This repository has no description
7.8 kB
304 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9 selfPkgs = self.packages.${pkgs.stdenv.hostPlatform.system};
10in
11{
12
13 imports = [
14 # Import modules
15 ../modules
16
17 # Import individual configurations
18 ./security-workarounds.nix
19 ./gc.nix
20 ./mc.nix
21 ./zsh.nix
22 ./htop.nix
23 ./tor-ssh.nix
24 ./networkd.nix
25 ./pinned-registry.nix
26 ./nix.nix
27
28 ./kartei.nix
29 {
30 # nix-index
31 imports = [
32 self.inputs.nix-index-database.nixosModules.nix-index
33 ];
34 programs.nix-index-database.comma.enable = true;
35 }
36 {
37 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
38 users.extraUsers.mainUser.hashedPasswordFile =
39 config.clan.core.vars.generators.password.files.passwordHash.path;
40 users.extraUsers.root.hashedPasswordFile =
41 config.clan.core.vars.generators.password.files.passwordHash.path;
42 boot.initrd.systemd.emergencyAccess = true;
43 clan.core.vars.generators.password = {
44 prompts.password = {
45 description = "Password for the main user";
46 type = "hidden";
47 };
48 files.password.deploy = false;
49 files.passwordHash.neededFor = "users";
50 runtimeInputs = with pkgs; [
51 coreutils
52 mkpasswd
53 ];
54 script = ''
55 cp $prompts/password $out/password
56 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
57 '';
58 };
59 }
60 {
61 services.openssh.enable = true;
62 services.openssh.settings.PasswordAuthentication = false;
63 services.openssh.hostKeys = [
64 {
65 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
66 type = "ed25519";
67 }
68 ];
69 clan.core.vars.generators.ssh = {
70 files."ssh.id_ed25519" = { };
71 files."ssh.id_ed25519.pub".secret = false;
72 runtimeInputs = with pkgs; [
73 coreutils
74 openssh
75 ];
76 script = ''
77 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
78 '';
79 };
80 }
81 {
82 users.extraUsers = {
83 root = {
84 openssh.authorizedKeys.keys = [
85 self.keys.ssh.barnacle.public
86 self.keys.ssh.yubi_pgp.public
87 self.keys.ssh.termux_massulus.public
88 self.keys.ssh.yubi1.public
89 self.keys.ssh.yubi2.public
90 self.keys.ssh.solo2.public
91 self.keys.ssh.xerxes.public
92 self.keys.ssh.ignavia.public
93 self.keys.ssh.phonetpm_massulus.public
94 ];
95 };
96 mainUser = {
97 name = "lass";
98 uid = 1337;
99 home = "/home/lass";
100 group = "users";
101 createHome = true;
102 useDefaultShell = true;
103 isNormalUser = true;
104 linger = true;
105 extraGroups = [
106 "audio"
107 "video"
108 "fuse"
109 "wheel"
110 "tor"
111 "dialout"
112 ];
113 openssh.authorizedKeys.keys = [
114 self.keys.ssh.barnacle.public
115 self.keys.ssh.yubi_pgp.public
116 self.keys.ssh.termux_massulus.public
117 self.keys.ssh.yubi1.public
118 self.keys.ssh.yubi2.public
119 self.keys.ssh.solo2.public
120 self.keys.ssh.xerxes.public
121 self.keys.ssh.ignavia.public
122 self.keys.ssh.phonetpm_massulus.public
123 ];
124 };
125 };
126 }
127 (
128 let
129 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
130 in
131 {
132 environment.variables = {
133 CURL_CA_BUNDLE = ca-bundle;
134 GIT_SSL_CAINFO = ca-bundle;
135 SSL_CERT_FILE = ca-bundle;
136 };
137 }
138 )
139 {
140 #for sshuttle
141 environment.systemPackages = [
142 pkgs.python3Packages.python
143 ];
144 }
145 ];
146
147 networking.hostName = config.clan.core.settings.machine.name;
148
149 users.mutableUsers = false;
150
151 # multiple-definition-problem when defining environment.variables.EDITOR
152 environment.extraInit = ''
153 EDITOR=vim
154 '';
155
156 nixpkgs.config.allowUnfree = true;
157
158 environment.systemPackages = with pkgs; [
159 self.packages.${pkgs.system}.nvim
