This repository has no description
7.7 kB
276 lines
1{ self, config, lib, pkgs, ... }:
2{
3 imports = [
4 ./binary-cache/client.nix
5 ./gc.nix
6 ./mc.nix
7 ./zsh.nix
8 ./htop.nix
9 ./wiregrill.nix
10 ./tmux.nix
11 ./tor-ssh.nix
12 ./networkd.nix
13 ./pinned-registry.nix
14 self.inputs.stockholm.nixosModules.users
15 self.inputs.stockholm.nixosModules.hosts
16 self.inputs.stockholm.nixosModules.kartei
17 self.inputs.stockholm.nixosModules.build
18 self.inputs.stockholm.nixosModules.dns
19 self.inputs.stockholm.nixosModules.exim
20 self.inputs.stockholm.nixosModules.exim-retiolum
21 self.inputs.stockholm.nixosModules.tinc
22 self.inputs.stockholm.nixosModules.iptables
23 self.inputs.stockholm.nixosModules.power-action
24 self.inputs.stockholm.nixosModules.setuid
25 self.inputs.stockholm.nixosModules.secret
26 self.inputs.stockholm.nixosModules.sitemap
27 self.inputs.stockholm.nixosModules.ssl
28 self.inputs.stockholm.nixosModules.systemd
29 self.inputs.stockholm.nixosModules.xresources
30 self.inputs.stockholm.nixosModules.ssh
31 self.inputs.stockholm.nixosModules.sync-containers3
32 {
33 users.extraUsers.mainUser.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
34 users.extraUsers.root.hashedPasswordFile = "${config.krebs.secret.directory}/passwordHash";
35 clanCore.secrets.password = {
36 secrets.password = { };
37 secrets.passwordHash = { };
38 generator = ''
39 ${pkgs.xkcdpass}/bin/xkcdpass -n 4 -d - > $secrets/password
40 cat $secrets/password | ${pkgs.mkpasswd}/bin/mkpasswd -s -m sha-512 > $secrets/passwordHash
41 '';
42 };
43 }
44 {
45 services.openssh.enable = true;
46 services.openssh.hostKeys = [{
47 path = "${config.krebs.secret.directory}/ssh.id_ed25519";
48 type = "ed25519";
49 }];
50 clanCore.secrets.ssh = {
51 secrets."ssh.id_ed25519" = { };
52 facts."ssh.id_ed25519.pub" = { };
53 generator = ''
54 ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -N "" -f $secrets/ssh.id_ed25519
55 mv $secrets/ssh.id_ed25519.pub $facts/ssh.id_ed25519.pub
56 '';
57 };
58 }
59 {
60 users.extraUsers = {
61 root = {
62 openssh.authorizedKeys.keys = [
63 config.krebs.users.lass.pubkey
64 ];
65 };
66 mainUser = {
67 name = "lass";
68 uid = 1337;
69 home = "/home/lass";
70 group = "users";
71 createHome = true;
72 useDefaultShell = true;
73 isNormalUser = true;
74 extraGroups = [
75 "audio"
76 "video"
77 "fuse"
78 "wheel"
79 "tor"
80 ];
81 openssh.authorizedKeys.keys = [
82 config.krebs.users.lass.pubkey
83 ];
84 };
85 };
86 }
87 (let ca-bundle = "/etc/ssl/certs/ca-bundle.crt"; in {
88 environment.variables = {
89 CURL_CA_BUNDLE = ca-bundle;
90 GIT_SSL_CAINFO = ca-bundle;
91 SSL_CERT_FILE = ca-bundle;
92 };
93 })
94 {
95 #for sshuttle
96 environment.systemPackages = [
97 pkgs.python3Packages.python
98 ];
99 }
100 ];
101
102 networking.hostName = config.krebs.build.host.name;
103
104 krebs = {
105 enable = true;
106 build.user = config.krebs.users.lass;
107 ssl.trustIntermediate = true;
108 };
109
110 nix.useSandbox = true;
111
112 users.mutableUsers = false;
113
114 # multiple-definition-problem when defining environment.variables.EDITOR
115 environment.extraInit = ''
116 EDITOR=vim
117 '';
118
119 nixpkgs.config.allowUnfree = true;
120
121 environment.systemPackages = with pkgs; [
122 self.packages.${pkgs.system}.vim
123
124 #stockholm
125 deploy
126 git
127 git-absorb
128 git-preview
129 gnumake
130 jq
131 nix-output-monitor
132
133 #style
134 rxvt-unicode-unwrapped.terminfo
135 alacritty.terminfo
136
137 #monitoring tools
138 htop
139 iotop
140
141 #network
142 iptables
143 iftop
144 tcpdump
145 mosh
146 eternal-terminal
147 sshify
148
149 #stuff for dl
