This repository has no description
9.8 kB
392 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 imports = [
10 ./security-workarounds.nix
11 ./binary-cache/client.nix
12 ./gc.nix
13 ./mc.nix
14 ./zsh.nix
15 ./htop.nix
16 ./wiregrill.nix
17 ./tmux.nix
18 ./tor-ssh.nix
19 ./networkd.nix
20 ./pinned-registry.nix
21 ./zerotier.nix
22 ./nether.nix
23 ./spora.nix
24 self.inputs.stockholm.nixosModules.users
25 self.inputs.stockholm.nixosModules.hosts
26 self.inputs.stockholm.nixosModules.kartei
27 self.inputs.stockholm.nixosModules.build
28 self.inputs.stockholm.nixosModules.dns
29 self.inputs.stockholm.nixosModules.exim
30 self.inputs.stockholm.nixosModules.exim-retiolum
31 self.inputs.stockholm.nixosModules.tinc
32 self.inputs.stockholm.nixosModules.iptables
33 self.inputs.stockholm.nixosModules.power-action
34 self.inputs.stockholm.nixosModules.setuid
35 self.inputs.stockholm.nixosModules.secret
36 self.inputs.stockholm.nixosModules.sitemap
37 self.inputs.stockholm.nixosModules.ssl
38 self.inputs.stockholm.nixosModules.systemd
39 self.inputs.stockholm.nixosModules.xresources
40 self.inputs.stockholm.nixosModules.ssh
41 self.inputs.stockholm.nixosModules.sync-containers3
42 {
43 users.extraUsers.mainUser.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
44 users.extraUsers.root.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
45 clanCore.facts.services.password = {
46 secret.password = { };
47 secret.passwordHash = { };
48 generator.path = with pkgs; [
49 coreutils
50 xkcdpass
51 mkpasswd
52 ];
53 generator.script = ''
54 xkcdpass -n 4 -d - > $secrets/password
55 cat $secrets/password | mkpasswd -s -m sha-512 > $secrets/passwordHash
56 '';
57 };
58 }
59 {
60 clan.core.vars.settings.secretStore = "password-store";
61 clan.core.vars.generators.testing = {
62 files.testaaa = { };
63 runtimeInputs = with pkgs; [ coreutils ];
64 script = ''
65 echo lol > $out/testaaa
66 '';
67 };
68 }
69 {
70 # deployment information
71 options.clan.flake-inputs = lib.mkOption {
72 description = ''
73 information about the flake inputs.
74 Used for update tracking.
75 '';
76 type = lib.types.attrsOf (
77 lib.types.attrsOf (
78 lib.types.nullOr (
79 lib.types.oneOf [
80 lib.types.str
81 lib.types.int
82 ]
83 )
84 )
85 );
86 default =
87 let
88 inputs = config.clan.core.clanDir.inputs;
89 cleanSourceInfo = input: {
90 rev = input.rev or null;
91 dirtyRev = input.dirtyRev or null;
92 lastModified = input.lastModified or null;
93 narHash = input.narHash or null;
94 };
95 sourceInfo = lib.mapAttrs (_: input: cleanSourceInfo input) inputs;
96 in
97 sourceInfo
98 // {
99 self = cleanSourceInfo config.clan.core.clanDir.sourceInfo;
100 };
101 };
102 config.environment.etc."flake-inputs.json".text =
103 let
104 text = builtins.unsafeDiscardStringContext (builtins.toJSON config.clan.flake-inputs);
105 in
106 text;
107 }
108 {
109 services.openssh.enable = true;
110 services.openssh.hostKeys = [
111 {
112 path = config.clanCore.facts.services.ssh.secret."ssh.id_ed25519".path;
113 type = "ed25519";
114 }
115 ];
116 clanCore.facts.services.ssh = {
117 secret."ssh.id_ed25519" = { };
118 public."ssh.id_ed25519.pub" = { };
119 generator.path = with pkgs; [
120 coreutils
121 openssh
122 ];
123 generator.script = ''
124 ssh-keygen -t ed25519 -N "" -f $secrets/ssh.id_ed25519
125 mv $secrets/ssh.id_ed25519.pub $facts/ssh.id_ed25519.pub
126 '';
127 };
128 }
129 {
130 users.extraUsers = {
131 root = {
132 openssh.authorizedKeys.keys = [
133 config.krebs.users.lass.pubkey
134 ];
135 };
136 mainUser = {
137 name = "lass";
138 uid = 1337;
139 home = "/home/lass";
140 group = "users";
141 createHome = true;
142 useDefaultShell = true;
143 isNormalUser = true;
144 extraGroups = [
145 "audio"
146 "video"
147 "fuse"
148 "wheel"
149 "tor"
150 ];
151 openssh.authorizedKeys.keys = [
152 config.krebs.users.lass.pubkey
153 ];
154 };
155 };
156 }
157 (
158 let
159 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
160 in
161 {
162 environment.variables = {
163 CURL_CA_BUNDLE = ca-bundle;
164 GIT_SSL_CAINFO = ca-bundle;
165 SSL_CERT_FILE = ca-bundle;
166 };
167 }
168 )
169 {
170 #for sshuttle
171 environment.systemPackages = [
172 pkgs.python3Packages.python
173 ];
174 }
175 ];
176
177 networking.hostName = config.krebs.build.host.name;
178
179 krebs = {
180 enable = true;
181 build.user = config.krebs.users.lass;
182 ssl.trustIntermediate = true;
183 };
184
185 nix.settings.sandbox = true;
186
