This repository has no description
8.4 kB
332 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 # Stockholm configuration
10 krebs.secret.directory = config.clan.core.vars.password-store.secretLocation;
11
12 # Nixpkgs overlays
13 nixpkgs.overlays = [
14 self.inputs.stockholm.overlays.default
15 (import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
16 ];
17
18 imports = [
19 # Import 3modules
20 ../3modules
21
22 # Import stockholm krebs module
23 self.inputs.stockholm.nixosModules.krebs
24
25 # Import individual configurations
26 ./security-workarounds.nix
27 # ./binary-cache/client.nix
28 ./gc.nix
29 ./mc.nix
30 ./zsh.nix
31 ./htop.nix
32 ./tor-ssh.nix
33 ./networkd.nix
34 ./pinned-registry.nix
35 ./zerotier.nix
36 ./nether.nix
37 ./nix.nix
38
39 # Import stockholm modules
40 self.inputs.stockholm.nixosModules.users
41 self.inputs.stockholm.nixosModules.hosts
42 self.inputs.stockholm.nixosModules.kartei
43 self.inputs.stockholm.nixosModules.build
44 self.inputs.stockholm.nixosModules.dns
45 self.inputs.stockholm.nixosModules.exim
46 self.inputs.stockholm.nixosModules.exim-retiolum
47 self.inputs.stockholm.nixosModules.tinc
48 self.inputs.stockholm.nixosModules.iptables
49 self.inputs.stockholm.nixosModules.setuid
50 self.inputs.stockholm.nixosModules.secret
51 self.inputs.stockholm.nixosModules.sitemap
52 self.inputs.stockholm.nixosModules.ssl
53 self.inputs.stockholm.nixosModules.systemd
54 self.inputs.stockholm.nixosModules.ssh
55 self.inputs.stockholm.nixosModules.sync-containers3
56 {
57 # nix-index
58 imports = [
59 self.inputs.nix-index-database.nixosModules.nix-index
60 ];
61 programs.nix-index-database.comma.enable = true;
62 }
63 {
64 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
65 users.extraUsers.mainUser.hashedPasswordFile =
66 config.clan.core.vars.generators.password.files.passwordHash.path;
67 users.extraUsers.root.hashedPasswordFile =
68 config.clan.core.vars.generators.password.files.passwordHash.path;
69 boot.initrd.systemd.emergencyAccess = true;
70 clan.core.vars.generators.password = {
71 prompts.password = {
72 description = "Password for the main user";
73 type = "hidden";
74 };
75 files.password.deploy = false;
76 files.passwordHash.neededFor = "users";
77 runtimeInputs = with pkgs; [
78 coreutils
79 mkpasswd
80 ];
81 script = ''
82 cp $prompts/password $out/password
83 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
84 '';
85 };
86 }
87 {
88 services.openssh.enable = true;
89 services.openssh.settings.PasswordAuthentication = false;
90 services.openssh.hostKeys = [
91 {
92 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
93 type = "ed25519";
94 }
95 ];
96 clan.core.vars.generators.ssh = {
97 files."ssh.id_ed25519" = { };
98 files."ssh.id_ed25519.pub".secret = false;
99 runtimeInputs = with pkgs; [
100 coreutils
101 openssh
102 ];
103 script = ''
104 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
105 '';
106 };
107 }
108 {
109 users.extraUsers = {
110 root = {
111 openssh.authorizedKeys.keys = [
112 self.keys.ssh.barnacle.public
113 self.keys.ssh.yubi_pgp.public
114 self.keys.ssh.yubi1.public
115 self.keys.ssh.yubi2.public
116 self.keys.ssh.solo2.public
117 self.keys.ssh.xerxes.public
118 self.keys.ssh.massulus.public
119 ];
120 };
121 mainUser = {
122 name = "lass";
123 uid = 1337;
124 home = "/home/lass";
125 group = "users";
126 createHome = true;
127 useDefaultShell = true;
128 isNormalUser = true;
129 extraGroups = [
130 "audio"
131 "video"
132 "fuse"
133 "wheel"
134 "tor"
135 "dialout"
136 ];
137 openssh.authorizedKeys.keys = [
138 self.keys.ssh.barnacle.public
139 self.keys.ssh.yubi_pgp.public
140 self.keys.ssh.yubi1.public
141 self.keys.ssh.yubi2.public
142 self.keys.ssh.solo2.public
143 self.keys.ssh.xerxes.public
144 self.keys.ssh.massulus.public
145 ];
146 };
147 };
148 }
149 (
150 let
