This repository has no description
8.4 kB
316 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9 selfPkgs = self.packages.${pkgs.stdenv.hostPlatform.system};
10in
11{
12
13 imports = [
14 # Import modules
15 ../modules
16
17 # Import individual configurations
18 ./security-workarounds.nix
19 ./gc.nix
20 ./mc.nix
21 ./zsh.nix
22 ./htop.nix
23 ./tor-ssh.nix
24 ./networkd.nix
25 ./pinned-registry.nix
26 ./nix.nix
27
28 ./kartei.nix
29 {
30 # nix-index
31 imports = [
32 self.inputs.nix-index-database.nixosModules.nix-index
33 ];
34 programs.nix-index-database.comma.enable = true;
35 }
36 {
37 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
38 users.extraUsers.mainUser.hashedPasswordFile =
39 config.clan.core.vars.generators.password.files.passwordHash.path;
40 users.extraUsers.root.hashedPasswordFile =
41 config.clan.core.vars.generators.password.files.passwordHash.path;
42 boot.initrd.systemd.emergencyAccess = true;
43 clan.core.vars.generators.password = {
44 prompts.password = {
45 description = "Password for the main user";
46 type = "hidden";
47 };
48 files.password.deploy = false;
49 files.passwordHash.neededFor = "users";
50 runtimeInputs = with pkgs; [
51 coreutils
52 mkpasswd
53 ];
54 script = ''
55 cp $prompts/password $out/password
56 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
57 '';
58 };
59 }
60 {
61 services.openssh.enable = true;
62 services.openssh.settings.PasswordAuthentication = false;
63 services.openssh.hostKeys = [
64 {
65 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
66 type = "ed25519";
67 }
68 ];
69 clan.core.vars.generators.ssh = {
70 files."ssh.id_ed25519" = { };
71 files."ssh.id_ed25519.pub".secret = false;
72 runtimeInputs = with pkgs; [
73 coreutils
74 openssh
75 ];
76 script = ''
77 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
78 '';
79 };
80 }
81 {
82 users.extraUsers = {
83 root = {
84 openssh.authorizedKeys.keys = [
85 self.keys.ssh.barnacle.public
86 self.keys.ssh.yubi_pgp.public
87 self.keys.ssh.termux_massulus.public
88 self.keys.ssh.yubi1.public
89 self.keys.ssh.yubi2.public
90 self.keys.ssh.solo2.public
91 self.keys.ssh.xerxes.public
92 self.keys.ssh.ignavia.public
93 self.keys.ssh.phonetpm_massulus.public
94 ];
95 };
96 mainUser = {
97 name = "lass";
98 uid = 1337;
99 home = "/home/lass";
100 group = "users";
101 createHome = true;
102 useDefaultShell = true;
103 isNormalUser = true;
104 linger = true;
105 extraGroups = [
106 "audio"
107 "video"
108 "fuse"
109 "wheel"
110 "tor"
111 "dialout"
112 ];
113 openssh.authorizedKeys.keys = [
114 self.keys.ssh.barnacle.public
115 self.keys.ssh.yubi_pgp.public
116 self.keys.ssh.termux_massulus.public
117 self.keys.ssh.yubi1.public
118 self.keys.ssh.yubi2.public
119 self.keys.ssh.solo2.public
120 self.keys.ssh.xerxes.public
121 self.keys.ssh.ignavia.public
122 self.keys.ssh.phonetpm_massulus.public
123 ];
124 };
125 };
126 }
127 (
128 let
129 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
130 in
131 {
132 environment.variables = {
133 CURL_CA_BUNDLE = ca-bundle;
134 GIT_SSL_CAINFO = ca-bundle;
135 SSL_CERT_FILE = ca-bundle;
136 };
137 }
138 )
139 (
140 # binary cache of the neoprism build farm (configs/nix-farm). The key
141 # only exists once `clan vars generate neoprism` has run; until then
142 # the cache is left out.
