This repository has no description
8.3 kB
328 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 # Stockholm configuration
10 krebs.secret.directory = config.clan.core.vars.password-store.secretLocation;
11
12 # Nixpkgs overlays
13 nixpkgs.overlays = [
14 self.inputs.stockholm.overlays.default
15 (import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
16 ];
17
18 imports = [
19 # Import modules
20 ../modules
21
22 # Import stockholm krebs module
23 self.inputs.stockholm.nixosModules.krebs
24
25 # Import individual configurations
26 ./security-workarounds.nix
27 ./gc.nix
28 ./mc.nix
29 ./zsh.nix
30 ./htop.nix
31 ./tor-ssh.nix
32 ./networkd.nix
33 ./pinned-registry.nix
34 ./nix.nix
35
36 # Import stockholm modules
37 self.inputs.stockholm.nixosModules.users
38 self.inputs.stockholm.nixosModules.hosts
39 ./kartei.nix
40 self.inputs.stockholm.nixosModules.build
41 self.inputs.stockholm.nixosModules.dns
42 self.inputs.stockholm.nixosModules.iptables
43 self.inputs.stockholm.nixosModules.secret
44 self.inputs.stockholm.nixosModules.setuid
45 self.inputs.stockholm.nixosModules.sitemap
46 self.inputs.stockholm.nixosModules.ssl
47 self.inputs.stockholm.nixosModules.systemd
48 self.inputs.stockholm.nixosModules.ssh
49 {
50 # nix-index
51 imports = [
52 self.inputs.nix-index-database.nixosModules.nix-index
53 ];
54 programs.nix-index-database.comma.enable = true;
55 }
56 {
57 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
58 users.extraUsers.mainUser.hashedPasswordFile =
59 config.clan.core.vars.generators.password.files.passwordHash.path;
60 users.extraUsers.root.hashedPasswordFile =
61 config.clan.core.vars.generators.password.files.passwordHash.path;
62 boot.initrd.systemd.emergencyAccess = true;
63 clan.core.vars.generators.password = {
64 prompts.password = {
65 description = "Password for the main user";
66 type = "hidden";
67 };
68 files.password.deploy = false;
69 files.passwordHash.neededFor = "users";
70 runtimeInputs = with pkgs; [
71 coreutils
72 mkpasswd
73 ];
74 script = ''
75 cp $prompts/password $out/password
76 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
77 '';
78 };
79 }
80 {
81 services.openssh.enable = true;
82 services.openssh.settings.PasswordAuthentication = false;
83 services.openssh.hostKeys = [
84 {
85 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
86 type = "ed25519";
87 }
88 ];
89 clan.core.vars.generators.ssh = {
90 files."ssh.id_ed25519" = { };
91 files."ssh.id_ed25519.pub".secret = false;
92 runtimeInputs = with pkgs; [
93 coreutils
94 openssh
95 ];
96 script = ''
97 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
98 '';
99 };
100 }
101 {
102 users.extraUsers = {
103 root = {
104 openssh.authorizedKeys.keys = [
105 self.keys.ssh.barnacle.public
106 self.keys.ssh.yubi_pgp.public
107 self.keys.ssh.termux_massulus.public
108 self.keys.ssh.yubi1.public
109 self.keys.ssh.yubi2.public
110 self.keys.ssh.solo2.public
111 self.keys.ssh.xerxes.public
112 self.keys.ssh.ignavia.public
113 ];
114 };
115 mainUser = {
116 name = "lass";
117 uid = 1337;
118 home = "/home/lass";
119 group = "users";
120 createHome = true;
121 useDefaultShell = true;
122 isNormalUser = true;
123 linger = true;
124 extraGroups = [
125 "audio"
126 "video"
127 "fuse"
128 "wheel"
129 "tor"
130 "dialout"
131 ];
132 openssh.authorizedKeys.keys = [
133 self.keys.ssh.barnacle.public
134 self.keys.ssh.yubi_pgp.public
135 self.keys.ssh.termux_massulus.public
136 self.keys.ssh.yubi1.public
137 self.keys.ssh.yubi2.public
138 self.keys.ssh.solo2.public
139 self.keys.ssh.xerxes.public
140 self.keys.ssh.ignavia.public
141 ];
142 };
143 };
144 }
145 (
146 let
147 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
148 in
149 {
150 environment.variables = {
151 CURL_CA_BUNDLE = ca-bundle;
