This repository has no description
9.8 kB
386 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 imports = [
10 ./security-workarounds.nix
11 # ./binary-cache/client.nix
12 ./gc.nix
13 ./mc.nix
14 ./zsh.nix
15 ./htop.nix
16 ./wiregrill.nix
17 ./tmux.nix
18 ./tor-ssh.nix
19 ./networkd.nix
20 ./pinned-registry.nix
21 ./zerotier.nix
22 ./nether.nix
23 ./spora.nix
24 self.inputs.stockholm.nixosModules.users
25 self.inputs.stockholm.nixosModules.hosts
26 self.inputs.stockholm.nixosModules.kartei
27 self.inputs.stockholm.nixosModules.build
28 self.inputs.stockholm.nixosModules.dns
29 self.inputs.stockholm.nixosModules.exim
30 self.inputs.stockholm.nixosModules.exim-retiolum
31 self.inputs.stockholm.nixosModules.tinc
32 self.inputs.stockholm.nixosModules.iptables
33 self.inputs.stockholm.nixosModules.power-action
34 self.inputs.stockholm.nixosModules.setuid
35 self.inputs.stockholm.nixosModules.secret
36 self.inputs.stockholm.nixosModules.sitemap
37 self.inputs.stockholm.nixosModules.ssl
38 self.inputs.stockholm.nixosModules.systemd
39 self.inputs.stockholm.nixosModules.xresources
40 self.inputs.stockholm.nixosModules.ssh
41 self.inputs.stockholm.nixosModules.sync-containers3
42 {
43 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
44 users.extraUsers.mainUser.hashedPasswordFile =
45 config.clan.core.vars.generators.password.files.passwordHash.path;
46 users.extraUsers.root.hashedPasswordFile =
47 config.clan.core.vars.generators.password.files.passwordHash.path;
48 boot.initrd.systemd.emergencyAccess = true;
49 clan.core.vars.generators.password = {
50 prompts.password.description = "Password for the main user";
51 files.password.deploy = false;
52 files.passwordHash.neededForUsers = true;
53 migrateFact = "password";
54 runtimeInputs = with pkgs; [
55 coreutils
56 mkpasswd
57 ];
58 script = ''
59 cp $prompts/password $out/password
60 exit 1
61 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
62 '';
63 };
64 }
65 {
66 # deployment information
67 options.clan.flake-inputs = lib.mkOption {
68 description = ''
69 information about the flake inputs.
70 Used for update tracking.
71 '';
72 type = lib.types.attrsOf (
73 lib.types.attrsOf (
74 lib.types.nullOr (
75 lib.types.oneOf [
76 lib.types.str
77 lib.types.int
78 ]
79 )
80 )
81 );
82 default =
83 let
84 inputs = config.clan.core.clanDir.inputs;
85 cleanSourceInfo = input: {
86 rev = input.rev or null;
87 dirtyRev = input.dirtyRev or null;
88 lastModified = input.lastModified or null;
89 narHash = input.narHash or null;
90 };
91 sourceInfo = lib.mapAttrs (_: input: cleanSourceInfo input) inputs;
92 in
93 sourceInfo
94 // {
95 self = cleanSourceInfo config.clan.core.clanDir.sourceInfo;
96 };
97 };
98 config.environment.etc."flake-inputs.json".text =
99 let
100 text = builtins.unsafeDiscardStringContext (builtins.toJSON config.clan.flake-inputs);
101 in
102 text;
103 }
104 {
105 services.openssh.enable = true;
106 services.openssh.hostKeys = [
107 {
108 path = config.clanCore.vars.generators.ssh.files."ssh.id_ed25519".path;
109 type = "ed25519";
110 }
111 ];
112 clan.core.vars.generators.ssh = {
113 files."ssh.id_ed25519".secret = true;
114 files."ssh.id_ed25519.pub".secret = false;
115 migrateFact = "ssh";
116 runtimeInputs = with pkgs; [
117 coreutils
118 openssh
119 ];
120 script = ''
121 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
122 mv $secrets/ssh.id_ed25519.pub $out/ssh.id_ed25519.pub
123 '';
124 };
125 }
126 {
127 users.extraUsers = {
128 root = {
129 openssh.authorizedKeys.keys = [
130 config.krebs.users.lass.pubkey
131 ];
132 };
133 mainUser = {
134 name = "lass";
135 uid = 1337;
136 home = "/home/lass";
137 group = "users";
138 createHome = true;
139 useDefaultShell = true;
140 isNormalUser = true;
141 extraGroups = [
142 "audio"
143 "video"
144 "fuse"
145 "wheel"
146 "tor"
147 ];
148 openssh.authorizedKeys.keys = [
149 config.krebs.users.lass.pubkey
150 ];
151 };
152 };
153 }
154 (
155 let
156 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
157 in
158 {
159 environment.variables = {
160 CURL_CA_BUNDLE = ca-bundle;
161 GIT_SSL_CAINFO = ca-bundle;
162 SSL_CERT_FILE = ca-bundle;
163 };
164 }
165 )
166 {
167 #for sshuttle
168 environment.systemPackages = [
169 pkgs.python3Packages.python
170 ];
171 }
172 ];
173
174 networking.hostName = config.krebs.build.host.name;
175
176 krebs = {
177 enable = true;
