This repository has no description
9.7 kB
382 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 imports = [
10 ./security-workarounds.nix
11 # ./binary-cache/client.nix
12 ./gc.nix
13 ./mc.nix
14 ./zsh.nix
15 ./htop.nix
16 ./wiregrill.nix
17 ./tmux.nix
18 ./tor-ssh.nix
19 ./networkd.nix
20 ./pinned-registry.nix
21 ./zerotier.nix
22 ./nether.nix
23 ./spora.nix
24 ./nix.nix
25 self.inputs.stockholm.nixosModules.users
26 self.inputs.stockholm.nixosModules.hosts
27 self.inputs.stockholm.nixosModules.kartei
28 self.inputs.stockholm.nixosModules.build
29 self.inputs.stockholm.nixosModules.dns
30 self.inputs.stockholm.nixosModules.exim
31 self.inputs.stockholm.nixosModules.exim-retiolum
32 self.inputs.stockholm.nixosModules.tinc
33 self.inputs.stockholm.nixosModules.iptables
34 self.inputs.stockholm.nixosModules.power-action
35 self.inputs.stockholm.nixosModules.setuid
36 self.inputs.stockholm.nixosModules.secret
37 self.inputs.stockholm.nixosModules.sitemap
38 self.inputs.stockholm.nixosModules.ssl
39 self.inputs.stockholm.nixosModules.systemd
40 self.inputs.stockholm.nixosModules.xresources
41 self.inputs.stockholm.nixosModules.ssh
42 self.inputs.stockholm.nixosModules.sync-containers3
43 {
44 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
45 users.extraUsers.mainUser.hashedPasswordFile =
46 config.clan.core.vars.generators.password.files.passwordHash.path;
47 users.extraUsers.root.hashedPasswordFile =
48 config.clan.core.vars.generators.password.files.passwordHash.path;
49 boot.initrd.systemd.emergencyAccess = true;
50 clan.core.vars.generators.password = {
51 prompts.password = {
52 description = "Password for the main user";
53 type = "hidden";
54 };
55 files.password.deploy = false;
56 files.passwordHash.neededForUsers = true;
57 migrateFact = "password";
58 runtimeInputs = with pkgs; [
59 coreutils
60 mkpasswd
61 ];
62 script = ''
63 cp $prompts/password $out/password
64 exit 1
65 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
66 '';
67 };
68 }
69 {
70 # deployment information
71 options.clan.flake-inputs = lib.mkOption {
72 description = ''
73 information about the flake inputs.
74 Used for update tracking.
75 '';
76 type = lib.types.attrsOf (
77 lib.types.attrsOf (
78 lib.types.nullOr (
79 lib.types.oneOf [
80 lib.types.str
81 lib.types.int
82 ]
83 )
84 )
85 );
86 default =
87 let
88 inputs = config.clan.core.clanDir.inputs;
89 cleanSourceInfo = input: {
90 rev = input.rev or null;
91 dirtyRev = input.dirtyRev or null;
92 lastModified = input.lastModified or null;
93 narHash = input.narHash or null;
94 };
95 sourceInfo = lib.mapAttrs (_: input: cleanSourceInfo input) inputs;
96 in
97 sourceInfo
98 // {
99 self = cleanSourceInfo config.clan.core.clanDir.sourceInfo;
100 };
101 };
102 config.environment.etc."flake-inputs.json".text =
103 let
104 text = builtins.unsafeDiscardStringContext (builtins.toJSON config.clan.flake-inputs);
105 in
106 text;
107 }
108 {
109 services.openssh.enable = true;
110 services.openssh.hostKeys = [
111 {
112 path = config.clanCore.vars.generators.ssh.files."ssh.id_ed25519".path;
113 type = "ed25519";
114 }
115 ];
116 clan.core.vars.generators.ssh = {
117 files."ssh.id_ed25519".secret = true;
118 files."ssh.id_ed25519.pub".secret = false;
119 migrateFact = "ssh";
120 runtimeInputs = with pkgs; [
121 coreutils
122 openssh
123 ];
124 script = ''
125 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
126 '';
127 };
128 }
129 {
130 users.extraUsers = {
131 root = {
132 openssh.authorizedKeys.keys = [
133 config.krebs.users.lass.pubkey
134 ];
135 };
136 mainUser = {
137 name = "lass";
138 uid = 1337;
139 home = "/home/lass";
140 group = "users";
141 createHome = true;
142 useDefaultShell = true;
143 isNormalUser = true;
144 extraGroups = [
145 "audio"
146 "video"
147 "fuse"
148 "wheel"
149 "tor"
150 ];
151 openssh.authorizedKeys.keys = [
152 config.krebs.users.lass.pubkey
153 ];
154 };
155 };
156 }
157 (
158 let
159 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
160 in
161 {
162 environment.variables = {
163 CURL_CA_BUNDLE = ca-bundle;
164 GIT_SSL_CAINFO = ca-bundle;
165 SSL_CERT_FILE = ca-bundle;
166 };
167 }
168 )
169 {
170 #for sshuttle
171 environment.systemPackages = [
172 pkgs.python3Packages.python
173 ];
174 }
175 ];
176
177 networking.hostName = config.krebs.build.host.name;
