This repository has no description
9.6 kB
383 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 imports = [
10 ./security-workarounds.nix
11 # ./binary-cache/client.nix
12 ./gc.nix
13 ./mc.nix
14 ./zsh.nix
15 ./htop.nix
16 ./wiregrill.nix
17 ./tmux.nix
18 ./tor-ssh.nix
19 ./networkd.nix
20 ./pinned-registry.nix
21 ./zerotier.nix
22 ./nether.nix
23 ./spora.nix
24 self.inputs.stockholm.nixosModules.users
25 self.inputs.stockholm.nixosModules.hosts
26 self.inputs.stockholm.nixosModules.kartei
27 self.inputs.stockholm.nixosModules.build
28 self.inputs.stockholm.nixosModules.dns
29 self.inputs.stockholm.nixosModules.exim
30 self.inputs.stockholm.nixosModules.exim-retiolum
31 self.inputs.stockholm.nixosModules.tinc
32 self.inputs.stockholm.nixosModules.iptables
33 self.inputs.stockholm.nixosModules.power-action
34 self.inputs.stockholm.nixosModules.setuid
35 self.inputs.stockholm.nixosModules.secret
36 self.inputs.stockholm.nixosModules.sitemap
37 self.inputs.stockholm.nixosModules.ssl
38 self.inputs.stockholm.nixosModules.systemd
39 self.inputs.stockholm.nixosModules.xresources
40 self.inputs.stockholm.nixosModules.ssh
41 self.inputs.stockholm.nixosModules.sync-containers3
42 {
43 users.extraUsers.mainUser.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
44 users.extraUsers.root.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
45 boot.initrd.systemd.emergencyAccess = true;
46 clanCore.facts.services.password = {
47 secret.password = { };
48 secret.passwordHash = { };
49 generator.path = with pkgs; [
50 coreutils
51 xkcdpass
52 mkpasswd
53 ];
54 generator.script = ''
55 xkcdpass -n 4 -d - > $secrets/password
56 cat $secrets/password | mkpasswd -s -m sha-512 > $secrets/passwordHash
57 '';
58 };
59 }
60 {
61 # deployment information
62 options.clan.flake-inputs = lib.mkOption {
63 description = ''
64 information about the flake inputs.
65 Used for update tracking.
66 '';
67 type = lib.types.attrsOf (
68 lib.types.attrsOf (
69 lib.types.nullOr (
70 lib.types.oneOf [
71 lib.types.str
72 lib.types.int
73 ]
74 )
75 )
76 );
77 default =
78 let
79 inputs = config.clan.core.clanDir.inputs;
80 cleanSourceInfo = input: {
81 rev = input.rev or null;
82 dirtyRev = input.dirtyRev or null;
83 lastModified = input.lastModified or null;
84 narHash = input.narHash or null;
85 };
86 sourceInfo = lib.mapAttrs (_: input: cleanSourceInfo input) inputs;
87 in
88 sourceInfo
89 // {
90 self = cleanSourceInfo config.clan.core.clanDir.sourceInfo;
91 };
92 };
93 config.environment.etc."flake-inputs.json".text =
94 let
95 text = builtins.unsafeDiscardStringContext (builtins.toJSON config.clan.flake-inputs);
96 in
97 text;
98 }
99 {
100 services.openssh.enable = true;
101 services.openssh.hostKeys = [
102 {
103 path = config.clanCore.facts.services.ssh.secret."ssh.id_ed25519".path;
104 type = "ed25519";
105 }
106 ];
107 clanCore.facts.services.ssh = {
108 secret."ssh.id_ed25519" = { };
109 public."ssh.id_ed25519.pub" = { };
110 generator.path = with pkgs; [
111 coreutils
112 openssh
113 ];
114 generator.script = ''
115 ssh-keygen -t ed25519 -N "" -f $secrets/ssh.id_ed25519
116 mv $secrets/ssh.id_ed25519.pub $facts/ssh.id_ed25519.pub
117 '';
118 };
119 }
120 {
121 users.extraUsers = {
122 root = {
123 openssh.authorizedKeys.keys = [
124 config.krebs.users.lass.pubkey
125 ];
126 };
127 mainUser = {
128 name = "lass";
129 uid = 1337;
130 home = "/home/lass";
131 group = "users";
132 createHome = true;
133 useDefaultShell = true;
134 isNormalUser = true;
135 extraGroups = [
136 "audio"
137 "video"
138 "fuse"
139 "wheel"
140 "tor"
141 ];
142 openssh.authorizedKeys.keys = [
143 config.krebs.users.lass.pubkey
144 ];
145 };
146 };
147 }
148 (
149 let
150 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
151 in
152 {
153 environment.variables = {
154 CURL_CA_BUNDLE = ca-bundle;
155 GIT_SSL_CAINFO = ca-bundle;
156 SSL_CERT_FILE = ca-bundle;
157 };
158 }
159 )
160 {
161 #for sshuttle
162 environment.systemPackages = [
163 pkgs.python3Packages.python
164 ];
165 }
166 ];
167
168 networking.hostName = config.krebs.build.host.name;
169
170 krebs = {
171 enable = true;
172 build.user = config.krebs.users.lass;
173 ssl.trustIntermediate = true;
174 };
175
176 nix.settings.sandbox = true;
177
178 users.mutableUsers = false;
179
180 # multiple-definition-problem when defining environment.variables.EDITOR
