This repository has no description
7.7 kB
280 lines
1{ self, config, lib, pkgs, ... }:
2{
3 imports = [
4 ./binary-cache/client.nix
5 ./gc.nix
6 ./mc.nix
7 ./zsh.nix
8 ./htop.nix
9 ./wiregrill.nix
10 ./tmux.nix
11 ./tor-ssh.nix
12 ./networkd.nix
13 ./pinned-registry.nix
14 ./zerotier.nix
15 self.inputs.stockholm.nixosModules.users
16 self.inputs.stockholm.nixosModules.hosts
17 self.inputs.stockholm.nixosModules.kartei
18 self.inputs.stockholm.nixosModules.build
19 self.inputs.stockholm.nixosModules.dns
20 self.inputs.stockholm.nixosModules.exim
21 self.inputs.stockholm.nixosModules.exim-retiolum
22 self.inputs.stockholm.nixosModules.tinc
23 self.inputs.stockholm.nixosModules.iptables
24 self.inputs.stockholm.nixosModules.power-action
25 self.inputs.stockholm.nixosModules.setuid
26 self.inputs.stockholm.nixosModules.secret
27 self.inputs.stockholm.nixosModules.sitemap
28 self.inputs.stockholm.nixosModules.ssl
29 self.inputs.stockholm.nixosModules.systemd
30 self.inputs.stockholm.nixosModules.xresources
31 self.inputs.stockholm.nixosModules.ssh
32 self.inputs.stockholm.nixosModules.sync-containers3
33 {
34 users.extraUsers.mainUser.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
35 users.extraUsers.root.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
36 clanCore.secrets.password = {
37 secrets.password = { };
38 secrets.passwordHash = { };
39 generator.path = with pkgs; [ coreutils xkcdpass mkpasswd ];
40 generator.script = ''
41 xkcdpass -n 4 -d - > $secrets/password
42 cat $secrets/password | mkpasswd -s -m sha-512 > $secrets/passwordHash
43 '';
44 };
45 }
46 {
47 services.openssh.enable = true;
48 services.openssh.hostKeys = [{
49 path = "${config.krebs.secret.directory}/ssh.id_ed25519";
50 type = "ed25519";
51 }];
52 clanCore.secrets.ssh = {
53 secrets."ssh.id_ed25519" = { };
54 facts."ssh.id_ed25519.pub" = { };
55 generator.path = with pkgs; [ coreutils openssh ];
56 generator.script = ''
57 ssh-keygen -t ed25519 -N "" -f $secrets/ssh.id_ed25519
58 mv $secrets/ssh.id_ed25519.pub $facts/ssh.id_ed25519.pub
59 '';
60 };
61 }
62 {
63 users.extraUsers = {
64 root = {
65 openssh.authorizedKeys.keys = [
66 config.krebs.users.lass.pubkey
67 ];
68 };
69 mainUser = {
70 name = "lass";
71 uid = 1337;
72 home = "/home/lass";
73 group = "users";
74 createHome = true;
75 useDefaultShell = true;
76 isNormalUser = true;
77 extraGroups = [
78 "audio"
79 "video"
80 "fuse"
81 "wheel"
82 "tor"
83 ];
84 openssh.authorizedKeys.keys = [
85 config.krebs.users.lass.pubkey
86 ];
87 };
88 };
89 }
90 (let ca-bundle = "/etc/ssl/certs/ca-bundle.crt"; in {
91 environment.variables = {
92 CURL_CA_BUNDLE = ca-bundle;
93 GIT_SSL_CAINFO = ca-bundle;
94 SSL_CERT_FILE = ca-bundle;
95 };
96 })
97 {
98 #for sshuttle
99 environment.systemPackages = [
100 pkgs.python3Packages.python
101 ];
102 }
103 ];
104
105 networking.hostName = config.krebs.build.host.name;
106
107 krebs = {
108 enable = true;
109 build.user = config.krebs.users.lass;
110 ssl.trustIntermediate = true;
111 };
112
113 nix.useSandbox = true;
114
115 users.mutableUsers = false;
116
117 # multiple-definition-problem when defining environment.variables.EDITOR
118 environment.extraInit = ''
119 EDITOR=vim
120 '';
121
122 nixpkgs.config.allowUnfree = true;
123
124 environment.systemPackages = with pkgs; [
125 self.packages.${pkgs.system}.vim
126
127 #stockholm
128 deploy
129 git
130 git-absorb
131 git-preview
132 gnumake
133 jq
134 nix-output-monitor
135
136 #style
137 rxvt-unicode-unwrapped.terminfo
138 alacritty.terminfo
139
140 #monitoring tools
141 htop
142 iotop
143
144 #network
145 iptables
146 iftop
147 tcpdump
148 mosh
149 eternal-terminal