178
179 krebs = {
180 enable = true;
181 build.user = config.krebs.users.lass;
182 ssl.trustIntermediate = true;
183 };
184
185 users.mutableUsers = false;
186
187 # multiple-definition-problem when defining environment.variables.EDITOR
188 environment.extraInit = ''
189 EDITOR=vim
190 '';
191
192 nixpkgs.config.allowUnfree = true;
193
194 environment.systemPackages = with pkgs; [
195 self.packages.${pkgs.system}.nvim
196
197 git
198 git-absorb
199 git-preview
200 gnumake
201 jq
202 nix-output-monitor
203
204 #style
205 rxvt-unicode-unwrapped.terminfo
206 alacritty.terminfo
207
208 #monitoring tools
209 htop
210 iotop
211
212 #network
213 iptables
214 iftop
215 tcpdump
216 mosh
217 eternal-terminal
218 self.packages.${pkgs.system}.sshify
219
220 #stuff for dl
221 aria2
222
223 #neat utils
224 file
225 hashPassword
226 xkcdpass
227 kpaste
228 cyberlocker-tools
229 pciutils
230 pop
231 q
232 rs
233 untilport
234 (pkgs.writeDashBin "urgent" ''
235 printf '\a'
236 '')
237 usbutils
238 self.packages.${pkgs.system}.logify
239 goify
240
241 #unpack stuff
242 libarchive
243
244 (pkgs.writeDashBin "sshn" ''
245 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
246 '')
247 ];
248
249 environment.shellAliases = {
250 ll = "ls -l";
251 la = "ls -la";
252 ls = "ls --color";
253 ip = "ip -color=auto";
254 grep = "grep --color=auto";
255 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
256 };
257
258 programs.bash = {
259 enableCompletion = true;
260 interactiveShellInit = ''
261 HISTCONTROL='erasedups:ignorespace'
262 HISTSIZE=65536
263 HISTFILESIZE=$HISTSIZE
264
265 shopt -s checkhash
266 shopt -s histappend histreedit histverify
267 shopt -s no_empty_cmd_completion
268 complete -d cd
269 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
270 '';
271 promptInit = ''
272 if test $UID = 0; then
273 PS1='\[\033[1;31m\]\w\[\033[0m\] '
274 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
275 elif test $UID = 1337; then
276 PS1='\[\033[1;32m\]\w\[\033[0m\] '
277 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
278 else
279 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
280 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
281 fi
282 if test -n "$SSH_CLIENT"; then
283 PS1='\[\033[35m\]\h'" $PS1"
284 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
285 fi
286 '';
287 };
288
289 services.journald.extraConfig = ''
290 SystemMaxUse=1G
291 RuntimeMaxUse=128M
292 Storage=persistent
293 '';
294
295 krebs.iptables = {
296 enable = true;
297 tables = {
298 filter.INPUT.policy = "DROP";
299 filter.FORWARD.policy = lib.mkDefault "DROP";
300 filter.INPUT.rules = lib.mkMerge [
301 (lib.mkBefore [
302 {
303 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
304 target = "ACCEPT";
305 }
306 {
307 predicate = "-p icmp";
308 target = "ACCEPT";
309 }
310 {
311 predicate = "-p ipv6-icmp";
312 target = "ACCEPT";
313 v4 = false;
314 }
315 {
316 predicate = "-i lo";
317 target = "ACCEPT";
318 }
319 {
320 predicate = "-p tcp --dport 22";
321 target = "ACCEPT";
322 }
323 ])
324 (lib.mkOrder 1000 [
325 {
326 predicate = "-p udp --dport 60000:61000";
327 target = "ACCEPT";
328 } # mosh
329 {
330 predicate = "-i retiolum -p udp -m udp --dport 53";
331 target = "ACCEPT";
332 }
333 {
334 predicate = "-i retiolum -p tcp --dport 19999";
335 target = "ACCEPT";
336 }
337 ])
338 (lib.mkAfter [
339 {
340 predicate = "-p tcp -i retiolum";
341 target = "REJECT --reject-with tcp-reset";
342 }
343 {
344 predicate = "-p udp -i retiolum";
345 target = "REJECT --reject-with icmp-port-unreachable";
346 v6 = false;
347 }
348 {
349 predicate = "-i retiolum";
350 target = "REJECT --reject-with icmp-proto-unreachable";
351 v6 = false;
352 }
353 ])
354 ];
355 };
356 };
357
358 networking.dhcpcd.extraConfig = ''
359 noipv4ll
360 '';
361
362 networking.extraHosts = ''
363 10.42.0.1 styx.gg23
364 '';
365
366 # use 24:00 time format, the default got sneakily changed around 20.03
367 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
368 time.timeZone = lib.mkDefault "Europe/Berlin";
369
370 # disable doc usually
371 documentation.nixos.enable = lib.mkDefault false;
372
373 # use new rebuild switch
374 system.switch = {
375 enable = false;
376 enableNg = true;
377 };
378
379 # use latest nix to hunt all the bugs
380 nix.package = pkgs.nixVersions.latest;
381
382}