This repository has no description
8.8 kB
341 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 # Clan core configuration
10 clan.core.facts.secretStore = "password-store";
11 clan.core.facts.secretUploadDirectory = lib.mkDefault "/etc/secrets";
12 clan.core.vars.settings.secretStore = "password-store";
13 clan.core.networking.targetHost = "root@${config.networking.hostName}";
14
15 # Stockholm configuration
16 krebs.secret.directory = config.clan.core.facts.secretUploadDirectory;
17
18 # Nixpkgs overlays
19 nixpkgs.overlays = [
20 self.inputs.stockholm.overlays.default
21 (import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
22 ];
23
24 imports = [
25 # Import 3modules
26 ../3modules
27
28 # Import stockholm krebs module
29 self.inputs.stockholm.nixosModules.krebs
30
31 # Import individual configurations
32 ./security-workarounds.nix
33 # ./binary-cache/client.nix
34 ./gc.nix
35 ./mc.nix
36 ./zsh.nix
37 ./htop.nix
38 ./tor-ssh.nix
39 ./networkd.nix
40 ./pinned-registry.nix
41 ./zerotier.nix
42 ./nether.nix
43 ./nix.nix
44
45 # Import stockholm modules
46 self.inputs.stockholm.nixosModules.users
47 self.inputs.stockholm.nixosModules.hosts
48 self.inputs.stockholm.nixosModules.kartei
49 self.inputs.stockholm.nixosModules.build
50 self.inputs.stockholm.nixosModules.dns
51 self.inputs.stockholm.nixosModules.exim
52 self.inputs.stockholm.nixosModules.exim-retiolum
53 self.inputs.stockholm.nixosModules.tinc
54 self.inputs.stockholm.nixosModules.iptables
55 self.inputs.stockholm.nixosModules.power-action
56 self.inputs.stockholm.nixosModules.setuid
57 self.inputs.stockholm.nixosModules.secret
58 self.inputs.stockholm.nixosModules.sitemap
59 self.inputs.stockholm.nixosModules.ssl
60 self.inputs.stockholm.nixosModules.systemd
61 self.inputs.stockholm.nixosModules.ssh
62 self.inputs.stockholm.nixosModules.sync-containers3
63 {
64 # nix-index
65 imports = [
66 self.inputs.nix-index-database.nixosModules.nix-index
67 ];
68 programs.nix-index-database.comma.enable = true;
69 }
70 {
71 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
72 users.extraUsers.mainUser.hashedPasswordFile =
73 config.clan.core.vars.generators.password.files.passwordHash.path;
74 users.extraUsers.root.hashedPasswordFile =
75 config.clan.core.vars.generators.password.files.passwordHash.path;
76 boot.initrd.systemd.emergencyAccess = true;
77 clan.core.vars.generators.password = {
78 prompts.password = {
79 description = "Password for the main user";
80 type = "hidden";
81 };
82 files.password.deploy = false;
83 files.passwordHash.neededFor = "users";
84 migrateFact = "password";
85 runtimeInputs = with pkgs; [
86 coreutils
87 mkpasswd
88 ];
89 script = ''
90 cp $prompts/password $out/password
91 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
92 '';
93 };
94 }
95 {
96 services.openssh.enable = true;
97 services.openssh.settings.PasswordAuthentication = false;
98 services.openssh.hostKeys = [
99 {
100 path = config.clanCore.vars.generators.ssh.files."ssh.id_ed25519".path;
101 type = "ed25519";
102 }
103 ];
104 clan.core.vars.generators.ssh = {
105 files."ssh.id_ed25519".secret = true;
106 files."ssh.id_ed25519.pub".secret = false;
107 migrateFact = "ssh";
108 runtimeInputs = with pkgs; [
109 coreutils
110 openssh
111 ];
112 script = ''
113 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
114 '';
115 };
116 }
117 {
118 users.extraUsers = {
119 root = {
120 openssh.authorizedKeys.keys = [
121 self.keys.ssh.barnacle.public
122 self.keys.ssh.yubi_pgp.public
123 self.keys.ssh.yubi1.public
124 self.keys.ssh.yubi2.public
125 self.keys.ssh.solo2.public
126 self.keys.ssh.xerxes.public
127 ];
128 };
129 mainUser = {
130 name = "lass";
131 uid = 1337;
132 home = "/home/lass";
133 group = "users";
134 createHome = true;
135 useDefaultShell = true;
136 isNormalUser = true;
137 extraGroups = [
138 "audio"
139 "video"
140 "fuse"
141 "wheel"
142 "tor"
143 "dialout"
144 ];
145 openssh.authorizedKeys.keys = [
146 self.keys.ssh.barnacle.public
147 self.keys.ssh.yubi_pgp.public
148 self.keys.ssh.yubi1.public
