This repository has no description
7.4 kB
273 lines
1{ self, config, lib, pkgs, ... }:
2{
3 imports = [
4 ./binary-cache/client.nix
5 ./gc.nix
6 ./mc.nix
7 ./zsh.nix
8 ./htop.nix
9 ./wiregrill.nix
10 ./tmux.nix
11 ./tor-ssh.nix
12 ./networkd.nix
13 ./pinned-registry.nix
14 ./zerotier.nix
15 ./nether.nix
16 ./spora.nix
17 self.inputs.stockholm.nixosModules.users
18 self.inputs.stockholm.nixosModules.hosts
19 self.inputs.stockholm.nixosModules.kartei
20 self.inputs.stockholm.nixosModules.build
21 self.inputs.stockholm.nixosModules.dns
22 self.inputs.stockholm.nixosModules.exim
23 self.inputs.stockholm.nixosModules.exim-retiolum
24 self.inputs.stockholm.nixosModules.tinc
25 self.inputs.stockholm.nixosModules.iptables
26 self.inputs.stockholm.nixosModules.power-action
27 self.inputs.stockholm.nixosModules.setuid
28 self.inputs.stockholm.nixosModules.secret
29 self.inputs.stockholm.nixosModules.sitemap
30 self.inputs.stockholm.nixosModules.ssl
31 self.inputs.stockholm.nixosModules.systemd
32 self.inputs.stockholm.nixosModules.xresources
33 self.inputs.stockholm.nixosModules.ssh
34 self.inputs.stockholm.nixosModules.sync-containers3
35 {
36 users.extraUsers.mainUser.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
37 users.extraUsers.root.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
38 clanCore.facts.services.password = {
39 secret.password = { };
40 secret.passwordHash = { };
41 generator.path = with pkgs; [ coreutils xkcdpass mkpasswd ];
42 generator.script = ''
43 xkcdpass -n 4 -d - > $secrets/password
44 cat $secrets/password | mkpasswd -s -m sha-512 > $secrets/passwordHash
45 '';
46 };
47 }
48 {
49 services.openssh.enable = true;
50 services.openssh.hostKeys = [{
51 path = config.clanCore.facts.services.ssh.secret."ssh.id_ed25519".path;
52 type = "ed25519";
53 }];
54 clanCore.facts.services.ssh = {
55 secret."ssh.id_ed25519" = { };
56 public."ssh.id_ed25519.pub" = { };
57 generator.path = with pkgs; [ coreutils openssh ];
58 generator.script = ''
59 ssh-keygen -t ed25519 -N "" -f $secrets/ssh.id_ed25519
60 mv $secrets/ssh.id_ed25519.pub $facts/ssh.id_ed25519.pub
61 '';
62 };
63 }
64 {
65 users.extraUsers = {
66 root = {
67 openssh.authorizedKeys.keys = [
68 config.krebs.users.lass.pubkey
69 ];
70 };
71 mainUser = {
72 name = "lass";
73 uid = 1337;
74 home = "/home/lass";
75 group = "users";
76 createHome = true;
77 useDefaultShell = true;
78 isNormalUser = true;
79 extraGroups = [
80 "audio"
81 "video"
82 "fuse"
83 "wheel"
84 "tor"
85 ];
86 openssh.authorizedKeys.keys = [
87 config.krebs.users.lass.pubkey
88 ];
89 };
90 };
91 }
92 (let ca-bundle = "/etc/ssl/certs/ca-bundle.crt"; in {
93 environment.variables = {
94 CURL_CA_BUNDLE = ca-bundle;
95 GIT_SSL_CAINFO = ca-bundle;
96 SSL_CERT_FILE = ca-bundle;
97 };
98 })
99 {
100 #for sshuttle
101 environment.systemPackages = [
102 pkgs.python3Packages.python
103 ];
104 }
105 ];
106
107 networking.hostName = config.krebs.build.host.name;
108
109 krebs = {
110 enable = true;
111 build.user = config.krebs.users.lass;
112 ssl.trustIntermediate = true;
113 };
114
115 nix.settings.sandbox = true;
116
117 users.mutableUsers = false;
118
119 # multiple-definition-problem when defining environment.variables.EDITOR
120 environment.extraInit = ''
121 EDITOR=vim
122 '';
123
124 nixpkgs.config.allowUnfree = true;
125
126 environment.systemPackages = with pkgs; [
127 self.packages.${pkgs.system}.vim
128
129 #stockholm
130 git
131 git-absorb
132 git-preview
133 gnumake
134 jq
135 nix-output-monitor
136
