This repository has no description
8.3 kB
314 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9 selfPkgs = self.packages.${pkgs.stdenv.hostPlatform.system};
10in
11{
12
13 imports = [
14 # Import modules
15 ../modules
16
17 # Import individual configurations
18 ./security-workarounds.nix
19 ./gc.nix
20 ./mc.nix
21 ./zsh.nix
22 ./htop.nix
23 ./tor-ssh.nix
24 ./networkd.nix
25 ./pinned-registry.nix
26 ./nix.nix
27
28 ./kartei.nix
29 {
30 # nix-index
31 imports = [
32 self.inputs.nix-index-database.nixosModules.nix-index
33 ];
34 programs.nix-index-database.comma.enable = true;
35 }
36 {
37 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
38 users.extraUsers.mainUser.hashedPasswordFile =
39 config.clan.core.vars.generators.password.files.passwordHash.path;
40 users.extraUsers.root.hashedPasswordFile =
41 config.clan.core.vars.generators.password.files.passwordHash.path;
42 boot.initrd.systemd.emergencyAccess = true;
43 clan.core.vars.generators.password = {
44 prompts.password = {
45 description = "Password for the main user";
46 type = "hidden";
47 };
48 files.password.deploy = false;
49 files.passwordHash.neededFor = "users";
50 runtimeInputs = with pkgs; [
51 coreutils
52 mkpasswd
53 ];
54 script = ''
55 cp $prompts/password $out/password
56 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
57 '';
58 };
59 }
60 {
61 services.openssh.enable = true;
62 services.openssh.settings.PasswordAuthentication = false;
63 services.openssh.hostKeys = [
64 {
65 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
66 type = "ed25519";
67 }
68 ];
69 clan.core.vars.generators.ssh = {
70 files."ssh.id_ed25519" = { };
71 files."ssh.id_ed25519.pub".secret = false;
72 runtimeInputs = with pkgs; [
73 coreutils
74 openssh
75 ];
76 script = ''
77 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
78 '';
79 };
80 }
81 {
82 users.extraUsers = {
83 root = {
84 openssh.authorizedKeys.keys = [
85 self.keys.ssh.barnacle.public
86 self.keys.ssh.yubi_pgp.public
87 self.keys.ssh.termux_massulus.public
88 self.keys.ssh.yubi1.public
89 self.keys.ssh.yubi2.public
90 self.keys.ssh.solo2.public
91 self.keys.ssh.ignavia.public
92 self.keys.ssh.phonetpm_massulus.public
93 ];
94 };
95 mainUser = {
96 name = "lass";
97 uid = 1337;
98 home = "/home/lass";
99 group = "users";
100 createHome = true;
101 useDefaultShell = true;
102 isNormalUser = true;
103 linger = true;
104 extraGroups = [
105 "audio"
106 "video"
107 "fuse"
108 "wheel"
109 "tor"
110 "dialout"
111 ];
112 openssh.authorizedKeys.keys = [
113 self.keys.ssh.barnacle.public
114 self.keys.ssh.yubi_pgp.public
115 self.keys.ssh.termux_massulus.public
116 self.keys.ssh.yubi1.public
117 self.keys.ssh.yubi2.public
118 self.keys.ssh.solo2.public
119 self.keys.ssh.ignavia.public
120 self.keys.ssh.phonetpm_massulus.public
121 ];
122 };
123 };
124 }
125 (
126 let
127 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
128 in
129 {
130 environment.variables = {
131 CURL_CA_BUNDLE = ca-bundle;
132 GIT_SSL_CAINFO = ca-bundle;
133 SSL_CERT_FILE = ca-bundle;
134 };
135 }
136 )
137 (
138 # binary cache of the neoprism build farm (configs/nix-farm). The key
139 # only exists once `clan vars generate neoprism` has run; until then
140 # the cache is left out.