181 environment.extraInit = ''
182 EDITOR=vim
183 '';
184
185 nixpkgs.config.allowUnfree = true;
186
187 environment.systemPackages = with pkgs; [
188 self.packages.${pkgs.system}.nvim
189
190 git
191 git-absorb
192 git-preview
193 gnumake
194 jq
195 nix-output-monitor
196
197 #style
198 rxvt-unicode-unwrapped.terminfo
199 alacritty.terminfo
200
201 #monitoring tools
202 htop
203 iotop
204
205 #network
206 iptables
207 iftop
208 tcpdump
209 mosh
210 eternal-terminal
211 self.packages.${pkgs.system}.sshify
212
213 #stuff for dl
214 aria2
215
216 #neat utils
217 file
218 hashPassword
219 xkcdpass
220 kpaste
221 cyberlocker-tools
222 pciutils
223 pop
224 q
225 rs
226 untilport
227 (pkgs.writeDashBin "urgent" ''
228 printf '\a'
229 '')
230 usbutils
231 self.packages.${pkgs.system}.logify
232 goify
233
234 #unpack stuff
235 libarchive
236
237 (pkgs.writeDashBin "sshn" ''
238 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
239 '')
240 ];
241
242 environment.shellAliases = {
243 ll = "ls -l";
244 la = "ls -la";
245 ls = "ls --color";
246 ip = "ip -color=auto";
247 grep = "grep --color=auto";
248 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
249 };
250
251 programs.bash = {
252 enableCompletion = true;
253 interactiveShellInit = ''
254 HISTCONTROL='erasedups:ignorespace'
255 HISTSIZE=65536
256 HISTFILESIZE=$HISTSIZE
257
258 shopt -s checkhash
259 shopt -s histappend histreedit histverify
260 shopt -s no_empty_cmd_completion
261 complete -d cd
262 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
263 '';
264 promptInit = ''
265 if test $UID = 0; then
266 PS1='\[\033[1;31m\]\w\[\033[0m\] '
267 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
268 elif test $UID = 1337; then
269 PS1='\[\033[1;32m\]\w\[\033[0m\] '
270 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
271 else
272 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
273 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
274 fi
275 if test -n "$SSH_CLIENT"; then
276 PS1='\[\033[35m\]\h'" $PS1"
277 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
278 fi
279 '';
280 };
281
282 services.journald.extraConfig = ''
283 SystemMaxUse=1G
284 RuntimeMaxUse=128M
285 Storage=persistent
286 '';
287
288 krebs.iptables = {
289 enable = true;
290 tables = {
291 filter.INPUT.policy = "DROP";
292 filter.FORWARD.policy = lib.mkDefault "DROP";
293 filter.INPUT.rules = lib.mkMerge [
294 (lib.mkBefore [
295 {
296 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
297 target = "ACCEPT";
298 }
299 {
300 predicate = "-p icmp";
301 target = "ACCEPT";
302 }
303 {
304 predicate = "-p ipv6-icmp";
305 target = "ACCEPT";
306 v4 = false;
307 }
308 {
309 predicate = "-i lo";
310 target = "ACCEPT";
311 }
312 {
313 predicate = "-p tcp --dport 22";
314 target = "ACCEPT";
315 }
316 ])
317 (lib.mkOrder 1000 [
318 {
319 predicate = "-p udp --dport 60000:61000";
320 target = "ACCEPT";
321 } # mosh
322 {
323 predicate = "-i retiolum -p udp -m udp --dport 53";
324 target = "ACCEPT";
325 }
326 {
327 predicate = "-i retiolum -p tcp --dport 19999";
328 target = "ACCEPT";
329 }
330 ])
331 (lib.mkAfter [
332 {
333 predicate = "-p tcp -i retiolum";
334 target = "REJECT --reject-with tcp-reset";
335 }
336 {
337 predicate = "-p udp -i retiolum";
338 target = "REJECT --reject-with icmp-port-unreachable";
339 v6 = false;
340 }
341 {
342 predicate = "-i retiolum";
343 target = "REJECT --reject-with icmp-proto-unreachable";
344 v6 = false;
345 }
346 ])
347 ];
348 };
349 };
350
351 networking.dhcpcd.extraConfig = ''
352 noipv4ll
353 '';
354
355 networking.extraHosts = ''
356 10.42.0.1 styx.gg23
357 '';
358
359 nix.settings.experimental-features = [
360 "nix-command"
361 "flakes"
362 ];
363
364 # use 24:00 time format, the default got sneakily changed around 20.03
365 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
366 time.timeZone = lib.mkDefault "Europe/Berlin";
367
368 # disable doc usually
369 documentation.nixos.enable = lib.mkDefault false;
370
371 # use new rebuild switch
372 system.switch = {
373 enable = false;
374 enableNg = true;
375 };
376
377 # use latest nix to hunt all the bugs
378 nix.package = pkgs.nixVersions.latest;
379
380 # workaround for systemd freezing up when suspending
381 # https://github.com/systemd/systemd/issues/33083
382 environment.variables.SYSTEMD_SLEEP_FREEZE_USER_SESSIONS = "false";
383}