This repository has no description
7.7 kB
278 lines
1{ self, config, lib, pkgs, ... }:
2{
3 imports = [
4 ./binary-cache/client.nix
5 ./gc.nix
6 ./mc.nix
7 ./zsh.nix
8 ./htop.nix
9 ./wiregrill.nix
10 ./tmux.nix
11 ./tor-ssh.nix
12 ./networkd.nix
13 ./pinned-registry.nix
14 ./zerotier.nix
15 self.inputs.stockholm.nixosModules.users
16 self.inputs.stockholm.nixosModules.hosts
17 self.inputs.stockholm.nixosModules.kartei
18 self.inputs.stockholm.nixosModules.build
19 self.inputs.stockholm.nixosModules.dns
20 self.inputs.stockholm.nixosModules.exim
21 self.inputs.stockholm.nixosModules.exim-retiolum
22 self.inputs.stockholm.nixosModules.tinc
23 self.inputs.stockholm.nixosModules.iptables
24 self.inputs.stockholm.nixosModules.power-action
25 self.inputs.stockholm.nixosModules.setuid
26 self.inputs.stockholm.nixosModules.secret
27 self.inputs.stockholm.nixosModules.sitemap
28 self.inputs.stockholm.nixosModules.ssl
29 self.inputs.stockholm.nixosModules.systemd
30 self.inputs.stockholm.nixosModules.xresources
31 self.inputs.stockholm.nixosModules.ssh
32 self.inputs.stockholm.nixosModules.sync-containers3
33 {
34 users.extraUsers.mainUser.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
35 users.extraUsers.root.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
36 clanCore.secrets.password = {
37 secrets.password = { };
38 secrets.passwordHash = { };
39 generator.script = ''
40 ${pkgs.xkcdpass}/bin/xkcdpass -n 4 -d - > $secrets/password
41 cat $secrets/password | ${pkgs.mkpasswd}/bin/mkpasswd -s -m sha-512 > $secrets/passwordHash
42 '';
43 };
44 }
45 {
46 services.openssh.enable = true;
47 services.openssh.hostKeys = [{
48 path = "${config.krebs.secret.directory}/ssh.id_ed25519";
49 type = "ed25519";
50 }];
51 clanCore.secrets.ssh = {
52 secrets."ssh.id_ed25519" = { };
53 facts."ssh.id_ed25519.pub" = { };
54 generator.script = ''
55 ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -N "" -f $secrets/ssh.id_ed25519
56 mv $secrets/ssh.id_ed25519.pub $facts/ssh.id_ed25519.pub
57 '';
58 };
59 }
60 {
61 users.extraUsers = {
62 root = {
63 openssh.authorizedKeys.keys = [
64 config.krebs.users.lass.pubkey
65 ];
66 };
67 mainUser = {
68 name = "lass";
69 uid = 1337;
70 home = "/home/lass";
71 group = "users";
72 createHome = true;
73 useDefaultShell = true;
74 isNormalUser = true;
75 extraGroups = [
76 "audio"
77 "video"
78 "fuse"
79 "wheel"
80 "tor"
81 ];
82 openssh.authorizedKeys.keys = [
83 config.krebs.users.lass.pubkey
84 ];
85 };
86 };
87 }
88 (let ca-bundle = "/etc/ssl/certs/ca-bundle.crt"; in {
89 environment.variables = {
90 CURL_CA_BUNDLE = ca-bundle;
91 GIT_SSL_CAINFO = ca-bundle;
92 SSL_CERT_FILE = ca-bundle;
93 };
94 })
95 {
96 #for sshuttle
97 environment.systemPackages = [
98 pkgs.python3Packages.python
99 ];
100 }
101 ];
102
103 networking.hostName = config.krebs.build.host.name;
104
105 krebs = {
106 enable = true;
107 build.user = config.krebs.users.lass;
108 ssl.trustIntermediate = true;
109 };
110
111 nix.useSandbox = true;
112
113 users.mutableUsers = false;
114
115 # multiple-definition-problem when defining environment.variables.EDITOR
116 environment.extraInit = ''
117 EDITOR=vim
118 '';
119
120 nixpkgs.config.allowUnfree = true;
121
122 environment.systemPackages = with pkgs; [
123 self.packages.${pkgs.system}.vim
124
125 #stockholm
126 deploy
127 git
128 git-absorb
129 git-preview
130 gnumake
131 jq
132 nix-output-monitor
133
134 #style
135 rxvt-unicode-unwrapped.terminfo
136 alacritty.terminfo
137
138 #monitoring tools
139 htop
140 iotop
141
142 #network
143 iptables
144 iftop
145 tcpdump
146 mosh
147 eternal-terminal
148 sshify
149
150 #stuff for dl