150 aria2
151
152 #neat utils
153 file
154 hashPassword
155 kpaste
156 cyberlocker-tools
157 pciutils
158 pop
159 q
160 rs
161 untilport
162 (pkgs.writeDashBin "urgent" ''
163 printf '\a'
164 '')
165 usbutils
166 logify
167 goify
168
169 #unpack stuff
170 libarchive
171
172 (pkgs.writeDashBin "sshn" ''
173 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
174 '')
175 ];
176
177 environment.shellAliases = {
178 ll = "ls -l";
179 la = "ls -la";
180 ls = "ls --color";
181 ip = "ip -color=auto";
182 grep = "grep --color=auto";
183 };
184
185 programs.bash = {
186 enableCompletion = true;
187 interactiveShellInit = ''
188 HISTCONTROL='erasedups:ignorespace'
189 HISTSIZE=65536
190 HISTFILESIZE=$HISTSIZE
191
192 shopt -s checkhash
193 shopt -s histappend histreedit histverify
194 shopt -s no_empty_cmd_completion
195 complete -d cd
196 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
197 '';
198 promptInit = ''
199 if test $UID = 0; then
200 PS1='\[\033[1;31m\]\w\[\033[0m\] '
201 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
202 elif test $UID = 1337; then
203 PS1='\[\033[1;32m\]\w\[\033[0m\] '
204 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
205 else
206 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
207 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
208 fi
209 if test -n "$SSH_CLIENT"; then
210 PS1='\[\033[35m\]\h'" $PS1"
211 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
212 fi
213 '';
214 };
215
216 services.journald.extraConfig = ''
217 SystemMaxUse=1G
218 RuntimeMaxUse=128M
219 Storage=persistent
220 '';
221
222 krebs.iptables = {
223 enable = true;
224 tables = {
225 nat.PREROUTING.rules = [
226 { predicate = "-i retiolum -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
227 { predicate = "-i wiregrill -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
228 { predicate = "-p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; }
229 { predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; }
230 ];
231 nat.OUTPUT.rules = [
232 { predicate = "-o lo -p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; }
233 ];
234 filter.INPUT.policy = "DROP";
235 filter.FORWARD.policy = "DROP";
236 filter.INPUT.rules = lib.mkMerge [
237 (lib.mkBefore [
238 { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
239 { predicate = "-p icmp"; target = "ACCEPT"; }
240 { predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; }
241 { predicate = "-i lo"; target = "ACCEPT"; }
242 { predicate = "-p tcp --dport 22"; target = "ACCEPT"; }
243 ])
244 (lib.mkOrder 1000 [
245 { predicate = "-i retiolum -p udp --dport 60000:61000"; target = "ACCEPT"; }
246 { predicate = "-i retiolum -p udp -m udp --dport 53"; target = "ACCEPT"; }
247 { predicate = "-i retiolum -p tcp --dport 19999"; target = "ACCEPT"; }
248 ])
249 (lib.mkAfter [
250 { predicate = "-p tcp -i retiolum"; target = "REJECT --reject-with tcp-reset"; }
251 { predicate = "-p udp -i retiolum"; target = "REJECT --reject-with icmp-port-unreachable"; v6 = false; }
252 { predicate = "-i retiolum"; target = "REJECT --reject-with icmp-proto-unreachable"; v6 = false; }
253 ])
254 ];
255 };
256 };
257
258 networking.dhcpcd.extraConfig = ''
259 noipv4ll
260 '';
261
262 networking.extraHosts = ''
263 10.42.0.1 styx.gg23
264 '';
265
266 nix.extraOptions = ''
267 experimental-features = nix-command flakes
268 '';
269
270 # use 24:00 time format, the default got sneakily changed around 20.03
271 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
272 time.timeZone = lib.mkDefault"Europe/Berlin";
273
274 # disable doc usually
275 documentation.nixos.enable = lib.mkDefault false;
276}