160 self.packages.${pkgs.system}.tmux
161 self.packages.${pkgs.system}.s
162
163 git
164 git-absorb
165 gnumake
166 jq
167 nix-output-monitor
168 comma
169
170 #style
171 rxvt-unicode-unwrapped.terminfo
172 alacritty.terminfo
173
174 #monitoring tools
175 htop
176 iotop
177
178 #network
179 iptables
180 iftop
181 tcpdump
182 mosh
183 self.packages.${pkgs.system}.sshify
184
185 #stuff for dl
186 aria2
187
188 #neat utils
189 file
190 xkcdpass
191 selfPkgs.kpaste
192 selfPkgs.cyberlocker-tools
193 pciutils
194 pop
195 selfPkgs.untilport
196 (pkgs.writers.writeDashBin "urgent" ''
197 printf '\a'
198 '')
199 usbutils
200
201 #unpack stuff
202 libarchive
203
204 (pkgs.writers.writeDashBin "sshn" ''
205 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
206 '')
207 ];
208
209 environment.shellAliases = {
210 ll = "ls -l";
211 la = "ls -la";
212 ls = "ls --color";
213 ip = "ip -color=auto";
214 grep = "grep --color=auto";
215 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
216 };
217
218 programs.bash = {
219 completion.enable = true;
220 interactiveShellInit = ''
221 HISTCONTROL='erasedups:ignorespace'
222 HISTSIZE=65536
223 HISTFILESIZE=$HISTSIZE
224
225 shopt -s checkhash
226 shopt -s histappend histreedit histverify
227 shopt -s no_empty_cmd_completion
228 complete -d cd
229 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
230 '';
231 promptInit = ''
232 if test $UID = 0; then
233 PS1='\[\033[1;31m\]\w\[\033[0m\] '
234 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
235 elif test $UID = 1337; then
236 PS1='\[\033[1;32m\]\w\[\033[0m\] '
237 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
238 else
239 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
240 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
241 fi
242 if test -n "$SSH_CLIENT"; then
243 PS1='\[\033[35m\]\h'" $PS1"
244 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
245 fi
246 '';
247 };
248
249 services.journald.settings.Journal = {
250 SystemMaxUse = "1G";
251 RuntimeMaxUse = "128M";
252 Storage = "persistent";
253 };
254
255 # nftables based NixOS firewall. Input and forward drop by default, as
256 # krebs.iptables did; no reverse path filter either, the routers,
257 # container hosts and NAT64 boxes route asymmetrically.
258 networking.nftables = {
259 enable = true;
260 # Defaults to true on machines older than 23.11, which would also wipe
261 # the tables libvirt, podman and jool keep on every reload.
262 flushRuleset = false;
263 # krebs.iptables loaded its rules through iptables-nft into these
264 # tables; nothing removes them when it goes away. Drop once every
265 # machine has switched to nftables.
266 extraDeletions = ''
267 table ip filter
268 delete table ip filter
269 table ip6 filter
270 delete table ip6 filter
271 table ip nat
272 delete table ip nat
273 table ip6 nat
274 delete table ip6 nat
275 '';
276 };
277 networking.firewall = {
278 filterForward = lib.mkDefault true;
279 checkReversePath = false;
280 # all of ICMP, not just echo-request, like krebs.iptables
281 extraInputRules = ''
282 meta l4proto icmp accept
283 '';
284 };
285
286 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
287 networking.firewall.allowedUDPPortRanges = [
288 {
289 from = 60000;
290 to = 61000;
291 }
292 ]; # mosh
293 networking.extraHosts = ''
294 10.42.0.1 acheron.gg23
295 10.42.0.3 styx.gg23
296 '';
297
298 # use 24:00 time format, the default got sneakily changed around 20.03
299 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
300 time.timeZone = lib.mkDefault "Europe/Berlin";
301
302 # disable doc usually
303 documentation.nixos.enable = lib.mkDefault false;
304}