This repository has no description
8.6 kB
348 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 imports = [
10 ./security-workarounds.nix
11 # ./binary-cache/client.nix
12 ./gc.nix
13 ./mc.nix
14 ./zsh.nix
15 ./htop.nix
16 ./wiregrill.nix
17 ./tmux.nix
18 ./tor-ssh.nix
19 ./networkd.nix
20 ./pinned-registry.nix
21 ./zerotier.nix
22 ./nether.nix
23 ./nix.nix
24 self.inputs.stockholm.nixosModules.users
25 self.inputs.stockholm.nixosModules.hosts
26 self.inputs.stockholm.nixosModules.kartei
27 self.inputs.stockholm.nixosModules.build
28 self.inputs.stockholm.nixosModules.dns
29 self.inputs.stockholm.nixosModules.exim
30 self.inputs.stockholm.nixosModules.exim-retiolum
31 self.inputs.stockholm.nixosModules.tinc
32 self.inputs.stockholm.nixosModules.iptables
33 self.inputs.stockholm.nixosModules.power-action
34 self.inputs.stockholm.nixosModules.setuid
35 self.inputs.stockholm.nixosModules.secret
36 self.inputs.stockholm.nixosModules.sitemap
37 self.inputs.stockholm.nixosModules.ssl
38 self.inputs.stockholm.nixosModules.systemd
39 self.inputs.stockholm.nixosModules.xresources
40 self.inputs.stockholm.nixosModules.ssh
41 self.inputs.stockholm.nixosModules.sync-containers3
42 { # nix-index
43 imports = [
44 self.inputs.nix-index-database.nixosModules.nix-index
45 ];
46 programs.nix-index-database.comma.enable = true;
47 }
48 {
49 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
50 users.extraUsers.mainUser.hashedPasswordFile =
51 config.clan.core.vars.generators.password.files.passwordHash.path;
52 users.extraUsers.root.hashedPasswordFile =
53 config.clan.core.vars.generators.password.files.passwordHash.path;
54 boot.initrd.systemd.emergencyAccess = true;
55 clan.core.vars.generators.password = {
56 prompts.password = {
57 description = "Password for the main user";
58 type = "hidden";
59 };
60 files.password.deploy = false;
61 files.passwordHash.neededFor = "users";
62 migrateFact = "password";
63 runtimeInputs = with pkgs; [
64 coreutils
65 mkpasswd
66 ];
67 script = ''
68 cp $prompts/password $out/password
69 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
70 '';
71 };
72 }
73 {
74 services.openssh.enable = true;
75 services.openssh.hostKeys = [
76 {
77 path = config.clanCore.vars.generators.ssh.files."ssh.id_ed25519".path;
78 type = "ed25519";
79 }
80 ];
81 clan.core.vars.generators.ssh = {
82 files."ssh.id_ed25519".secret = true;
83 files."ssh.id_ed25519.pub".secret = false;
84 migrateFact = "ssh";
85 runtimeInputs = with pkgs; [
86 coreutils
87 openssh
88 ];
89 script = ''
90 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
91 '';
92 };
93 }
94 {
95 users.extraUsers = {
96 root = {
97 openssh.authorizedKeys.keys = [
98 config.krebs.users.lass.pubkey
99 ];
100 };
101 mainUser = {
102 name = "lass";
103 uid = 1337;
104 home = "/home/lass";
105 group = "users";
106 createHome = true;
107 useDefaultShell = true;
108 isNormalUser = true;
109 extraGroups = [
110 "audio"
111 "video"
112 "fuse"
113 "wheel"
114 "tor"
115 "dialout"
116 ];
117 openssh.authorizedKeys.keys = [
118 config.krebs.users.lass.pubkey
119 ];
120 };
121 };
122 }
123 (
124 let
125 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
126 in
127 {
128 environment.variables = {
129 CURL_CA_BUNDLE = ca-bundle;
130 GIT_SSL_CAINFO = ca-bundle;
131 SSL_CERT_FILE = ca-bundle;
132 };
133 }
134 )
135 {
136 #for sshuttle
137 environment.systemPackages = [
138 pkgs.python3Packages.python
139 ];
140 }
141 ];
142
143 networking.hostName = config.krebs.build.host.name;
144
145 krebs = {
146 enable = true;
147 build.user = config.krebs.users.lass;
148 ssl.trustIntermediate = true;
149 };
150
151 users.mutableUsers = false;
152
153 # multiple-definition-problem when defining environment.variables.EDITOR
154 environment.extraInit = ''
155 EDITOR=vim
156 '';
157
158 nixpkgs.config.allowUnfree = true;
159
160 environment.systemPackages = with pkgs; [
161 self.packages.${pkgs.system}.nvim