178 build.user = config.krebs.users.lass;
179 ssl.trustIntermediate = true;
180 };
181
182 nix.settings.sandbox = true;
183
184 users.mutableUsers = false;
185
186 # multiple-definition-problem when defining environment.variables.EDITOR
187 environment.extraInit = ''
188 EDITOR=vim
189 '';
190
191 nixpkgs.config.allowUnfree = true;
192
193 environment.systemPackages = with pkgs; [
194 self.packages.${pkgs.system}.nvim
195
196 git
197 git-absorb
198 git-preview
199 gnumake
200 jq
201 nix-output-monitor
202
203 #style
204 rxvt-unicode-unwrapped.terminfo
205 alacritty.terminfo
206
207 #monitoring tools
208 htop
209 iotop
210
211 #network
212 iptables
213 iftop
214 tcpdump
215 mosh
216 eternal-terminal
217 self.packages.${pkgs.system}.sshify
218
219 #stuff for dl
220 aria2
221
222 #neat utils
223 file
224 hashPassword
225 xkcdpass
226 kpaste
227 cyberlocker-tools
228 pciutils
229 pop
230 q
231 rs
232 untilport
233 (pkgs.writeDashBin "urgent" ''
234 printf '\a'
235 '')
236 usbutils
237 self.packages.${pkgs.system}.logify
238 goify
239
240 #unpack stuff
241 libarchive
242
243 (pkgs.writeDashBin "sshn" ''
244 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
245 '')
246 ];
247
248 environment.shellAliases = {
249 ll = "ls -l";
250 la = "ls -la";
251 ls = "ls --color";
252 ip = "ip -color=auto";
253 grep = "grep --color=auto";
254 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
255 };
256
257 programs.bash = {
258 enableCompletion = true;
259 interactiveShellInit = ''
260 HISTCONTROL='erasedups:ignorespace'
261 HISTSIZE=65536
262 HISTFILESIZE=$HISTSIZE
263
264 shopt -s checkhash
265 shopt -s histappend histreedit histverify
266 shopt -s no_empty_cmd_completion
267 complete -d cd
268 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
269 '';
270 promptInit = ''
271 if test $UID = 0; then
272 PS1='\[\033[1;31m\]\w\[\033[0m\] '
273 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
274 elif test $UID = 1337; then
275 PS1='\[\033[1;32m\]\w\[\033[0m\] '
276 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
277 else
278 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
279 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
280 fi
281 if test -n "$SSH_CLIENT"; then
282 PS1='\[\033[35m\]\h'" $PS1"
283 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
284 fi
285 '';
286 };
287
288 services.journald.extraConfig = ''
289 SystemMaxUse=1G
290 RuntimeMaxUse=128M
291 Storage=persistent
292 '';
293
294 krebs.iptables = {
295 enable = true;
296 tables = {
297 filter.INPUT.policy = "DROP";
298 filter.FORWARD.policy = lib.mkDefault "DROP";
299 filter.INPUT.rules = lib.mkMerge [
300 (lib.mkBefore [
301 {
302 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
303 target = "ACCEPT";
304 }
305 {
306 predicate = "-p icmp";
307 target = "ACCEPT";
308 }
309 {
310 predicate = "-p ipv6-icmp";
311 target = "ACCEPT";
312 v4 = false;
313 }
314 {
315 predicate = "-i lo";
316 target = "ACCEPT";
317 }
318 {
319 predicate = "-p tcp --dport 22";
320 target = "ACCEPT";
321 }
322 ])
323 (lib.mkOrder 1000 [
324 {
325 predicate = "-p udp --dport 60000:61000";
326 target = "ACCEPT";
327 } # mosh
328 {
329 predicate = "-i retiolum -p udp -m udp --dport 53";
330 target = "ACCEPT";
331 }
332 {
333 predicate = "-i retiolum -p tcp --dport 19999";
334 target = "ACCEPT";
335 }
336 ])
337 (lib.mkAfter [
338 {
339 predicate = "-p tcp -i retiolum";
340 target = "REJECT --reject-with tcp-reset";
341 }
342 {
343 predicate = "-p udp -i retiolum";
344 target = "REJECT --reject-with icmp-port-unreachable";
345 v6 = false;
346 }
347 {
348 predicate = "-i retiolum";
349 target = "REJECT --reject-with icmp-proto-unreachable";
350 v6 = false;
351 }
352 ])
353 ];
354 };
355 };
356
357 networking.dhcpcd.extraConfig = ''
358 noipv4ll
359 '';
360
361 networking.extraHosts = ''
362 10.42.0.1 styx.gg23
363 '';
364
365 nix.settings.experimental-features = [
366 "nix-command"
367 "flakes"
368 ];
369
370 # use 24:00 time format, the default got sneakily changed around 20.03
371 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
372 time.timeZone = lib.mkDefault "Europe/Berlin";
373
374 # disable doc usually
375 documentation.nixos.enable = lib.mkDefault false;
376
377 # use new rebuild switch
378 system.switch = {
379 enable = false;
380 enableNg = true;
381 };
382
383 # use latest nix to hunt all the bugs
384 nix.package = pkgs.nixVersions.latest;
385
386}