This repository has no description
9.4 kB
370 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 # Clan core configuration
10 clan.core.facts.secretStore = "password-store";
11 clan.core.facts.secretUploadDirectory = lib.mkDefault "/etc/secrets";
12 clan.core.vars.settings.secretStore = "password-store";
13 clan.core.networking.targetHost = "root@${config.networking.hostName}";
14
15 # Stockholm configuration
16 krebs.secret.directory = config.clan.core.facts.secretUploadDirectory;
17
18 # Nixpkgs overlays
19 nixpkgs.overlays = [
20 self.inputs.stockholm.overlays.default
21 (import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
22 ];
23
24 imports = [
25 # Import 3modules
26 ../3modules
27
28 # Import stockholm krebs module
29 self.inputs.stockholm.nixosModules.krebs
30
31 # Import individual configurations
32 ./security-workarounds.nix
33 # ./binary-cache/client.nix
34 ./gc.nix
35 ./mc.nix
36 ./zsh.nix
37 ./htop.nix
38 ./wiregrill.nix
39 ./tmux.nix
40 ./tor-ssh.nix
41 ./networkd.nix
42 ./pinned-registry.nix
43 ./zerotier.nix
44 ./nether.nix
45 ./spora.nix
46 ./nix.nix
47
48 # Import stockholm modules
49 self.inputs.stockholm.nixosModules.users
50 self.inputs.stockholm.nixosModules.hosts
51 self.inputs.stockholm.nixosModules.kartei
52 self.inputs.stockholm.nixosModules.build
53 self.inputs.stockholm.nixosModules.dns
54 self.inputs.stockholm.nixosModules.exim
55 self.inputs.stockholm.nixosModules.exim-retiolum
56 self.inputs.stockholm.nixosModules.tinc
57 self.inputs.stockholm.nixosModules.iptables
58 self.inputs.stockholm.nixosModules.power-action
59 self.inputs.stockholm.nixosModules.setuid
60 self.inputs.stockholm.nixosModules.secret
61 self.inputs.stockholm.nixosModules.sitemap
62 self.inputs.stockholm.nixosModules.ssl
63 self.inputs.stockholm.nixosModules.systemd
64 self.inputs.stockholm.nixosModules.xresources
65 self.inputs.stockholm.nixosModules.ssh
66 self.inputs.stockholm.nixosModules.sync-containers3
67 {
68 # nix-index
69 imports = [
70 self.inputs.nix-index-database.nixosModules.nix-index
71 ];
72 programs.nix-index-database.comma.enable = true;
73 }
74 {
75 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
76 users.extraUsers.mainUser.hashedPasswordFile =
77 config.clan.core.vars.generators.password.files.passwordHash.path;
78 users.extraUsers.root.hashedPasswordFile =
79 config.clan.core.vars.generators.password.files.passwordHash.path;
80 boot.initrd.systemd.emergencyAccess = true;
81 clan.core.vars.generators.password = {
82 prompts.password = {
83 description = "Password for the main user";
84 type = "hidden";
85 };
86 files.password.deploy = false;
87 files.passwordHash.neededFor = "users";
88 migrateFact = "password";
89 runtimeInputs = with pkgs; [
90 coreutils
91 mkpasswd
92 ];
93 script = ''
94 cp $prompts/password $out/password
95 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
96 '';
97 };
98 }
99 {
100 services.openssh.enable = true;
101 services.openssh.hostKeys = [
102 {
103 path = config.clanCore.vars.generators.ssh.files."ssh.id_ed25519".path;
104 type = "ed25519";
105 }
106 ];
107 clan.core.vars.generators.ssh = {
108 files."ssh.id_ed25519".secret = true;
109 files."ssh.id_ed25519.pub".secret = false;
110 migrateFact = "ssh";
111 runtimeInputs = with pkgs; [
112 coreutils
113 openssh
114 ];
115 script = ''
116 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
117 '';
118 };
119 }
120 {
121 users.extraUsers = {
122 root = {
123 openssh.authorizedKeys.keys = [
124 config.krebs.users.lass.pubkey
125 ];
126 };
127 mainUser = {
128 name = "lass";
129 uid = 1337;
130 home = "/home/lass";
131 group = "users";
132 createHome = true;
133 useDefaultShell = true;
134 isNormalUser = true;
135 extraGroups = [
136 "audio"
137 "video"
138 "fuse"
139 "wheel"
140 "tor"
141 "dialout"
142 ];
143 openssh.authorizedKeys.keys = [
144 config.krebs.users.lass.pubkey
145 ];
146 };
147 };
148 }
149 (
150 let
151 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
152 in
153 {
154 environment.variables = {
155 CURL_CA_BUNDLE = ca-bundle;
156 GIT_SSL_CAINFO = ca-bundle;
157 SSL_CERT_FILE = ca-bundle;
158 };
159 }
160 )
161 {
162 #for sshuttle
163 environment.systemPackages = [
164 pkgs.python3Packages.python
165 ];
166 }
167 ];
168
169 networking.hostName = config.krebs.build.host.name;