141 let
142 pub = self + "/vars/per-machine/neoprism/nix-cache-signing/key.pub/value";
143 in
144 lib.mkIf (builtins.pathExists pub) {
145 nix.settings.extra-substituters = [ "https://cache.lassul.us" ];
146 nix.settings.extra-trusted-public-keys = [ (lib.removeSuffix "\n" (builtins.readFile pub)) ];
147 }
148 )
149 {
150 #for sshuttle
151 environment.systemPackages = [
152 pkgs.python3Packages.python
153 ];
154 }
155 ];
156
157 networking.hostName = config.clan.core.settings.machine.name;
158
159 users.mutableUsers = false;
160
161 # multiple-definition-problem when defining environment.variables.EDITOR
162 environment.extraInit = ''
163 EDITOR=vim
164 '';
165
166 nixpkgs.config.allowUnfree = true;
167
168 environment.systemPackages = with pkgs; [
169 self.packages.${pkgs.system}.nvim
170 self.packages.${pkgs.system}.tmux
171 self.packages.${pkgs.system}.s
172
173 git
174 git-absorb
175 gnumake
176 jq
177 nix-output-monitor
178 comma
179
180 #style
181 rxvt-unicode-unwrapped.terminfo
182 alacritty.terminfo
183
184 #monitoring tools
185 htop
186 iotop
187
188 #network
189 iptables
190 iftop
191 tcpdump
192 mosh
193 self.packages.${pkgs.system}.sshify
194
195 #stuff for dl
196 aria2
197
198 #neat utils
199 file
200 xkcdpass
201 selfPkgs.kpaste
202 selfPkgs.cyberlocker-tools
203 pciutils
204 pop
205 selfPkgs.untilport
206 (pkgs.writers.writeDashBin "urgent" ''
207 printf '\a'
208 '')
209 usbutils
210
211 #unpack stuff
212 libarchive
213
214 (pkgs.writers.writeDashBin "sshn" ''
215 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
216 '')
217 ];
218
219 environment.shellAliases = {
220 ll = "ls -l";
221 la = "ls -la";
222 ls = "ls --color";
223 ip = "ip -color=auto";
224 grep = "grep --color=auto";
225 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
226 };
227
228 programs.bash = {
229 completion.enable = true;
230 interactiveShellInit = ''
231 HISTCONTROL='erasedups:ignorespace'
232 HISTSIZE=65536
233 HISTFILESIZE=$HISTSIZE
234
235 shopt -s checkhash
236 shopt -s histappend histreedit histverify
237 shopt -s no_empty_cmd_completion
238 complete -d cd
239 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
240 '';
241 promptInit = ''
242 if test $UID = 0; then
243 PS1='\[\033[1;31m\]\w\[\033[0m\] '
244 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
245 elif test $UID = 1337; then
246 PS1='\[\033[1;32m\]\w\[\033[0m\] '
247 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
248 else
249 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
250 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
251 fi
252 if test -n "$SSH_CLIENT"; then
253 PS1='\[\033[35m\]\h'" $PS1"
254 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
255 fi
256 '';
257 };
258
259 services.journald.settings.Journal = {
260 SystemMaxUse = "1G";
261 RuntimeMaxUse = "128M";
262 Storage = "persistent";
263 };
264
265 # nftables based NixOS firewall. Input and forward drop by default, as
266 # krebs.iptables did; no reverse path filter either, the routers,
267 # container hosts and NAT64 boxes route asymmetrically.
268 networking.nftables = {
269 enable = true;
270 # Defaults to true on machines older than 23.11, which would also wipe
271 # the tables libvirt, podman and jool keep on every reload.
272 flushRuleset = false;
273 # krebs.iptables loaded its rules through iptables-nft into these
274 # tables; nothing removes them when it goes away. Drop once every
275 # machine has switched to nftables.
276 extraDeletions = ''
277 table ip filter
278 delete table ip filter
279 table ip6 filter
280 delete table ip6 filter
281 table ip nat
282 delete table ip nat
283 table ip6 nat
284 delete table ip6 nat
285 '';
286 };
287 networking.firewall = {
288 filterForward = lib.mkDefault true;
289 checkReversePath = false;
290 # all of ICMP, not just echo-request, like krebs.iptables
291 extraInputRules = ''
292 meta l4proto icmp accept
293 '';
294 };
295
296 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
297 networking.firewall.allowedUDPPortRanges = [
298 {
299 from = 60000;
300 to = 61000;
301 }
302 ]; # mosh
303 networking.extraHosts = ''
304 10.42.0.1 acheron.gg23
305 10.42.0.3 styx.gg23
306 '';
307
308 # use 24:00 time format, the default got sneakily changed around 20.03
309 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
310 time.timeZone = lib.mkDefault "Europe/Berlin";
311
312 # disable doc usually
313 documentation.nixos.enable = lib.mkDefault false;
314}