This repository has no description
8.2 kB
328 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 # Stockholm configuration
10 krebs.secret.directory = config.clan.core.vars.password-store.secretLocation;
11
12 # Nixpkgs overlays
13 nixpkgs.overlays = [
14 self.inputs.stockholm.overlays.default
15 (import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
16 ];
17
18 imports = [
19 # Import 3modules
20 ../3modules
21
22 # Import stockholm krebs module
23 self.inputs.stockholm.nixosModules.krebs
24
25 # Import individual configurations
26 ./security-workarounds.nix
27 # ./binary-cache/client.nix
28 ./gc.nix
29 ./mc.nix
30 ./zsh.nix
31 ./htop.nix
32 ./tor-ssh.nix
33 ./networkd.nix
34 ./pinned-registry.nix
35 ./zerotier.nix
36 ./nether.nix
37 ./nix.nix
38
39 # Import stockholm modules
40 self.inputs.stockholm.nixosModules.users
41 self.inputs.stockholm.nixosModules.hosts
42 self.inputs.stockholm.nixosModules.kartei
43 self.inputs.stockholm.nixosModules.build
44 self.inputs.stockholm.nixosModules.dns
45 self.inputs.stockholm.nixosModules.tinc
46 self.inputs.stockholm.nixosModules.iptables
47 self.inputs.stockholm.nixosModules.secret
48 self.inputs.stockholm.nixosModules.setuid
49 self.inputs.stockholm.nixosModules.sitemap
50 self.inputs.stockholm.nixosModules.ssl
51 self.inputs.stockholm.nixosModules.systemd
52 self.inputs.stockholm.nixosModules.ssh
53 {
54 # nix-index
55 imports = [
56 self.inputs.nix-index-database.nixosModules.nix-index
57 ];
58 programs.nix-index-database.comma.enable = true;
59 }
60 {
61 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
62 users.extraUsers.mainUser.hashedPasswordFile =
63 config.clan.core.vars.generators.password.files.passwordHash.path;
64 users.extraUsers.root.hashedPasswordFile =
65 config.clan.core.vars.generators.password.files.passwordHash.path;
66 boot.initrd.systemd.emergencyAccess = true;
67 clan.core.vars.generators.password = {
68 prompts.password = {
69 description = "Password for the main user";
70 type = "hidden";
71 };
72 files.password.deploy = false;
73 files.passwordHash.neededFor = "users";
74 runtimeInputs = with pkgs; [
75 coreutils
76 mkpasswd
77 ];
78 script = ''
79 cp $prompts/password $out/password
80 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
81 '';
82 };
83 }
84 {
85 services.openssh.enable = true;
86 services.openssh.settings.PasswordAuthentication = false;
87 services.openssh.hostKeys = [
88 {
89 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
90 type = "ed25519";
91 }
92 ];
93 clan.core.vars.generators.ssh = {
94 files."ssh.id_ed25519" = { };
95 files."ssh.id_ed25519.pub".secret = false;
96 runtimeInputs = with pkgs; [
97 coreutils
98 openssh
99 ];
100 script = ''
101 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
102 '';
103 };
104 }
105 {
106 users.extraUsers = {
107 root = {
108 openssh.authorizedKeys.keys = [
109 self.keys.ssh.barnacle.public
110 self.keys.ssh.yubi_pgp.public
111 self.keys.ssh.yubi1.public
112 self.keys.ssh.yubi2.public
113 self.keys.ssh.solo2.public
114 self.keys.ssh.xerxes.public
115 self.keys.ssh.massulus.public
116 ];
117 };
118 mainUser = {
119 name = "lass";
120 uid = 1337;
121 home = "/home/lass";
122 group = "users";
123 createHome = true;
124 useDefaultShell = true;
125 isNormalUser = true;
126 extraGroups = [
127 "audio"
128 "video"
129 "fuse"
130 "wheel"
131 "tor"
132 "dialout"
133 ];
134 openssh.authorizedKeys.keys = [
135 self.keys.ssh.barnacle.public
136 self.keys.ssh.yubi_pgp.public
137 self.keys.ssh.yubi1.public
138 self.keys.ssh.yubi2.public
139 self.keys.ssh.solo2.public
140 self.keys.ssh.xerxes.public
141 self.keys.ssh.massulus.public
142 ];
143 };
144 };
145 }
146 (
147 let
148 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
149 in
150 {
