predicate = "-i retiolum -p udp -m udp --dport 53";
329 target = "ACCEPT";
330 }
331 {
332 predicate = "-i retiolum -p tcp --dport 19999";
333 target = "ACCEPT";
334 }
335 ])
336 (lib.mkAfter [
337 {
338 predicate = "-p tcp -i retiolum";
339 target = "REJECT --reject-with tcp-reset";
340 }
341 {
342 predicate = "-p udp -i retiolum";
343 target = "REJECT --reject-with icmp-port-unreachable";
344 v6 = false;
345 }
346 {
347 predicate = "-i retiolum";
348 target = "REJECT --reject-with icmp-proto-unreachable";
349 v6 = false;
350 }
351 ])
352 ];
353 };
354 };
355
356 networking.dhcpcd.extraConfig = ''
357 noipv4ll
358 '';
359
360 networking.extraHosts = ''
361 10.42.0.1 styx.gg23
362 '';
363
364 # use 24:00 time format, the default got sneakily changed around 20.03
365 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
366 time.timeZone = lib.mkDefault "Europe/Berlin";
367
368 # disable doc usually
369 documentation.nixos.enable = lib.mkDefault false;
370
371 # use new rebuild switch
372 system.switch = {
373 enable = false;
374 enableNg = true;
375 };
376
377 # use latest nix to hunt all the bugs
378 nix.package = pkgs.nixVersions.latest;
379
380}