This repository has no description
8.2 kB
327 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 # Stockholm configuration
10 krebs.secret.directory = config.clan.core.vars.password-store.secretLocation;
11
12 # Nixpkgs overlays
13 nixpkgs.overlays = [
14 self.inputs.stockholm.overlays.default
15 (import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
16 ];
17
18 imports = [
19 # Import 3modules
20 ../3modules
21
22 # Import stockholm krebs module
23 self.inputs.stockholm.nixosModules.krebs
24
25 # Import individual configurations
26 ./security-workarounds.nix
27 # ./binary-cache/client.nix
28 ./gc.nix
29 ./mc.nix
30 ./zsh.nix
31 ./htop.nix
32 ./tor-ssh.nix
33 ./networkd.nix
34 ./pinned-registry.nix
35 ./zerotier.nix
36 ./nix.nix
37
38 # Import stockholm modules
39 self.inputs.stockholm.nixosModules.users
40 self.inputs.stockholm.nixosModules.hosts
41 self.inputs.stockholm.nixosModules.kartei
42 self.inputs.stockholm.nixosModules.build
43 self.inputs.stockholm.nixosModules.dns
44 self.inputs.stockholm.nixosModules.tinc
45 self.inputs.stockholm.nixosModules.iptables
46 self.inputs.stockholm.nixosModules.secret
47 self.inputs.stockholm.nixosModules.setuid
48 self.inputs.stockholm.nixosModules.sitemap
49 self.inputs.stockholm.nixosModules.ssl
50 self.inputs.stockholm.nixosModules.systemd
51 self.inputs.stockholm.nixosModules.ssh
52 {
53 # nix-index
54 imports = [
55 self.inputs.nix-index-database.nixosModules.nix-index
56 ];
57 programs.nix-index-database.comma.enable = true;
58 }
59 {
60 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
61 users.extraUsers.mainUser.hashedPasswordFile =
62 config.clan.core.vars.generators.password.files.passwordHash.path;
63 users.extraUsers.root.hashedPasswordFile =
64 config.clan.core.vars.generators.password.files.passwordHash.path;
65 boot.initrd.systemd.emergencyAccess = true;
66 clan.core.vars.generators.password = {
67 prompts.password = {
68 description = "Password for the main user";
69 type = "hidden";
70 };
71 files.password.deploy = false;
72 files.passwordHash.neededFor = "users";
73 runtimeInputs = with pkgs; [
74 coreutils
75 mkpasswd
76 ];
77 script = ''
78 cp $prompts/password $out/password
79 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
80 '';
81 };
82 }
83 {
84 services.openssh.enable = true;
85 services.openssh.settings.PasswordAuthentication = false;
86 services.openssh.hostKeys = [
87 {
88 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
89 type = "ed25519";
90 }
91 ];
92 clan.core.vars.generators.ssh = {
93 files."ssh.id_ed25519" = { };
94 files."ssh.id_ed25519.pub".secret = false;
95 runtimeInputs = with pkgs; [
96 coreutils
97 openssh
98 ];
99 script = ''
100 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
101 '';
102 };
103 }
104 {
105 users.extraUsers = {
106 root = {
107 openssh.authorizedKeys.keys = [
108 self.keys.ssh.barnacle.public
109 self.keys.ssh.yubi_pgp.public
110 self.keys.ssh.yubi1.public
111 self.keys.ssh.yubi2.public
112 self.keys.ssh.solo2.public
113 self.keys.ssh.xerxes.public
114 self.keys.ssh.massulus.public
115 ];
116 };
117 mainUser = {
118 name = "lass";
119 uid = 1337;
120 home = "/home/lass";
121 group = "users";
122 createHome = true;
123 useDefaultShell = true;
124 isNormalUser = true;
125 extraGroups = [
126 "audio"
127 "video"
128 "fuse"
129 "wheel"
130 "tor"
131 "dialout"
132 ];
133 openssh.authorizedKeys.keys = [
134 self.keys.ssh.barnacle.public
135 self.keys.ssh.yubi_pgp.public
136 self.keys.ssh.yubi1.public
137 self.keys.ssh.yubi2.public
138 self.keys.ssh.solo2.public
139 self.keys.ssh.xerxes.public
140 self.keys.ssh.massulus.public
141 ];
142 };
143 };
144 }
145 (
146 let
147 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
148 in
149 {
150 environment.variables = {