137 #style
138 rxvt-unicode-unwrapped.terminfo
139 alacritty.terminfo
140
141 #monitoring tools
142 htop
143 iotop
144
145 #network
146 iptables
147 iftop
148 tcpdump
149 mosh
150 eternal-terminal
151 self.packages.${pkgs.system}.sshify
152
153 #stuff for dl
154 aria2
155
156 #neat utils
157 file
158 hashPassword
159 kpaste
160 cyberlocker-tools
161 pciutils
162 pop
163 q
164 rs
165 untilport
166 (pkgs.writeDashBin "urgent" ''
167 printf '\a'
168 '')
169 usbutils
170 self.packages.${pkgs.system}.logify
171 goify
172
173 #unpack stuff
174 libarchive
175
176 (pkgs.writeDashBin "sshn" ''
177 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
178 '')
179 ];
180
181 environment.shellAliases = {
182 ll = "ls -l";
183 la = "ls -la";
184 ls = "ls --color";
185 ip = "ip -color=auto";
186 grep = "grep --color=auto";
187 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
188 };
189
190 programs.bash = {
191 enableCompletion = true;
192 interactiveShellInit = ''
193 HISTCONTROL='erasedups:ignorespace'
194 HISTSIZE=65536
195 HISTFILESIZE=$HISTSIZE
196
197 shopt -s checkhash
198 shopt -s histappend histreedit histverify
199 shopt -s no_empty_cmd_completion
200 complete -d cd
201 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
202 '';
203 promptInit = ''
204 if test $UID = 0; then
205 PS1='\[\033[1;31m\]\w\[\033[0m\] '
206 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
207 elif test $UID = 1337; then
208 PS1='\[\033[1;32m\]\w\[\033[0m\] '
209 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
210 else
211 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
212 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
213 fi
214 if test -n "$SSH_CLIENT"; then
215 PS1='\[\033[35m\]\h'" $PS1"
216 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
217 fi
218 '';
219 };
220
221 services.journald.extraConfig = ''
222 SystemMaxUse=1G
223 RuntimeMaxUse=128M
224 Storage=persistent
225 '';
226
227 krebs.iptables = {
228 enable = true;
229 tables = {
230 filter.INPUT.policy = "DROP";
231 filter.FORWARD.policy = lib.mkDefault "DROP";
232 filter.INPUT.rules = lib.mkMerge [
233 (lib.mkBefore [
234 { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
235 { predicate = "-p icmp"; target = "ACCEPT"; }
236 { predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; }
237 { predicate = "-i lo"; target = "ACCEPT"; }
238 { predicate = "-p tcp --dport 22"; target = "ACCEPT"; }
239 ])
240 (lib.mkOrder 1000 [
241 { predicate = "-p udp --dport 60000:61000"; target = "ACCEPT"; } # mosh
242 { predicate = "-i retiolum -p udp -m udp --dport 53"; target = "ACCEPT"; }
243 { predicate = "-i retiolum -p tcp --dport 19999"; target = "ACCEPT"; }
244 ])
245 (lib.mkAfter [
246 { predicate = "-p tcp -i retiolum"; target = "REJECT --reject-with tcp-reset"; }
247 { predicate = "-p udp -i retiolum"; target = "REJECT --reject-with icmp-port-unreachable"; v6 = false; }
248 { predicate = "-i retiolum"; target = "REJECT --reject-with icmp-proto-unreachable"; v6 = false; }
249 ])
250 ];
251 };
252 };
253
254 networking.dhcpcd.extraConfig = ''
255 noipv4ll
256 '';
257
258 networking.extraHosts = ''
259 10.42.0.1 styx.gg23
260 '';
261
262 nix.settings.experimental-features = [
263 "nix-command"
264 "flakes"
265 ];
266
267 # use 24:00 time format, the default got sneakily changed around 20.03
268 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
269 time.timeZone = lib.mkDefault"Europe/Berlin";
270
271 # disable doc usually
272 documentation.nixos.enable = lib.mkDefault false;
273}