187 users.mutableUsers = false;
188
189 # multiple-definition-problem when defining environment.variables.EDITOR
190 environment.extraInit = ''
191 EDITOR=vim
192 '';
193
194 nixpkgs.config.allowUnfree = true;
195
196 environment.systemPackages = with pkgs; [
197 self.packages.${pkgs.system}.nvim
198
199 git
200 git-absorb
201 git-preview
202 gnumake
203 jq
204 nix-output-monitor
205
206 #style
207 rxvt-unicode-unwrapped.terminfo
208 alacritty.terminfo
209
210 #monitoring tools
211 htop
212 iotop
213
214 #network
215 iptables
216 iftop
217 tcpdump
218 mosh
219 eternal-terminal
220 self.packages.${pkgs.system}.sshify
221
222 #stuff for dl
223 aria2
224
225 #neat utils
226 file
227 hashPassword
228 xkcdpass
229 kpaste
230 cyberlocker-tools
231 pciutils
232 pop
233 q
234 rs
235 untilport
236 (pkgs.writeDashBin "urgent" ''
237 printf '\a'
238 '')
239 usbutils
240 self.packages.${pkgs.system}.logify
241 goify
242
243 #unpack stuff
244 libarchive
245
246 (pkgs.writeDashBin "sshn" ''
247 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
248 '')
249 ];
250
251 environment.shellAliases = {
252 ll = "ls -l";
253 la = "ls -la";
254 ls = "ls --color";
255 ip = "ip -color=auto";
256 grep = "grep --color=auto";
257 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
258 };
259
260 programs.bash = {
261 enableCompletion = true;
262 interactiveShellInit = ''
263 HISTCONTROL='erasedups:ignorespace'
264 HISTSIZE=65536
265 HISTFILESIZE=$HISTSIZE
266
267 shopt -s checkhash
268 shopt -s histappend histreedit histverify
269 shopt -s no_empty_cmd_completion
270 complete -d cd
271 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
272 '';
273 promptInit = ''
274 if test $UID = 0; then
275 PS1='\[\033[1;31m\]\w\[\033[0m\] '
276 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
277 elif test $UID = 1337; then
278 PS1='\[\033[1;32m\]\w\[\033[0m\] '
279 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
280 else
281 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
282 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
283 fi
284 if test -n "$SSH_CLIENT"; then
285 PS1='\[\033[35m\]\h'" $PS1"
286 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
287 fi
288 '';
289 };
290
291 services.journald.extraConfig = ''
292 SystemMaxUse=1G
293 RuntimeMaxUse=128M
294 Storage=persistent
295 '';
296
297 krebs.iptables = {
298 enable = true;
299 tables = {
300 filter.INPUT.policy = "DROP";
301 filter.FORWARD.policy = lib.mkDefault "DROP";
302 filter.INPUT.rules = lib.mkMerge [
303 (lib.mkBefore [
304 {
305 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
306 target = "ACCEPT";
307 }
308 {
309 predicate = "-p icmp";
310 target = "ACCEPT";
311 }
312 {
313 predicate = "-p ipv6-icmp";
314 target = "ACCEPT";
315 v4 = false;
316 }
317 {
318 predicate = "-i lo";
319 target = "ACCEPT";
320 }
321 {
322 predicate = "-p tcp --dport 22";
323 target = "ACCEPT";
324 }
325 ])
326 (lib.mkOrder 1000 [
327 {
328 predicate = "-p udp --dport 60000:61000";
329 target = "ACCEPT";
330 } # mosh
331 {
332 predicate = "-i retiolum -p udp -m udp --dport 53";
333 target = "ACCEPT";
334 }
335 {
336 predicate = "-i retiolum -p tcp --dport 19999";
337 target = "ACCEPT";
338 }
339 ])
340 (lib.mkAfter [
341 {
342 predicate = "-p tcp -i retiolum";
343 target = "REJECT --reject-with tcp-reset";
344 }
345 {
346 predicate = "-p udp -i retiolum";
347 target = "REJECT --reject-with icmp-port-unreachable";
348 v6 = false;
349 }
350 {
351 predicate = "-i retiolum";
352 target = "REJECT --reject-with icmp-proto-unreachable";
353 v6 = false;
354 }
355 ])
356 ];
357 };
358 };
359
360 networking.dhcpcd.extraConfig = ''
361 noipv4ll
362 '';
363
364 networking.extraHosts = ''
365 10.42.0.1 styx.gg23
366 '';
367
368 nix.settings.experimental-features = [
369 "nix-command"
370 "flakes"
371 ];
372
373 # use 24:00 time format, the default got sneakily changed around 20.03
374 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
375 time.timeZone = lib.mkDefault "Europe/Berlin";
376
377 # disable doc usually
378 documentation.nixos.enable = lib.mkDefault false;
379
380 # use new rebuild switch
381 system.switch = {
382 enable = false;
383 enableNg = true;
384 };
385
386 # use latest nix to hunt all the bugs
387 nix.package = pkgs.nixVersions.latest;
388
389 # workaround for systemd freezing up when suspending
390 # https://github.com/systemd/systemd/issues/33083
391 environment.variables.SYSTEMD_SLEEP_FREEZE_USER_SESSIONS = "false";
392}