150 sshify
151
152 #stuff for dl
153 aria2
154
155 #neat utils
156 file
157 hashPassword
158 kpaste
159 cyberlocker-tools
160 pciutils
161 pop
162 q
163 rs
164 untilport
165 (pkgs.writeDashBin "urgent" ''
166 printf '\a'
167 '')
168 usbutils
169 logify
170 goify
171
172 #unpack stuff
173 libarchive
174
175 (pkgs.writeDashBin "sshn" ''
176 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
177 '')
178 ];
179
180 environment.shellAliases = {
181 ll = "ls -l";
182 la = "ls -la";
183 ls = "ls --color";
184 ip = "ip -color=auto";
185 grep = "grep --color=auto";
186 };
187
188 programs.bash = {
189 enableCompletion = true;
190 interactiveShellInit = ''
191 HISTCONTROL='erasedups:ignorespace'
192 HISTSIZE=65536
193 HISTFILESIZE=$HISTSIZE
194
195 shopt -s checkhash
196 shopt -s histappend histreedit histverify
197 shopt -s no_empty_cmd_completion
198 complete -d cd
199 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
200 '';
201 promptInit = ''
202 if test $UID = 0; then
203 PS1='\[\033[1;31m\]\w\[\033[0m\] '
204 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
205 elif test $UID = 1337; then
206 PS1='\[\033[1;32m\]\w\[\033[0m\] '
207 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
208 else
209 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
210 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
211 fi
212 if test -n "$SSH_CLIENT"; then
213 PS1='\[\033[35m\]\h'" $PS1"
214 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
215 fi
216 '';
217 };
218
219 services.journald.extraConfig = ''
220 SystemMaxUse=1G
221 RuntimeMaxUse=128M
222 Storage=persistent
223 '';
224
225 krebs.iptables = {
226 enable = true;
227 tables = {
228 nat.PREROUTING.rules = [
229 { predicate = "-i retiolum -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
230 { predicate = "-i wiregrill -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
231 { predicate = "-p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; }
232 { predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; }
233 ];
234 nat.OUTPUT.rules = [
235 { predicate = "-o lo -p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; }
236 ];
237 filter.INPUT.policy = "DROP";
238 filter.FORWARD.policy = "DROP";
239 filter.INPUT.rules = lib.mkMerge [
240 (lib.mkBefore [
241 { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
242 { predicate = "-p icmp"; target = "ACCEPT"; }
243 { predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; }
244 { predicate = "-i lo"; target = "ACCEPT"; }
245 { predicate = "-p tcp --dport 22"; target = "ACCEPT"; }
246 ])
247 (lib.mkOrder 1000 [
248 { predicate = "-p udp --dport 60000:61000"; target = "ACCEPT"; } # mosh
249 { predicate = "-i retiolum -p udp -m udp --dport 53"; target = "ACCEPT"; }
250 { predicate = "-i retiolum -p tcp --dport 19999"; target = "ACCEPT"; }
251 ])
252 (lib.mkAfter [
253 { predicate = "-p tcp -i retiolum"; target = "REJECT --reject-with tcp-reset"; }
254 { predicate = "-p udp -i retiolum"; target = "REJECT --reject-with icmp-port-unreachable"; v6 = false; }
255 { predicate = "-i retiolum"; target = "REJECT --reject-with icmp-proto-unreachable"; v6 = false; }
256 ])
257 ];
258 };
259 };
260
261 networking.dhcpcd.extraConfig = ''
262 noipv4ll
263 '';
264
265 networking.extraHosts = ''
266 10.42.0.1 styx.gg23
267 '';
268
269 nix.settings.experimental-features = [
270 "nix-command"
271 "flakes"
272 ];
273
274 # use 24:00 time format, the default got sneakily changed around 20.03
275 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
276 time.timeZone = lib.mkDefault"Europe/Berlin";
277
278 # disable doc usually
279 documentation.nixos.enable = lib.mkDefault false;
280}