This repository has no description
8.6 kB
337 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8{
9 # Clan core configuration
10 clan.core.vars.settings.secretStore = "password-store";
11 clan.core.networking.targetHost = "root@${config.networking.hostName}";
12
13 # Stockholm configuration
14 krebs.secret.directory = config.clan.core.vars.password-store.secretLocation;
15
16 # Nixpkgs overlays
17 nixpkgs.overlays = [
18 self.inputs.stockholm.overlays.default
19 (import (self.inputs.stockholm.inputs.nix-writers + "/pkgs")) # TODO get rid of that overlay
20 ];
21
22 imports = [
23 # Import 3modules
24 ../3modules
25
26 # Import stockholm krebs module
27 self.inputs.stockholm.nixosModules.krebs
28
29 # Import individual configurations
30 ./security-workarounds.nix
31 # ./binary-cache/client.nix
32 ./gc.nix
33 ./mc.nix
34 ./zsh.nix
35 ./htop.nix
36 ./tor-ssh.nix
37 ./networkd.nix
38 ./pinned-registry.nix
39 ./zerotier.nix
40 ./nether.nix
41 ./nix.nix
42
43 # Import stockholm modules
44 self.inputs.stockholm.nixosModules.users
45 self.inputs.stockholm.nixosModules.hosts
46 self.inputs.stockholm.nixosModules.kartei
47 self.inputs.stockholm.nixosModules.build
48 self.inputs.stockholm.nixosModules.dns
49 self.inputs.stockholm.nixosModules.exim
50 self.inputs.stockholm.nixosModules.exim-retiolum
51 self.inputs.stockholm.nixosModules.tinc
52 self.inputs.stockholm.nixosModules.iptables
53 self.inputs.stockholm.nixosModules.power-action
54 self.inputs.stockholm.nixosModules.setuid
55 self.inputs.stockholm.nixosModules.secret
56 self.inputs.stockholm.nixosModules.sitemap
57 self.inputs.stockholm.nixosModules.ssl
58 self.inputs.stockholm.nixosModules.systemd
59 self.inputs.stockholm.nixosModules.ssh
60 self.inputs.stockholm.nixosModules.sync-containers3
61 {
62 # nix-index
63 imports = [
64 self.inputs.nix-index-database.nixosModules.nix-index
65 ];
66 programs.nix-index-database.comma.enable = true;
67 }
68 {
69 # We need to mount these vars before the users phase, since that is the moment where the hashsed password are put into /etc/shadown
70 users.extraUsers.mainUser.hashedPasswordFile =
71 config.clan.core.vars.generators.password.files.passwordHash.path;
72 users.extraUsers.root.hashedPasswordFile =
73 config.clan.core.vars.generators.password.files.passwordHash.path;
74 boot.initrd.systemd.emergencyAccess = true;
75 clan.core.vars.generators.password = {
76 prompts.password = {
77 description = "Password for the main user";
78 type = "hidden";
79 };
80 files.password.deploy = false;
81 files.passwordHash.neededFor = "users";
82 runtimeInputs = with pkgs; [
83 coreutils
84 mkpasswd
85 ];
86 script = ''
87 cp $prompts/password $out/password
88 cat $out/password | mkpasswd -s -m sha-512 > $out/passwordHash
89 '';
90 };
91 }
92 {
93 services.openssh.enable = true;
94 services.openssh.settings.PasswordAuthentication = false;
95 services.openssh.hostKeys = [
96 {
97 path = config.clan.core.vars.generators.ssh.files."ssh.id_ed25519".path;
98 type = "ed25519";
99 }
100 ];
101 clan.core.vars.generators.ssh = {
102 files."ssh.id_ed25519" = { };
103 files."ssh.id_ed25519.pub".secret = false;
104 runtimeInputs = with pkgs; [
105 coreutils
106 openssh
107 ];
108 script = ''
109 ssh-keygen -t ed25519 -N "" -f $out/ssh.id_ed25519
110 '';
111 };
112 }
113 {
114 users.extraUsers = {
115 root = {
116 openssh.authorizedKeys.keys = [
117 self.keys.ssh.barnacle.public
118 self.keys.ssh.yubi_pgp.public
119 self.keys.ssh.yubi1.public
120 self.keys.ssh.yubi2.public
121 self.keys.ssh.solo2.public
122 self.keys.ssh.xerxes.public
123 ];
124 };
125 mainUser = {
126 name = "lass";
127 uid = 1337;
128 home = "/home/lass";
129 group = "users";
130 createHome = true;
131 useDefaultShell = true;
132 isNormalUser = true;
133 extraGroups = [
134 "audio"
135 "video"
136 "fuse"
137 "wheel"
138 "tor"
139 "dialout"
140 ];
141 openssh.authorizedKeys.keys = [
142 self.keys.ssh.barnacle.public
143 self.keys.ssh.yubi_pgp.public
144 self.keys.ssh.yubi1.public
145 self.keys.ssh.yubi2.public