143 let
144 pub = self + "/vars/per-machine/neoprism/nix-cache-signing/key.pub/value";
145 in
146 lib.mkIf (builtins.pathExists pub) {
147 nix.settings.extra-substituters = [ "https://cache.lassul.us" ];
148 nix.settings.extra-trusted-public-keys = [ (lib.removeSuffix "\n" (builtins.readFile pub)) ];
149 }
150 )
151 {
152 #for sshuttle
153 environment.systemPackages = [
154 pkgs.python3Packages.python
155 ];
156 }
157 ];
158
159 networking.hostName = config.clan.core.settings.machine.name;
160
161 users.mutableUsers = false;
162
163 # multiple-definition-problem when defining environment.variables.EDITOR
164 environment.extraInit = ''
165 EDITOR=vim
166 '';
167
168 nixpkgs.config.allowUnfree = true;
169
170 environment.systemPackages = with pkgs; [
171 self.packages.${pkgs.system}.nvim
172 self.packages.${pkgs.system}.tmux
173 self.packages.${pkgs.system}.s
174
175 git
176 git-absorb
177 gnumake
178 jq
179 nix-output-monitor
180 comma
181
182 #style
183 rxvt-unicode-unwrapped.terminfo
184 alacritty.terminfo
185
186 #monitoring tools
187 htop
188 iotop
189
190 #network
191 iptables
192 iftop
193 tcpdump
194 mosh
195 self.packages.${pkgs.system}.sshify
196
197 #stuff for dl
198 aria2
199
200 #neat utils
201 file
202 xkcdpass
203 selfPkgs.kpaste
204 selfPkgs.cyberlocker-tools
205 pciutils
206 pop
207 selfPkgs.untilport
208 (pkgs.writers.writeDashBin "urgent" ''
209 printf '\a'
210 '')
211 usbutils
212
213 #unpack stuff
214 libarchive
215
216 (pkgs.writers.writeDashBin "sshn" ''
217 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
218 '')
219 ];
220
221 environment.shellAliases = {
222 ll = "ls -l";
223 la = "ls -la";
224 ls = "ls --color";
225 ip = "ip -color=auto";
226 grep = "grep --color=auto";
227 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
228 };
229
230 programs.bash = {
231 completion.enable = true;
232 interactiveShellInit = ''
233 HISTCONTROL='erasedups:ignorespace'
234 HISTSIZE=65536
235 HISTFILESIZE=$HISTSIZE
236
237 shopt -s checkhash
238 shopt -s histappend histreedit histverify
239 shopt -s no_empty_cmd_completion
240 complete -d cd
241 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
242 '';
243 promptInit = ''
244 if test $UID = 0; then
245 PS1='\[\033[1;31m\]\w\[\033[0m\] '
246 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
247 elif test $UID = 1337; then
248 PS1='\[\033[1;32m\]\w\[\033[0m\] '
249 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
250 else
251 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
252 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
253 fi
254 if test -n "$SSH_CLIENT"; then
255 PS1='\[\033[35m\]\h'" $PS1"
256 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
257 fi
258 '';
259 };
260
261 services.journald.settings.Journal = {
262 SystemMaxUse = "1G";
263 RuntimeMaxUse = "128M";
264 Storage = "persistent";
265 };
266
267 # nftables based NixOS firewall. Input and forward drop by default, as
268 # krebs.iptables did; no reverse path filter either, the routers,
269 # container hosts and NAT64 boxes route asymmetrically.
270 networking.nftables = {
271 enable = true;
272 # Defaults to true on machines older than 23.11, which would also wipe
273 # the tables libvirt, podman and jool keep on every reload.
274 flushRuleset = false;
275 # krebs.iptables loaded its rules through iptables-nft into these
276 # tables; nothing removes them when it goes away. Drop once every
277 # machine has switched to nftables.
278 extraDeletions = ''
279 table ip filter
280 delete table ip filter
281 table ip6 filter
282 delete table ip6 filter
283 table ip nat
284 delete table ip nat
285 table ip6 nat
286 delete table ip6 nat
287 '';
288 };
289 networking.firewall = {
290 filterForward = lib.mkDefault true;
291 checkReversePath = false;
292 # all of ICMP, not just echo-request, like krebs.iptables
293 extraInputRules = ''
294 meta l4proto icmp accept
295 '';
296 };
297
298 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
299 networking.firewall.allowedUDPPortRanges = [
300 {
301 from = 60000;
302 to = 61000;
303 }
304 ]; # mosh
305 networking.extraHosts = ''
306 10.42.0.1 acheron.gg23
307 10.42.0.3 styx.gg23
308 '';
309
310 # use 24:00 time format, the default got sneakily changed around 20.03
311 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
312 time.timeZone = lib.mkDefault "Europe/Berlin";
313
314 # disable doc usually
315 documentation.nixos.enable = lib.mkDefault false;
316}