This repository has no description
8.3 kB
315 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9 selfPkgs = self.packages.${pkgs.stdenv.hostPlatform.system};
10in
11{
12
13 imports = [
14 # Import modules
15 ../modules
16
17 # Import individual configurations
18 ./security-workarounds.nix
19 ./gc.nix
20 ./mc.nix
21 ./zsh.nix
22 ./htop.nix
23 ./tor-ssh.nix
24 ./networkd.nix
25 ./pinned-registry.nix
26 ./nix.nix
27 ./monitoring/agent.nix
28
29 ./kartei.nix
30 {
31 # nix-index
32 imports = [
33 self.inputs.nix-index-database.nixosModules.nix-index
34 ];
35 programs.nix-index-database.comma.enable = true;
36 }
37 {
38 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
39 users.extraUsers.mainUser.hashedPasswordFile =
40 config.clan.core.vars.generators.password.files.passwordHash.path;
41 users.extraUsers.root.hashedPasswordFile =
42 config.clan.core.vars.generators.password.files.passwordHash.path;
43 boot.initrd.systemd.emergencyAccess = true;
44 clan.core.vars.generators.password = {
45 prompts.password = {
46 description = "Password for the main user";
47 type = "hidden";
48 };
49 files.password.deploy = false;
50 files.passwordHash.neededFor = "users";
51 runtimeInputs = with pkgs; [
52 coreutils
53 mkpasswd
54 ];
55 script = ''
56 cp $prompts/password $out/password
57 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
58 '';
59 };
60 }
61 {
62 services.openssh.enable = true;
63 services.openssh.settings.PasswordAuthentication = false;
64 services.openssh.hostKeys = [
65 {
66 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
67 type = "ed25519";
68 }
69 ];
70 clan.core.vars.generators.ssh = {
71 files."ssh.id_ed25519" = { };
72 files."ssh.id_ed25519.pub".secret = false;
73 runtimeInputs = with pkgs; [
74 coreutils
75 openssh
76 ];
77 script = ''
78 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
79 '';
80 };
81 }
82 {
83 users.extraUsers = {
84 root = {
85 openssh.authorizedKeys.keys = [
86 self.keys.ssh.barnacle.public
87 self.keys.ssh.yubi_pgp.public
88 self.keys.ssh.termux_massulus.public
89 self.keys.ssh.yubi1.public
90 self.keys.ssh.yubi2.public
91 self.keys.ssh.solo2.public
92 self.keys.ssh.ignavia.public
93 self.keys.ssh.phonetpm_massulus.public
94 ];
95 };
96 mainUser = {
97 name = "lass";
98 uid = 1337;
99 home = "/home/lass";
100 group = "users";
101 createHome = true;
102 useDefaultShell = true;
103 isNormalUser = true;
104 linger = true;
105 extraGroups = [
106 "audio"
107 "video"
108 "fuse"
109 "wheel"
110 "tor"
111 "dialout"
112 ];
113 openssh.authorizedKeys.keys = [
114 self.keys.ssh.barnacle.public
115 self.keys.ssh.yubi_pgp.public
116 self.keys.ssh.termux_massulus.public
117 self.keys.ssh.yubi1.public
118 self.keys.ssh.yubi2.public
119 self.keys.ssh.solo2.public
120 self.keys.ssh.ignavia.public
121 self.keys.ssh.phonetpm_massulus.public
122 ];
123 };
124 };
125 }
126 (
127 let
128 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
129 in
130 {
131 environment.variables = {
132 CURL_CA_BUNDLE = ca-bundle;
133 GIT_SSL_CAINFO = ca-bundle;
134 SSL_CERT_FILE = ca-bundle;
135 };
136 }
137 )
138 (
139 # binary cache on neoprism, CI pushes there (configs/nix-cache.nix). The key
140 # only exists once `clan vars generate neoprism` has run; until then
141 # the cache is left out.