146 self.keys.ssh.solo2.public
147 self.keys.ssh.xerxes.public
148 ];
149 };
150 };
151 }
152 (
153 let
154 ca-bundle = "/etc/ssl/certs/ca-bundle.crt";
155 in
156 {
157 environment.variables = {
158 CURL_CA_BUNDLE = ca-bundle;
159 GIT_SSL_CAINFO = ca-bundle;
160 SSL_CERT_FILE = ca-bundle;
161 };
162 }
163 )
164 {
165 #for sshuttle
166 environment.systemPackages = [
167 pkgs.python3Packages.python
168 ];
169 }
170 ];
171
172 networking.hostName = config.krebs.build.host.name;
173
174 krebs = {
175 enable = true;
176 build.user = config.krebs.users.lass;
177 ssl.trustIntermediate = true;
178 };
179
180 users.mutableUsers = false;
181
182 # multiple-definition-problem when defining environment.variables.EDITOR
183 environment.extraInit = ''
184 EDITOR=vim
185 '';
186
187 nixpkgs.config.allowUnfree = true;
188
189 environment.systemPackages = with pkgs; [
190 self.packages.${pkgs.system}.nvim
191 self.packages.${pkgs.system}.tmux
192
193 git
194 git-absorb
195 git-preview
196 gnumake
197 jq
198 nix-output-monitor
199 comma
200
201 #style
202 rxvt-unicode-unwrapped.terminfo
203 alacritty.terminfo
204
205 #monitoring tools
206 htop
207 iotop
208
209 #network
210 iptables
211 iftop
212 tcpdump
213 mosh
214 eternal-terminal
215 self.packages.${pkgs.system}.sshify
216
217 #stuff for dl
218 aria2
219
220 #neat utils
221 file
222 hashPassword
223 xkcdpass
224 kpaste
225 cyberlocker-tools
226 pciutils
227 pop
228 q
229 untilport
230 (pkgs.writeDashBin "urgent" ''
231 printf '\a'
232 '')
233 usbutils
234 self.packages.${pkgs.system}.logify
235 goify
236
237 #unpack stuff
238 libarchive
239
240 (pkgs.writeDashBin "sshn" ''
241 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
242 '')
243 ];
244
245 environment.shellAliases = {
246 ll = "ls -l";
247 la = "ls -la";
248 ls = "ls --color";
249 ip = "ip -color=auto";
250 grep = "grep --color=auto";
251 nosleep = "systemd-inhibit --what=handle-lid-switch sleep infinity";
252 };
253
254 programs.bash = {
255 completion.enable = true;
256 interactiveShellInit = ''
257 HISTCONTROL='erasedups:ignorespace'
258 HISTSIZE=65536
259 HISTFILESIZE=$HISTSIZE
260
261 shopt -s checkhash
262 shopt -s histappend histreedit histverify
263 shopt -s no_empty_cmd_completion
264 complete -d cd
265 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
266 '';
267 promptInit = ''
268 if test $UID = 0; then
269 PS1='\[\033[1;31m\]\w\[\033[0m\] '
270 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
271 elif test $UID = 1337; then
272 PS1='\[\033[1;32m\]\w\[\033[0m\] '
273 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
274 else
275 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
276 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
277 fi
278 if test -n "$SSH_CLIENT"; then
279 PS1='\[\033[35m\]\h'" $PS1"
280 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
281 fi
282 '';
283 };
284
285 services.journald.extraConfig = ''
286 SystemMaxUse=1G
287 RuntimeMaxUse=128M
288 Storage=persistent
289 '';
290
291 krebs.iptables = {
292 enable = true;
293 tables = {
294 filter.INPUT.policy = "DROP";
295 filter.FORWARD.policy = lib.mkDefault "DROP";
296 filter.INPUT.rules = lib.mkMerge [
297 (lib.mkBefore [
298 {
299 predicate = "-m conntrack --ctstate RELATED,ESTABLISHED";
300 target = "ACCEPT";
301 }
302 {
303 predicate = "-p icmp";
304 target = "ACCEPT";
305 }
306 {
307 predicate = "-p ipv6-icmp";
308 target = "ACCEPT";
309 v4 = false;
310 }
311 {
312 predicate = "-i lo";
313 target = "ACCEPT";
314 }
315 ])
316 ];
317 };
318 };
319
320 networking.firewall.allowedTCPPorts = [ 22 ]; # ssh
321 networking.firewall.allowedUDPPortRanges = [
322 {
323 from = 60000;
324 to = 61000;
325 }
326 ]; # mosh
327 networking.extraHosts = ''
328 10.42.0.1 styx.gg23
329 '';
330
331 # use 24:00 time format, the default got sneakily changed around 20.03
332 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
333 time.timeZone = lib.mkDefault "Europe/Berlin";
334
335 # disable doc usually
336 documentation.nixos.enable = lib.mkDefault false;
337}