151 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
152 in
153 {
154 environment.variables = {
155 CURL_CA_BUNDLE = ca-bundle;
156 GIT_SSL_CAINFO = ca-bundle;
157 SSL_CERT_FILE = ca-bundle;
158 };
159 }
160 )
161 {
162 #for sshuttle
163 environment.systemPackages = [
164 pkgs.python3Packages.python
165 ];
166 }
167 ];
168
169 networking.hostName = config.krebs.build.host.name;
170
171 krebs = {
172 enable = true;
173 build.user = config.krebs.users.lass;
174 ssl.trustIntermediate = true;
175 };
176
177 users.mutableUsers = false;
178
179 # multiple-definition-problem when defining environment.variables.EDITOR
180 environment.extraInit = ''
181 EDITOR=vim
182 '';
183
184 nixpkgs.config.allowUnfree = true;
185
186 environment.systemPackages = with pkgs; [
187 self.packages.${pkgs.system}.nvim
188 self.packages.${pkgs.system}.tmux
189
190 git
191 git-absorb
192 git-preview
193 gnumake
194 jq
195 nix-output-monitor
196 comma
197
198 #style
199 rxvt-unicode-unwrapped.terminfo
200 alacritty.terminfo
201
202 #monitoring tools
203 htop
204 iotop
205
206 #network
207 iptables
208 iftop
209 tcpdump
210 mosh
211 eternal-terminal
212 self.packages.${pkgs.system}.sshify
213
214 #stuff for dl
215 aria2
216
217 #neat utils
218 file
219 xkcdpass
220 kpaste
221 cyberlocker-tools
222 pciutils
223 pop
224 q
225 untilport
226 (pkgs.writeDashBin "urgent" ''
227 printf '\a'
228 '')
229 usbutils
230 goify
231
232 #unpack stuff
233 libarchive
234
235 (pkgs.writeDashBin "sshn" ''
236 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
237 '')
238 ];
239
240 environment.shellAliases = {
241 ll = "ls -l";
242 la = "ls -la";
243 ls = "ls --color";
244 ip = "ip -color=auto";
245 grep = "grep --color=auto";
246 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
247 };
248
249 programs.bash = {
250 completion.enable = true;
251 interactiveShellInit = ''
252 HISTCONTROL='erasedups:ignorespace'
253 HISTSIZE=65536
254 HISTFILESIZE=$HISTSIZE
255
256 shopt -s checkhash
257 shopt -s histappend histreedit histverify
258 shopt -s no_empty_cmd_completion
259 complete -d cd
260 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
261 '';
262 promptInit = ''
263 if test $UID = 0; then
264 PS1='\[\033[1;31m\]\w\[\033[0m\] '
265 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
266 elif test $UID = 1337; then
267 PS1='\[\033[1;32m\]\w\[\033[0m\] '
268 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
269 else
270 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
271 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
272 fi
273 if test -n "$SSH_CLIENT"; then
274 PS1='\[\033[35m\]\h'" $PS1"
275 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
276 fi
277 '';
278 };
279
280 services.journald.extraConfig = ''
281 SystemMaxUse=1G
282 RuntimeMaxUse=128M
283 Storage=persistent
284 '';
285
286 krebs.iptables = {
287 enable = true;
288 tables = {
289 filter.INPUT.policy = "DROP";
290 filter.FORWARD.policy = lib.mkDefault "DROP";
291 filter.INPUT.rules = lib.mkMerge [
292 (lib.mkBefore [
293 {
294 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
295 target = "ACCEPT";
296 }
297 {
298 predicate = "-p icmp";
299 target = "ACCEPT";
300 }
301 {
302 predicate = "-p ipv6-icmp";
303 target = "ACCEPT";
304 v4 = false;
305 }
306 {
307 predicate = "-i lo";
308 target = "ACCEPT";
309 }
310 ])
311 ];
312 };
313 };
314
315 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
316 networking.firewall.allowedUDPPortRanges = [
317 {
318 from = 60000;
319 to = 61000;
320 }
321 ]; # mosh
322 networking.extraHosts = ''
323 10.42.0.1 styx.gg23
324 '';
325
326 # use 24:00 time format, the default got sneakily changed around 20.03
327 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
328 time.timeZone = lib.mkDefault "Europe/Berlin";
329
330 # disable doc usually
331 documentation.nixos.enable = lib.mkDefault false;
332}