This repository has no description
8.4 kB
330 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 # Stockholm configuration
10 krebs.secret.directory = config.clan.core.vars.password-store.secretLocation;
11
12 # Nixpkgs overlays
13 nixpkgs.overlays = [
14 self.inputs.stockholm.overlays.default
15 (import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
16 ];
17
18 imports = [
19 # Import 3modules
20 ../3modules
21
22 # Import stockholm krebs module
23 self.inputs.stockholm.nixosModules.krebs
24
25 # Import individual configurations
26 ./security-workarounds.nix
27 # ./binary-cache/client.nix
28 ./gc.nix
29 ./mc.nix
30 ./zsh.nix
31 ./htop.nix
32 ./tor-ssh.nix
33 ./networkd.nix
34 ./pinned-registry.nix
35 ./nix.nix
36
37 # Import stockholm modules
38 self.inputs.stockholm.nixosModules.users
39 self.inputs.stockholm.nixosModules.hosts
40 self.inputs.stockholm.nixosModules.kartei
41 self.inputs.stockholm.nixosModules.build
42 self.inputs.stockholm.nixosModules.dns
43 self.inputs.stockholm.nixosModules.iptables
44 self.inputs.stockholm.nixosModules.secret
45 self.inputs.stockholm.nixosModules.setuid
46 self.inputs.stockholm.nixosModules.sitemap
47 self.inputs.stockholm.nixosModules.ssl
48 self.inputs.stockholm.nixosModules.systemd
49 self.inputs.stockholm.nixosModules.ssh
50 {
51 # nix-index
52 imports = [
53 self.inputs.nix-index-database.nixosModules.nix-index
54 ];
55 programs.nix-index-database.comma.enable = true;
56 }
57 {
58 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
59 users.extraUsers.mainUser.hashedPasswordFile =
60 config.clan.core.vars.generators.password.files.passwordHash.path;
61 users.extraUsers.root.hashedPasswordFile =
62 config.clan.core.vars.generators.password.files.passwordHash.path;
63 boot.initrd.systemd.emergencyAccess = true;
64 clan.core.vars.generators.password = {
65 prompts.password = {
66 description = "Password for the main user";
67 type = "hidden";
68 };
69 files.password.deploy = false;
70 files.passwordHash.neededFor = "users";
71 runtimeInputs = with pkgs; [
72 coreutils
73 mkpasswd
74 ];
75 script = ''
76 cp $prompts/password $out/password
77 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
78 '';
79 };
80 }
81 {
82 services.openssh.enable = true;
83 services.openssh.settings.PasswordAuthentication = false;
84 services.openssh.hostKeys = [
85 {
86 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
87 type = "ed25519";
88 }
89 ];
90 clan.core.vars.generators.ssh = {
91 files."ssh.id_ed25519" = { };
92 files."ssh.id_ed25519.pub".secret = false;
93 runtimeInputs = with pkgs; [
94 coreutils
95 openssh
96 ];
97 script = ''
98 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
99 '';
100 };
101 }
102 {
103 users.extraUsers = {
104 root = {
105 openssh.authorizedKeys.keys = [
106 self.keys.ssh.barnacle.public
107 self.keys.ssh.yubi_pgp.public
108 self.keys.ssh.termux_massulus.public
109 self.keys.ssh.yubi1.public
110 self.keys.ssh.yubi2.public
111 self.keys.ssh.solo2.public
112 self.keys.ssh.xerxes.public
113 self.keys.ssh.ignavia.public
114 ];
115 };
116 mainUser = {
117 name = "lass";
118 uid = 1337;
119 home = "/home/lass";
120 group = "users";
121 createHome = true;
122 useDefaultShell = true;
123 isNormalUser = true;
124 linger = true;
125 extraGroups = [
126 "audio"
127 "video"
128 "fuse"
129 "wheel"
130 "tor"
131 "dialout"
132 ];
133 openssh.authorizedKeys.keys = [
134 self.keys.ssh.barnacle.public
135 self.keys.ssh.yubi_pgp.public
136 self.keys.ssh.termux_massulus.public
137 self.keys.ssh.yubi1.public
138 self.keys.ssh.yubi2.public
139 self.keys.ssh.solo2.public
140 self.keys.ssh.xerxes.public
141 self.keys.ssh.ignavia.public
142 ];
143 };
144 };
145 }
146 (
147 let
148 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
149 in
150 {
151 environment.variables = {