142 let
143 pub = self + "/vars/per-machine/neoprism/nix-cache-signing/key.pub/value";
144 in
145 lib.mkIf (builtins.pathExists pub) {
146 nix.settings.extra-substituters = [ "https://cache.lassul.us" ];
147 nix.settings.extra-trusted-public-keys = [ (lib.removeSuffix "\n" (builtins.readFile pub)) ];
148 }
149 )
150 {
151 #for sshuttle
152 environment.systemPackages = [
153 pkgs.python3Packages.python
154 ];
155 }
156 ];
157
158 networking.hostName = config.clan.core.settings.machine.name;
159
160 users.mutableUsers = false;
161
162 # multiple-definition-problem when defining environment.variables.EDITOR
163 environment.extraInit = ''
164 EDITOR=vim
165 '';
166
167 nixpkgs.config.allowUnfree = true;
168
169 environment.systemPackages = with pkgs; [
170 self.packages.${pkgs.system}.nvim
171 self.packages.${pkgs.system}.tmux
172 self.packages.${pkgs.system}.s
173
174 git
175 git-absorb
176 gnumake
177 jq
178 nix-output-monitor
179 comma
180
181 #style
182 rxvt-unicode-unwrapped.terminfo
183 alacritty.terminfo
184
185 #monitoring tools
186 htop
187 iotop
188
189 #network
190 iptables
191 iftop
192 tcpdump
193 mosh
194 self.packages.${pkgs.system}.sshify
195
196 #stuff for dl
197 aria2
198
199 #neat utils
200 file
201 xkcdpass
202 selfPkgs.kpaste
203 selfPkgs.cyberlocker-tools
204 pciutils
205 pop
206 selfPkgs.untilport
207 (pkgs.writers.writeDashBin "urgent" ''
208 printf '\a'
209 '')
210 usbutils
211
212 #unpack stuff
213 libarchive
214
215 (pkgs.writers.writeDashBin "sshn" ''
216 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
217 '')
218 ];
219
220 environment.shellAliases = {
221 ll = "ls -l";
222 la = "ls -la";
223 ls = "ls --color";
224 ip = "ip -color=auto";
225 grep = "grep --color=auto";
226 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
227 };
228
229 programs.bash = {
230 completion.enable = true;
231 interactiveShellInit = ''
232 HISTCONTROL='erasedups:ignorespace'
233 HISTSIZE=65536
234 HISTFILESIZE=$HISTSIZE
235
236 shopt -s checkhash
237 shopt -s histappend histreedit histverify
238 shopt -s no_empty_cmd_completion
239 complete -d cd
240 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
241 '';
242 promptInit = ''
243 if test $UID = 0; then
244 PS1='\[\033[1;31m\]\w\[\033[0m\] '
245 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
246 elif test $UID = 1337; then
247 PS1='\[\033[1;32m\]\w\[\033[0m\] '
248 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
249 else
250 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
251 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
252 fi
253 if test -n "$SSH_CLIENT"; then
254 PS1='\[\033[35m\]\h'" $PS1"
255 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
256 fi
257 '';
258 };
259
260 services.journald.settings.Journal = {
261 SystemMaxUse = "1G";
262 RuntimeMaxUse = "128M";
263 Storage = "persistent";
264 };
265
266 # nftables based NixOS firewall. Input and forward drop by default, as
267 # krebs.iptables did; no reverse path filter either, the routers,
268 # container hosts and NAT64 boxes route asymmetrically.
269 networking.nftables = {
270 enable = true;
271 # Defaults to true on machines older than 23.11, which would also wipe
272 # the tables libvirt, podman and jool keep on every reload.
273 flushRuleset = false;
274 # krebs.iptables loaded its rules through iptables-nft into these
275 # tables; nothing removes them when it goes away. Drop once every
276 # machine has switched to nftables.
277 extraDeletions = ''
278 table ip filter
279 delete table ip filter
280 table ip6 filter
281 delete table ip6 filter
282 table ip nat
283 delete table ip nat
284 table ip6 nat
285 delete table ip6 nat
286 '';
287 };
288 networking.firewall = {
289 filterForward = lib.mkDefault true;
290 checkReversePath = false;
291 # all of ICMP, not just echo-request, like krebs.iptables
292 extraInputRules = ''
293 meta l4proto icmp accept
294 '';
295 };
296
297 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
298 networking.firewall.allowedUDPPortRanges = [
299 {
300 from = 60000;
301 to = 61000;
302 }
303 ]; # mosh
304 networking.extraHosts = ''
305 10.42.0.1 acheron.gg23
306 10.42.0.3 styx.gg23
307 '';
308
309 # use 24:00 time format, the default got sneakily changed around 20.03
310 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
311 time.timeZone = lib.mkDefault "Europe/Berlin";
312
313 # disable doc usually
314 documentation.nixos.enable = lib.mkDefault false;
315}