152 GIT_SSL_CAINFO = ca-bundle;
153 SSL_CERT_FILE = ca-bundle;
154 };
155 }
156 )
157 {
158 #for sshuttle
159 environment.systemPackages = [
160 pkgs.python3Packages.python
161 ];
162 }
163 ];
164
165 networking.hostName = config.krebs.build.host.name;
166
167 krebs = {
168 enable = true;
169 build.user = config.krebs.users.lass;
170 ssl.trustIntermediate = true;
171 };
172
173 users.mutableUsers = false;
174
175 # multiple-definition-problem when defining environment.variables.EDITOR
176 environment.extraInit = ''
177 EDITOR=vim
178 '';
179
180 nixpkgs.config.allowUnfree = true;
181
182 environment.systemPackages = with pkgs; [
183 self.packages.${pkgs.system}.nvim
184 self.packages.${pkgs.system}.tmux
185 self.packages.${pkgs.system}.s
186
187 git
188 git-absorb
189 gnumake
190 jq
191 nix-output-monitor
192 comma
193
194 #style
195 rxvt-unicode-unwrapped.terminfo
196 alacritty.terminfo
197
198 #monitoring tools
199 htop
200 iotop
201
202 #network
203 iptables
204 iftop
205 tcpdump
206 mosh
207 eternal-terminal
208 self.packages.${pkgs.system}.sshify
209
210 #stuff for dl
211 aria2
212
213 #neat utils
214 file
215 xkcdpass
216 kpaste
217 cyberlocker-tools
218 pciutils
219 pop
220 untilport
221 (pkgs.writeDashBin "urgent" ''
222 printf '\a'
223 '')
224 usbutils
225 goify
226
227 #unpack stuff
228 libarchive
229
230 (pkgs.writeDashBin "sshn" ''
231 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
232 '')
233 ];
234
235 environment.shellAliases = {
236 ll = "ls -l";
237 la = "ls -la";
238 ls = "ls --color";
239 ip = "ip -color=auto";
240 grep = "grep --color=auto";
241 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
242 };
243
244 programs.bash = {
245 completion.enable = true;
246 interactiveShellInit = ''
247 HISTCONTROL='erasedups:ignorespace'
248 HISTSIZE=65536
249 HISTFILESIZE=$HISTSIZE
250
251 shopt -s checkhash
252 shopt -s histappend histreedit histverify
253 shopt -s no_empty_cmd_completion
254 complete -d cd
255 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
256 '';
257 promptInit = ''
258 if test $UID = 0; then
259 PS1='\[\033[1;31m\]\w\[\033[0m\] '
260 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
261 elif test $UID = 1337; then
262 PS1='\[\033[1;32m\]\w\[\033[0m\] '
263 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
264 else
265 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
266 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
267 fi
268 if test -n "$SSH_CLIENT"; then
269 PS1='\[\033[35m\]\h'" $PS1"
270 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
271 fi
272 '';
273 };
274
275 services.journald.settings.Journal = {
276 SystemMaxUse = "1G";
277 RuntimeMaxUse = "128M";
278 Storage = "persistent";
279 };
280
281 krebs.iptables = {
282 enable = true;
283 tables = {
284 filter.INPUT.policy = "DROP";
285 filter.FORWARD.policy = lib.mkDefault "DROP";
286 filter.INPUT.rules = lib.mkMerge [
287 (lib.mkBefore [
288 {
289 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
290 target = "ACCEPT";
291 }
292 {
293 predicate = "-p icmp";
294 target = "ACCEPT";
295 }
296 {
297 predicate = "-p ipv6-icmp";
298 target = "ACCEPT";
299 v4 = false;
300 }
301 {
302 predicate = "-i lo";
303 target = "ACCEPT";
304 }
305 ])
306 ];
307 };
308 };
309
310 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
311 networking.firewall.allowedUDPPortRanges = [
312 {
313 from = 60000;
314 to = 61000;
315 }
316 ]; # mosh
317 networking.extraHosts = ''
318 10.42.0.1 acheron.gg23
319 10.42.0.3 styx.gg23
320 '';
321
322 # use 24:00 time format, the default got sneakily changed around 20.03
323 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
324 time.timeZone = lib.mkDefault "Europe/Berlin";
325
326 # disable doc usually
327 documentation.nixos.enable = lib.mkDefault false;
328}