149 self.keys.ssh.yubi2.public
150 self.keys.ssh.solo2.public
151 self.keys.ssh.xerxes.public
152 ];
153 };
154 };
155 }
156 (
157 let
158 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
159 in
160 {
161 environment.variables = {
162 CURL_CA_BUNDLE = ca-bundle;
163 GIT_SSL_CAINFO = ca-bundle;
164 SSL_CERT_FILE = ca-bundle;
165 };
166 }
167 )
168 {
169 #for sshuttle
170 environment.systemPackages = [
171 pkgs.python3Packages.python
172 ];
173 }
174 ];
175
176 networking.hostName = config.krebs.build.host.name;
177
178 krebs = {
179 enable = true;
180 build.user = config.krebs.users.lass;
181 ssl.trustIntermediate = true;
182 };
183
184 users.mutableUsers = false;
185
186 # multiple-definition-problem when defining environment.variables.EDITOR
187 environment.extraInit = ''
188 EDITOR=vim
189 '';
190
191 nixpkgs.config.allowUnfree = true;
192
193 environment.systemPackages = with pkgs; [
194 self.packages.${pkgs.system}.nvim
195 self.packages.${pkgs.system}.tmux
196
197 git
198 git-absorb
199 git-preview
200 gnumake
201 jq
202 nix-output-monitor
203 comma
204
205 #style
206 rxvt-unicode-unwrapped.terminfo
207 alacritty.terminfo
208
209 #monitoring tools
210 htop
211 iotop
212
213 #network
214 iptables
215 iftop
216 tcpdump
217 mosh
218 eternal-terminal
219 self.packages.${pkgs.system}.sshify
220
221 #stuff for dl
222 aria2
223
224 #neat utils
225 file
226 hashPassword
227 xkcdpass
228 kpaste
229 cyberlocker-tools
230 pciutils
231 pop
232 q
233 untilport
234 (pkgs.writeDashBin "urgent" ''
235 printf '\a'
236 '')
237 usbutils
238 self.packages.${pkgs.system}.logify
239 goify
240
241 #unpack stuff
242 libarchive
243
244 (pkgs.writeDashBin "sshn" ''
245 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
246 '')
247 ];
248
249 environment.shellAliases = {
250 ll = "ls -l";
251 la = "ls -la";
252 ls = "ls --color";
253 ip = "ip -color=auto";
254 grep = "grep --color=auto";
255 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
256 };
257
258 programs.bash = {
259 completion.enable = true;
260 interactiveShellInit = ''
261 HISTCONTROL='erasedups:ignorespace'
262 HISTSIZE=65536
263 HISTFILESIZE=$HISTSIZE
264
265 shopt -s checkhash
266 shopt -s histappend histreedit histverify
267 shopt -s no_empty_cmd_completion
268 complete -d cd
269 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
270 '';
271 promptInit = ''
272 if test $UID = 0; then
273 PS1='\[\033[1;31m\]\w\[\033[0m\] '
274 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
275 elif test $UID = 1337; then
276 PS1='\[\033[1;32m\]\w\[\033[0m\] '
277 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
278 else
279 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
280 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
281 fi
282 if test -n "$SSH_CLIENT"; then
283 PS1='\[\033[35m\]\h'" $PS1"
284 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
285 fi
286 '';
287 };
288
289 services.journald.extraConfig = ''
290 SystemMaxUse=1G
291 RuntimeMaxUse=128M
292 Storage=persistent
293 '';
294
295 krebs.iptables = {
296 enable = true;
297 tables = {
298 filter.INPUT.policy = "DROP";
299 filter.FORWARD.policy = lib.mkDefault "DROP";
300 filter.INPUT.rules = lib.mkMerge [
301 (lib.mkBefore [
302 {
303 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
304 target = "ACCEPT";
305 }
306 {
307 predicate = "-p icmp";
308 target = "ACCEPT";
309 }
310 {
311 predicate = "-p ipv6-icmp";
312 target = "ACCEPT";
313 v4 = false;
314 }
315 {
316 predicate = "-i lo";
317 target = "ACCEPT";
318 }
319 ])
320 ];
321 };
322 };
323
324 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
325 networking.firewall.allowedUDPPortRanges = [
326 {
327 from = 60000;
328 to = 61000;
329 }
330 ]; # mosh
331 networking.extraHosts = ''
332 10.42.0.1 styx.gg23
333 '';
334
335 # use 24:00 time format, the default got sneakily changed around 20.03
336 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
337 time.timeZone = lib.mkDefault "Europe/Berlin";
338
339 # disable doc usually
340 documentation.nixos.enable = lib.mkDefault false;
341}