This repository has no description
7.9 kB
280 lines
1{ self, config, lib, pkgs, ... }:
2{
3 imports = [
4 ./binary-cache/client.nix
5 ./gc.nix
6 ./mc.nix
7 ./zsh.nix
8 ./htop.nix
9 ./wiregrill.nix
10 ./tmux.nix
11 ./tor-ssh.nix
12 ./networkd.nix
13 self.inputs.stockholm.nixosModules.users
14 self.inputs.stockholm.nixosModules.hosts
15 self.inputs.stockholm.nixosModules.kartei
16 self.inputs.stockholm.nixosModules.build
17 self.inputs.stockholm.nixosModules.dns
18 self.inputs.stockholm.nixosModules.exim
19 self.inputs.stockholm.nixosModules.exim-retiolum
20 self.inputs.stockholm.nixosModules.tinc
21 self.inputs.stockholm.nixosModules.fetchWallpaper
22 self.inputs.stockholm.nixosModules.iptables
23 self.inputs.stockholm.nixosModules.power-action
24 self.inputs.stockholm.nixosModules.setuid
25 self.inputs.stockholm.nixosModules.secret
26 self.inputs.stockholm.nixosModules.sitemap
27 self.inputs.stockholm.nixosModules.ssl
28 self.inputs.stockholm.nixosModules.systemd
29 self.inputs.stockholm.nixosModules.xresources
30 self.inputs.stockholm.nixosModules.ssh
31 self.inputs.stockholm.nixosModules.sync-containers3
32 {
33 users.extraUsers.mainUser.passwordFile = "${config.krebs.secret.directory}/passwordHash";
34 users.extraUsers.root.passwordFile = "${config.krebs.secret.directory}/passwordHash";
35 clanCore.secrets.password = {
36 secrets.password = { };
37 secrets.passwordHash = { };
38 generator = ''
39 ${pkgs.xkcdpass}/bin/xkcdpass -n 4 -d - > $secrets/password
40 cat $secrets/password | ${pkgs.mkpasswd}/bin/mkpasswd -s -m sha-512 > $secrets/passwordHash
41 '';
42 };
43 }
44 {
45 services.openssh.enable = true;
46 services.openssh.hostKeys = [{
47 path = "${config.krebs.secret.directory}/ssh.id_ed25519";
48 type = "ed25519";
49 }];
50 clanCore.secrets.ssh = {
51 secrets."ssh.id_ed25519" = { };
52 facts."ssh.id_ed25519.pub" = { };
53 generator = ''
54 ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -N "" -f $secrets/ssh.id_ed25519
55 mv $secrets/ssh.id_ed25519.pub $facts/ssh.id_ed25519.pub
56 '';
57 };
58 }
59 {
60 users.extraUsers = {
61 root = {
62 openssh.authorizedKeys.keys = [
63 config.krebs.users.lass.pubkey
64 config.krebs.users.lass-blue.pubkey
65 config.krebs.users.lass-green.pubkey
66 ];
67 };
68 mainUser = {
69 name = "lass";
70 uid = 1337;
71 home = "/home/lass";
72 group = "users";
73 createHome = true;
74 useDefaultShell = true;
75 isNormalUser = true;
76 extraGroups = [
77 "audio"
78 "video"
79 "fuse"
80 "wheel"
81 "tor"
82 ];
83 openssh.authorizedKeys.keys = [
84 config.krebs.users.lass.pubkey
85 config.krebs.users.lass-blue.pubkey
86 config.krebs.users.lass-green.pubkey
87 ];
88 };
89 };
90 }
91 (let ca-bundle = "/etc/ssl/certs/ca-bundle.crt"; in {
92 environment.variables = {
93 CURL_CA_BUNDLE = ca-bundle;
94 GIT_SSL_CAINFO = ca-bundle;
95 SSL_CERT_FILE = ca-bundle;
96 };
97 })
98 {
99 #for sshuttle
100 environment.systemPackages = [
101 pkgs.python3Packages.python
102 ];
103 }
104 ];
105
106 networking.hostName = config.krebs.build.host.name;
107
108 krebs = {
109 enable = true;
110 build.user = config.krebs.users.lass;
111 ssl.trustIntermediate = true;
112 };
113
114 nix.useSandbox = true;
115
116 users.mutableUsers = false;
117
118 # multiple-definition-problem when defining environment.variables.EDITOR
119 environment.extraInit = ''
120 EDITOR=vim
121 '';
122
123 nixpkgs.config.allowUnfree = true;
124
125 environment.systemPackages = with pkgs; [
126 self.packages.${pkgs.system}.vim
127
128 #stockholm
129 deploy
130 git
131 git-absorb
132 git-preview
133 gnumake
134 jq
135 nix-output-monitor
136
137 #style
138 rxvt-unicode-unwrapped.terminfo
139 alacritty.terminfo
140
141 #monitoring tools
142 htop
143 iotop
144
145 #network