151 environment.variables = {
152 CURL_CA_BUNDLE = ca-bundle;
153 GIT_SSL_CAINFO = ca-bundle;
154 SSL_CERT_FILE = ca-bundle;
155 };
156 }
157 )
158 {
159 #for sshuttle
160 environment.systemPackages = [
161 pkgs.python3Packages.python
162 ];
163 }
164 ];
165
166 networking.hostName = config.krebs.build.host.name;
167
168 krebs = {
169 enable = true;
170 build.user = config.krebs.users.lass;
171 ssl.trustIntermediate = true;
172 };
173
174 users.mutableUsers = false;
175
176 # multiple-definition-problem when defining environment.variables.EDITOR
177 environment.extraInit = ''
178 EDITOR=vim
179 '';
180
181 nixpkgs.config.allowUnfree = true;
182
183 environment.systemPackages = with pkgs; [
184 self.packages.${pkgs.system}.nvim
185 self.packages.${pkgs.system}.tmux
186
187 git
188 git-absorb
189 gnumake
190 jq
191 nix-output-monitor
192 comma
193
194 #style
195 rxvt-unicode-unwrapped.terminfo
196 alacritty.terminfo
197
198 #monitoring tools
199 htop
200 iotop
201
202 #network
203 iptables
204 iftop
205 tcpdump
206 mosh
207 eternal-terminal
208 self.packages.${pkgs.system}.sshify
209
210 #stuff for dl
211 aria2
212
213 #neat utils
214 file
215 xkcdpass
216 kpaste
217 cyberlocker-tools
218 pciutils
219 pop
220 q
221 untilport
222 (pkgs.writeDashBin "urgent" ''
223 printf '\a'
224 '')
225 usbutils
226 goify
227
228 #unpack stuff
229 libarchive
230
231 (pkgs.writeDashBin "sshn" ''
232 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
233 '')
234 ];
235
236 environment.shellAliases = {
237 ll = "ls -l";
238 la = "ls -la";
239 ls = "ls --color";
240 ip = "ip -color=auto";
241 grep = "grep --color=auto";
242 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
243 };
244
245 programs.bash = {
246 completion.enable = true;
247 interactiveShellInit = ''
248 HISTCONTROL='erasedups:ignorespace'
249 HISTSIZE=65536
250 HISTFILESIZE=$HISTSIZE
251
252 shopt -s checkhash
253 shopt -s histappend histreedit histverify
254 shopt -s no_empty_cmd_completion
255 complete -d cd
256 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
257 '';
258 promptInit = ''
259 if test $UID = 0; then
260 PS1='\[\033[1;31m\]\w\[\033[0m\] '
261 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
262 elif test $UID = 1337; then
263 PS1='\[\033[1;32m\]\w\[\033[0m\] '
264 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
265 else
266 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
267 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
268 fi
269 if test -n "$SSH_CLIENT"; then
270 PS1='\[\033[35m\]\h'" $PS1"
271 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
272 fi
273 '';
274 };
275
276 services.journald.extraConfig = ''
277 SystemMaxUse=1G
278 RuntimeMaxUse=128M
279 Storage=persistent
280 '';
281
282 krebs.iptables = {
283 enable = true;
284 tables = {
285 filter.INPUT.policy = "DROP";
286 filter.FORWARD.policy = lib.mkDefault "DROP";
287 filter.INPUT.rules = lib.mkMerge [
288 (lib.mkBefore [
289 {
290 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
291 target = "ACCEPT";
292 }
293 {
294 predicate = "-p icmp";
295 target = "ACCEPT";
296 }
297 {
298 predicate = "-p ipv6-icmp";
299 target = "ACCEPT";
300 v4 = false;
301 }
302 {
303 predicate = "-i lo";
304 target = "ACCEPT";
305 }
306 ])
307 ];
308 };
309 };
310
311 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
312 networking.firewall.allowedUDPPortRanges = [
313 {
314 from = 60000;
315 to = 61000;
316 }
317 ]; # mosh
318 networking.extraHosts = ''
319 10.42.0.1 styx.gg23
320 '';
321
322 # use 24:00 time format, the default got sneakily changed around 20.03
323 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
324 time.timeZone = lib.mkDefault "Europe/Berlin";
325
326 # disable doc usually
327 documentation.nixos.enable = lib.mkDefault false;
328}