151 CURL_CA_BUNDLE = ca-bundle;
152 GIT_SSL_CAINFO = ca-bundle;
153 SSL_CERT_FILE = ca-bundle;
154 };
155 }
156 )
157 {
158 #for sshuttle
159 environment.systemPackages = [
160 pkgs.python3Packages.python
161 ];
162 }
163 ];
164
165 networking.hostName = config.krebs.build.host.name;
166
167 krebs = {
168 enable = true;
169 build.user = config.krebs.users.lass;
170 ssl.trustIntermediate = true;
171 };
172
173 users.mutableUsers = false;
174
175 # multiple-definition-problem when defining environment.variables.EDITOR
176 environment.extraInit = ''
177 EDITOR=vim
178 '';
179
180 nixpkgs.config.allowUnfree = true;
181
182 environment.systemPackages = with pkgs; [
183 self.packages.${pkgs.system}.nvim
184 self.packages.${pkgs.system}.tmux
185
186 git
187 git-absorb
188 gnumake
189 jq
190 nix-output-monitor
191 comma
192
193 #style
194 rxvt-unicode-unwrapped.terminfo
195 alacritty.terminfo
196
197 #monitoring tools
198 htop
199 iotop
200
201 #network
202 iptables
203 iftop
204 tcpdump
205 mosh
206 eternal-terminal
207 self.packages.${pkgs.system}.sshify
208
209 #stuff for dl
210 aria2
211
212 #neat utils
213 file
214 xkcdpass
215 kpaste
216 cyberlocker-tools
217 pciutils
218 pop
219 q
220 untilport
221 (pkgs.writeDashBin "urgent" ''
222 printf '\a'
223 '')
224 usbutils
225 goify
226
227 #unpack stuff
228 libarchive
229
230 (pkgs.writeDashBin "sshn" ''
231 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
232 '')
233 ];
234
235 environment.shellAliases = {
236 ll = "ls -l";
237 la = "ls -la";
238 ls = "ls --color";
239 ip = "ip -color=auto";
240 grep = "grep --color=auto";
241 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
242 };
243
244 programs.bash = {
245 completion.enable = true;
246 interactiveShellInit = ''
247 HISTCONTROL='erasedups:ignorespace'
248 HISTSIZE=65536
249 HISTFILESIZE=$HISTSIZE
250
251 shopt -s checkhash
252 shopt -s histappend histreedit histverify
253 shopt -s no_empty_cmd_completion
254 complete -d cd
255 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
256 '';
257 promptInit = ''
258 if test $UID = 0; then
259 PS1='\[\033[1;31m\]\w\[\033[0m\] '
260 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
261 elif test $UID = 1337; then
262 PS1='\[\033[1;32m\]\w\[\033[0m\] '
263 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
264 else
265 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
266 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
267 fi
268 if test -n "$SSH_CLIENT"; then
269 PS1='\[\033[35m\]\h'" $PS1"
270 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
271 fi
272 '';
273 };
274
275 services.journald.extraConfig = ''
276 SystemMaxUse=1G
277 RuntimeMaxUse=128M
278 Storage=persistent
279 '';
280
281 krebs.iptables = {
282 enable = true;
283 tables = {
284 filter.INPUT.policy = "DROP";
285 filter.FORWARD.policy = lib.mkDefault "DROP";
286 filter.INPUT.rules = lib.mkMerge [
287 (lib.mkBefore [
288 {
289 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
290 target = "ACCEPT";
291 }
292 {
293 predicate = "-p icmp";
294 target = "ACCEPT";
295 }
296 {
297 predicate = "-p ipv6-icmp";
298 target = "ACCEPT";
299 v4 = false;
300 }
301 {
302 predicate = "-i lo";
303 target = "ACCEPT";
304 }
305 ])
306 ];
307 };
308 };
309
310 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
311 networking.firewall.allowedUDPPortRanges = [
312 {
313 from = 60000;
314 to = 61000;
315 }
316 ]; # mosh
317 networking.extraHosts = ''
318 10.42.0.1 styx.gg23
319 '';
320
321 # use 24:00 time format, the default got sneakily changed around 20.03
322 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
323 time.timeZone = lib.mkDefault "Europe/Berlin";
324
325 # disable doc usually
326 documentation.nixos.enable = lib.mkDefault false;
327}