162
163 git
164 git-absorb
165 git-preview
166 gnumake
167 jq
168 nix-output-monitor
169 comma
170
171 #style
172 rxvt-unicode-unwrapped.terminfo
173 alacritty.terminfo
174
175 #monitoring tools
176 htop
177 iotop
178
179 #network
180 iptables
181 iftop
182 tcpdump
183 mosh
184 eternal-terminal
185 self.packages.${pkgs.system}.sshify
186
187 #stuff for dl
188 aria2
189
190 #neat utils
191 file
192 hashPassword
193 xkcdpass
194 kpaste
195 cyberlocker-tools
196 pciutils
197 pop
198 q
199 untilport
200 (pkgs.writeDashBin "urgent" ''
201 printf '\a'
202 '')
203 usbutils
204 self.packages.${pkgs.system}.logify
205 goify
206
207 #unpack stuff
208 libarchive
209
210 (pkgs.writeDashBin "sshn" ''
211 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
212 '')
213 ];
214
215 environment.shellAliases = {
216 ll = "ls -l";
217 la = "ls -la";
218 ls = "ls --color";
219 ip = "ip -color=auto";
220 grep = "grep --color=auto";
221 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
222 };
223
224 programs.bash = {
225 enableCompletion = true;
226 interactiveShellInit = ''
227 HISTCONTROL='erasedups:ignorespace'
228 HISTSIZE=65536
229 HISTFILESIZE=$HISTSIZE
230
231 shopt -s checkhash
232 shopt -s histappend histreedit histverify
233 shopt -s no_empty_cmd_completion
234 complete -d cd
235 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
236 '';
237 promptInit = ''
238 if test $UID = 0; then
239 PS1='\[\033[1;31m\]\w\[\033[0m\] '
240 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
241 elif test $UID = 1337; then
242 PS1='\[\033[1;32m\]\w\[\033[0m\] '
243 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
244 else
245 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
246 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
247 fi
248 if test -n "$SSH_CLIENT"; then
249 PS1='\[\033[35m\]\h'" $PS1"
250 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
251 fi
252 '';
253 };
254
255 services.journald.extraConfig = ''
256 SystemMaxUse=1G
257 RuntimeMaxUse=128M
258 Storage=persistent
259 '';
260
261 krebs.iptables = {
262 enable = true;
263 tables = {
264 filter.INPUT.policy = "DROP";
265 filter.FORWARD.policy = lib.mkDefault "DROP";
266 filter.INPUT.rules = lib.mkMerge [
267 (lib.mkBefore [
268 {
269 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
270 target = "ACCEPT";
271 }
272 {
273 predicate = "-p icmp";
274 target = "ACCEPT";
275 }
276 {
277 predicate = "-p ipv6-icmp";
278 target = "ACCEPT";
279 v4 = false;
280 }
281 {
282 predicate = "-i lo";
283 target = "ACCEPT";
284 }
285 {
286 predicate = "-p tcp --dport 22";
287 target = "ACCEPT";
288 }
289 ])
290 (lib.mkOrder 1000 [
291 {
292 predicate = "-p udp --dport 60000:61000";
293 target = "ACCEPT";
294 } # mosh
295 {
296 predicate = "-i retiolum -p udp -m udp --dport 53";
297 target = "ACCEPT";
298 }
299 {
300 predicate = "-i retiolum -p tcp --dport 19999";
301 target = "ACCEPT";
302 }
303 ])
304 (lib.mkAfter [
305 {
306 predicate = "-p tcp -i retiolum";
307 target = "REJECT --reject-with tcp-reset";
308 }
309 {
310 predicate = "-p udp -i retiolum";
311 target = "REJECT --reject-with icmp-port-unreachable";
312 v6 = false;
313 }
314 {
315 predicate = "-i retiolum";
316 target = "REJECT --reject-with icmp-proto-unreachable";
317 v6 = false;
318 }
319 ])
320 ];
321 };
322 };
323
324 networking.dhcpcd.extraConfig = ''
325 noipv4ll
326 '';
327
328 networking.extraHosts = ''
329 10.42.0.1 styx.gg23
330 '';
331
332 # use 24:00 time format, the default got sneakily changed around 20.03
333 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
334 time.timeZone = lib.mkDefault "Europe/Berlin";
335
336 # disable doc usually
337 documentation.nixos.enable = lib.mkDefault false;
338
339 # use new rebuild switch
340 system.switch = {
341 enable = false;
342 enableNg = true;
343 };
344
345 # use latest nix to hunt all the bugs
346 nix.package = pkgs.nixVersions.latest;
347
348}