151 aria2
152
153 #neat utils
154 file
155 hashPassword
156 kpaste
157 cyberlocker-tools
158 pciutils
159 pop
160 q
161 rs
162 untilport
163 (pkgs.writeDashBin "urgent" ''
164 printf '\a'
165 '')
166 usbutils
167 logify
168 goify
169
170 #unpack stuff
171 libarchive
172
173 (pkgs.writeDashBin "sshn" ''
174 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
175 '')
176 ];
177
178 environment.shellAliases = {
179 ll = "ls -l";
180 la = "ls -la";
181 ls = "ls --color";
182 ip = "ip -color=auto";
183 grep = "grep --color=auto";
184 };
185
186 programs.bash = {
187 enableCompletion = true;
188 interactiveShellInit = ''
189 HISTCONTROL='erasedups:ignorespace'
190 HISTSIZE=65536
191 HISTFILESIZE=$HISTSIZE
192
193 shopt -s checkhash
194 shopt -s histappend histreedit histverify
195 shopt -s no_empty_cmd_completion
196 complete -d cd
197 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
198 '';
199 promptInit = ''
200 if test $UID = 0; then
201 PS1='\[\033[1;31m\]\w\[\033[0m\] '
202 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
203 elif test $UID = 1337; then
204 PS1='\[\033[1;32m\]\w\[\033[0m\] '
205 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
206 else
207 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
208 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
209 fi
210 if test -n "$SSH_CLIENT"; then
211 PS1='\[\033[35m\]\h'" $PS1"
212 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
213 fi
214 '';
215 };
216
217 services.journald.extraConfig = ''
218 SystemMaxUse=1G
219 RuntimeMaxUse=128M
220 Storage=persistent
221 '';
222
223 krebs.iptables = {
224 enable = true;
225 tables = {
226 nat.PREROUTING.rules = [
227 { predicate = "-i retiolum -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
228 { predicate = "-i wiregrill -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
229 { predicate = "-p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; }
230 { predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; }
231 ];
232 nat.OUTPUT.rules = [
233 { predicate = "-o lo -p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; }
234 ];
235 filter.INPUT.policy = "DROP";
236 filter.FORWARD.policy = "DROP";
237 filter.INPUT.rules = lib.mkMerge [
238 (lib.mkBefore [
239 { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
240 { predicate = "-p icmp"; target = "ACCEPT"; }
241 { predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; }
242 { predicate = "-i lo"; target = "ACCEPT"; }
243 { predicate = "-p tcp --dport 22"; target = "ACCEPT"; }
244 ])
245 (lib.mkOrder 1000 [
246 { predicate = "-p udp --dport 60000:61000"; target = "ACCEPT"; } # mosh
247 { predicate = "-i retiolum -p udp -m udp --dport 53"; target = "ACCEPT"; }
248 { predicate = "-i retiolum -p tcp --dport 19999"; target = "ACCEPT"; }
249 ])
250 (lib.mkAfter [
251 { predicate = "-p tcp -i retiolum"; target = "REJECT --reject-with tcp-reset"; }
252 { predicate = "-p udp -i retiolum"; target = "REJECT --reject-with icmp-port-unreachable"; v6 = false; }
253 { predicate = "-i retiolum"; target = "REJECT --reject-with icmp-proto-unreachable"; v6 = false; }
254 ])
255 ];
256 };
257 };
258
259 networking.dhcpcd.extraConfig = ''
260 noipv4ll
261 '';
262
263 networking.extraHosts = ''
264 10.42.0.1 styx.gg23
265 '';
266
267 nix.settings.experimental-features = [
268 "nix-command"
269 "flakes"
270 ];
271
272 # use 24:00 time format, the default got sneakily changed around 20.03
273 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
274 time.timeZone = lib.mkDefault"Europe/Berlin";
275
276 # disable doc usually
277 documentation.nixos.enable = lib.mkDefault false;
278}