152 CURL_CA_BUNDLE = ca-bundle;
153 GIT_SSL_CAINFO = ca-bundle;
154 SSL_CERT_FILE = ca-bundle;
155 };
156 }
157 )
158 {
159 #for sshuttle
160 environment.systemPackages = [
161 pkgs.python3Packages.python
162 ];
163 }
164 ];
165
166 networking.hostName = config.krebs.build.host.name;
167
168 krebs = {
169 enable = true;
170 build.user = config.krebs.users.lass;
171 ssl.trustIntermediate = true;
172 };
173
174 users.mutableUsers = false;
175
176 # multiple-definition-problem when defining environment.variables.EDITOR
177 environment.extraInit = ''
178 EDITOR=vim
179 '';
180
181 nixpkgs.config.allowUnfree = true;
182
183 environment.systemPackages = with pkgs; [
184 self.packages.${pkgs.system}.nvim
185 self.packages.${pkgs.system}.tmux
186 self.packages.${pkgs.system}.s
187
188 git
189 git-absorb
190 gnumake
191 jq
192 nix-output-monitor
193 comma
194
195 #style
196 rxvt-unicode-unwrapped.terminfo
197 alacritty.terminfo
198
199 #monitoring tools
200 htop
201 iotop
202
203 #network
204 iptables
205 iftop
206 tcpdump
207 mosh
208 eternal-terminal
209 self.packages.${pkgs.system}.sshify
210
211 #stuff for dl
212 aria2
213
214 #neat utils
215 file
216 xkcdpass
217 kpaste
218 cyberlocker-tools
219 pciutils
220 pop
221 q
222 untilport
223 (pkgs.writeDashBin "urgent" ''
224 printf '\a'
225 '')
226 usbutils
227 goify
228
229 #unpack stuff
230 libarchive
231
232 (pkgs.writeDashBin "sshn" ''
233 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
234 '')
235 ];
236
237 environment.shellAliases = {
238 ll = "ls -l";
239 la = "ls -la";
240 ls = "ls --color";
241 ip = "ip -color=auto";
242 grep = "grep --color=auto";
243 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
244 };
245
246 programs.bash = {
247 completion.enable = true;
248 interactiveShellInit = ''
249 HISTCONTROL='erasedups:ignorespace'
250 HISTSIZE=65536
251 HISTFILESIZE=$HISTSIZE
252
253 shopt -s checkhash
254 shopt -s histappend histreedit histverify
255 shopt -s no_empty_cmd_completion
256 complete -d cd
257 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
258 '';
259 promptInit = ''
260 if test $UID = 0; then
261 PS1='\[\033[1;31m\]\w\[\033[0m\] '
262 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
263 elif test $UID = 1337; then
264 PS1='\[\033[1;32m\]\w\[\033[0m\] '
265 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
266 else
267 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
268 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
269 fi
270 if test -n "$SSH_CLIENT"; then
271 PS1='\[\033[35m\]\h'" $PS1"
272 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
273 fi
274 '';
275 };
276
277 services.journald.settings.Journal = {
278 SystemMaxUse = "1G";
279 RuntimeMaxUse = "128M";
280 Storage = "persistent";
281 };
282
283 krebs.iptables = {
284 enable = true;
285 tables = {
286 filter.INPUT.policy = "DROP";
287 filter.FORWARD.policy = lib.mkDefault "DROP";
288 filter.INPUT.rules = lib.mkMerge [
289 (lib.mkBefore [
290 {
291 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
292 target = "ACCEPT";
293 }
294 {
295 predicate = "-p icmp";
296 target = "ACCEPT";
297 }
298 {
299 predicate = "-p ipv6-icmp";
300 target = "ACCEPT";
301 v4 = false;
302 }
303 {
304 predicate = "-i lo";
305 target = "ACCEPT";
306 }
307 ])
308 ];
309 };
310 };
311
312 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
313 networking.firewall.allowedUDPPortRanges = [
314 {
315 from = 60000;
316 to = 61000;
317 }
318 ]; # mosh
319 networking.extraHosts = ''
320 10.42.0.1 acheron.gg23
321 10.42.0.3 styx.gg23
322 '';
323
324 # use 24:00 time format, the default got sneakily changed around 20.03
325 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
326 time.timeZone = lib.mkDefault "Europe/Berlin";
327
328 # disable doc usually
329 documentation.nixos.enable = lib.mkDefault false;
330}