146 iptables
147 iftop
148 tcpdump
149 mosh
150 eternal-terminal
151 sshify
152
153 #stuff for dl
154 aria2
155
156 #neat utils
157 file
158 hashPassword
159 kpaste
160 cyberlocker-tools
161 pciutils
162 pop
163 q
164 rs
165 untilport
166 (pkgs.writeDashBin "urgent" ''
167 printf '\a'
168 '')
169 usbutils
170 logify
171 goify
172
173 #unpack stuff
174 libarchive
175
176 (pkgs.writeDashBin "sshn" ''
177 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
178 '')
179 ];
180
181 environment.shellAliases = {
182 ll = "ls -l";
183 la = "ls -la";
184 ls = "ls --color";
185 ip = "ip -color=auto";
186 grep = "grep --color=auto";
187 };
188
189 programs.bash = {
190 enableCompletion = true;
191 interactiveShellInit = ''
192 HISTCONTROL='erasedups:ignorespace'
193 HISTSIZE=65536
194 HISTFILESIZE=$HISTSIZE
195
196 shopt -s checkhash
197 shopt -s histappend histreedit histverify
198 shopt -s no_empty_cmd_completion
199 complete -d cd
200 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
201 '';
202 promptInit = ''
203 if test $UID = 0; then
204 PS1='\[\033[1;31m\]\w\[\033[0m\] '
205 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
206 elif test $UID = 1337; then
207 PS1='\[\033[1;32m\]\w\[\033[0m\] '
208 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
209 else
210 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
211 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
212 fi
213 if test -n "$SSH_CLIENT"; then
214 PS1='\[\033[35m\]\h'" $PS1"
215 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
216 fi
217 '';
218 };
219
220 services.journald.extraConfig = ''
221 SystemMaxUse=1G
222 RuntimeMaxUse=128M
223 Storage=persistent
224 '';
225
226 krebs.iptables = {
227 enable = true;
228 tables = {
229 nat.PREROUTING.rules = [
230 { predicate = "-i retiolum -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
231 { predicate = "-i wiregrill -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
232 { predicate = "-p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; }
233 { predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; }
234 ];
235 nat.OUTPUT.rules = [
236 { predicate = "-o lo -p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; }
237 ];
238 filter.INPUT.policy = "DROP";
239 filter.FORWARD.policy = "DROP";
240 filter.INPUT.rules = lib.mkMerge [
241 (lib.mkBefore [
242 { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
243 { predicate = "-p icmp"; target = "ACCEPT"; }
244 { predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; }
245 { predicate = "-i lo"; target = "ACCEPT"; }
246 { predicate = "-p tcp --dport 22"; target = "ACCEPT"; }
247 ])
248 (lib.mkOrder 1000 [
249 { predicate = "-i retiolum -p udp --dport 60000:61000"; target = "ACCEPT"; }
250 { predicate = "-i retiolum -p udp -m udp --dport 53"; target = "ACCEPT"; }
251 { predicate = "-i retiolum -p tcp --dport 19999"; target = "ACCEPT"; }
252 ])
253 (lib.mkAfter [
254 { predicate = "-p tcp -i retiolum"; target = "REJECT --reject-with tcp-reset"; }
255 { predicate = "-p udp -i retiolum"; target = "REJECT --reject-with icmp-port-unreachable"; v6 = false; }
256 { predicate = "-i retiolum"; target = "REJECT --reject-with icmp-proto-unreachable"; v6 = false; }
257 ])
258 ];
259 };
260 };
261
262 networking.dhcpcd.extraConfig = ''
263 noipv4ll
264 '';
265
266 networking.extraHosts = ''
267 10.42.0.1 styx.gg23
268 '';
269
270 nix.extraOptions = ''
271 experimental-features = nix-command flakes
272 '';
273
274 # use 24:00 time format, the default got sneakily changed around 20.03
275 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
276 time.timeZone = lib.mkDefault"Europe/Berlin";
277
278 # disable doc usually
279 documentation.nixos.enable = lib.mkDefault false;
280}