170
171 krebs = {
172 enable = true;
173 build.user = config.krebs.users.lass;
174 ssl.trustIntermediate = true;
175 };
176
177 users.mutableUsers = false;
178
179 # multiple-definition-problem when defining environment.variables.EDITOR
180 environment.extraInit = ''
181 EDITOR=vim
182 '';
183
184 nixpkgs.config.allowUnfree = true;
185
186 environment.systemPackages = with pkgs; [
187 self.packages.${pkgs.system}.nvim
188
189 git
190 git-absorb
191 git-preview
192 gnumake
193 jq
194 nix-output-monitor
195 comma
196
197 #style
198 rxvt-unicode-unwrapped.terminfo
199 alacritty.terminfo
200
201 #monitoring tools
202 htop
203 iotop
204
205 #network
206 iptables
207 iftop
208 tcpdump
209 mosh
210 eternal-terminal
211 self.packages.${pkgs.system}.sshify
212
213 #stuff for dl
214 aria2
215
216 #neat utils
217 file
218 hashPassword
219 xkcdpass
220 kpaste
221 cyberlocker-tools
222 pciutils
223 pop
224 q
225 untilport
226 (pkgs.writeDashBin "urgent" ''
227 printf '\a'
228 '')
229 usbutils
230 self.packages.${pkgs.system}.logify
231 goify
232
233 #unpack stuff
234 libarchive
235
236 (pkgs.writeDashBin "sshn" ''
237 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
238 '')
239 ];
240
241 environment.shellAliases = {
242 ll = "ls -l";
243 la = "ls -la";
244 ls = "ls --color";
245 ip = "ip -color=auto";
246 grep = "grep --color=auto";
247 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
248 };
249
250 programs.bash = {
251 completion.enable = true;
252 interactiveShellInit = ''
253 HISTCONTROL='erasedups:ignorespace'
254 HISTSIZE=65536
255 HISTFILESIZE=$HISTSIZE
256
257 shopt -s checkhash
258 shopt -s histappend histreedit histverify
259 shopt -s no_empty_cmd_completion
260 complete -d cd
261 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
262 '';
263 promptInit = ''
264 if test $UID = 0; then
265 PS1='\[\033[1;31m\]\w\[\033[0m\] '
266 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
267 elif test $UID = 1337; then
268 PS1='\[\033[1;32m\]\w\[\033[0m\] '
269 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
270 else
271 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
272 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
273 fi
274 if test -n "$SSH_CLIENT"; then
275 PS1='\[\033[35m\]\h'" $PS1"
276 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
277 fi
278 '';
279 };
280
281 services.journald.extraConfig = ''
282 SystemMaxUse=1G
283 RuntimeMaxUse=128M
284 Storage=persistent
285 '';
286
287 krebs.iptables = {
288 enable = true;
289 tables = {
290 filter.INPUT.policy = "DROP";
291 filter.FORWARD.policy = lib.mkDefault "DROP";
292 filter.INPUT.rules = lib.mkMerge [
293 (lib.mkBefore [
294 {
295 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
296 target = "ACCEPT";
297 }
298 {
299 predicate = "-p icmp";
300 target = "ACCEPT";
301 }
302 {
303 predicate = "-p ipv6-icmp";
304 target = "ACCEPT";
305 v4 = false;
306 }
307 {
308 predicate = "-i lo";
309 target = "ACCEPT";
310 }
311 {
312 predicate = "-p tcp --dport 22";
313 target = "ACCEPT";
314 }
315 ])
316 (lib.mkOrder 1000 [
317 {
318 predicate = "-p udp --dport 60000:61000";
319 target = "ACCEPT";
320 } # mosh
321 {
322 predicate = "-i retiolum -p udp -m udp --dport 53";
323 target = "ACCEPT";
324 }
325 {
326 predicate = "-i retiolum -p tcp --dport 19999";
327 target = "ACCEPT";
328 }
329 ])
330 (lib.mkAfter [
331 {
332 predicate = "-p tcp -i retiolum";
333 target = "REJECT --reject-with tcp-reset";
334 }
335 {
336 predicate = "-p udp -i retiolum";
337 target = "REJECT --reject-with icmp-port-unreachable";
338 v6 = false;
339 }
340 {
341 predicate = "-i retiolum";
342 target = "REJECT --reject-with icmp-proto-unreachable";
343 v6 = false;
344 }
345 ])
346 ];
347 };
348 };
349
350 networking.extraHosts = ''
351 10.42.0.1 styx.gg23
352 '';
353
354 # use 24:00 time format, the default got sneakily changed around 20.03
355 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
356 time.timeZone = lib.mkDefault "Europe/Berlin";
357
358 # disable doc usually
359 documentation.nixos.enable = lib.mkDefault false;
360
361 # use new rebuild switch
362 system.switch = {
363 enable = false;
364 enableNg = true;
365 };
366
367 # use latest nix to hunt all the bugs
368 nix.package = pkgs.nixVersions.latest;
369
370}