This repository has no description
7.2 kB
263 lines
1{ self, config, lib, pkgs, ... }:
2{
3 imports = [
4 ./binary-cache/client.nix
5 ./gc.nix
6 ./mc.nix
7 ./zsh.nix
8 ./htop.nix
9 ./wiregrill.nix
10 ./tmux.nix
11 ./tor-ssh.nix
12 ./networkd.nix
13 self.inputs.stockholm.nixosModules.users
14 self.inputs.stockholm.nixosModules.hosts
15 self.inputs.stockholm.nixosModules.kartei
16 self.inputs.stockholm.nixosModules.build
17 self.inputs.stockholm.nixosModules.dns
18 self.inputs.stockholm.nixosModules.exim
19 self.inputs.stockholm.nixosModules.exim-retiolum
20 self.inputs.stockholm.nixosModules.tinc
21 self.inputs.stockholm.nixosModules.fetchWallpaper
22 self.inputs.stockholm.nixosModules.iptables
23 self.inputs.stockholm.nixosModules.power-action
24 self.inputs.stockholm.nixosModules.setuid
25 self.inputs.stockholm.nixosModules.secret
26 self.inputs.stockholm.nixosModules.sitemap
27 self.inputs.stockholm.nixosModules.ssl
28 self.inputs.stockholm.nixosModules.systemd
29 self.inputs.stockholm.nixosModules.xresources
30 self.inputs.stockholm.nixosModules.ssh
31 self.inputs.stockholm.nixosModules.sync-containers3
32 {
33 users.extraUsers.mainUser.passwordFile = "${config.krebs.secret.directory}/passwordFile";
34 users.extraUsers.root.passwordFile = "${config.krebs.secret.directory}/passwordFile";
35 }
36 {
37 users.extraUsers = {
38 root = {
39 openssh.authorizedKeys.keys = [
40 config.krebs.users.lass.pubkey
41 config.krebs.users.lass-blue.pubkey
42 config.krebs.users.lass-green.pubkey
43 ];
44 };
45 mainUser = {
46 name = "lass";
47 uid = 1337;
48 home = "/home/lass";
49 group = "users";
50 createHome = true;
51 useDefaultShell = true;
52 isNormalUser = true;
53 extraGroups = [
54 "audio"
55 "video"
56 "fuse"
57 "wheel"
58 "tor"
59 ];
60 openssh.authorizedKeys.keys = [
61 config.krebs.users.lass.pubkey
62 config.krebs.users.lass-blue.pubkey
63 config.krebs.users.lass-green.pubkey
64 ];
65 };
66 };
67 }
68 (let ca-bundle = "/etc/ssl/certs/ca-bundle.crt"; in {
69 environment.variables = {
70 CURL_CA_BUNDLE = ca-bundle;
71 GIT_SSL_CAINFO = ca-bundle;
72 SSL_CERT_FILE = ca-bundle;
73 };
74 })
75 {
76 #for sshuttle
77 environment.systemPackages = [
78 pkgs.python3Packages.python
79 ];
80 }
81 ];
82
83 networking.hostName = config.krebs.build.host.name;
84
85 krebs = {
86 enable = true;
87 build.user = config.krebs.users.lass;
88 ssl.trustIntermediate = true;
89 };
90
91 nix.useSandbox = true;
92
93 users.mutableUsers = false;
94
95 # multiple-definition-problem when defining environment.variables.EDITOR
96 environment.extraInit = ''
97 EDITOR=vim
98 '';
99
100 nixpkgs.config.allowUnfree = true;
101
102 environment.systemPackages = with pkgs; [
103 self.packages.${pkgs.system}.vim
104
105 #stockholm
106 deploy
107 git
108 git-absorb
109 git-preview
110 gnumake
111 jq
112 nix-output-monitor
113
114 #style
115 rxvt-unicode-unwrapped.terminfo
116 alacritty.terminfo
117
118 #monitoring tools
119 htop
120 iotop
121
122 #network
123 iptables
124 iftop
125 tcpdump
126 mosh
127 eternal-terminal
128 sshify
129
130 #stuff for dl
131 aria2
132
133 #neat utils
134 file
135 hashPassword
136 kpaste
137 cyberlocker-tools
138 pciutils
139 pop
140 q
141 rs
142 untilport
143 (pkgs.writeDashBin "urgent" ''
144 printf '\a'
145 '')
146 usbutils
147 logify
148 goify
149
150 #unpack stuff
151 libarchive
152
153 (pkgs.writeDashBin "sshn" ''
154 ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
155 '')
156 ];
157
158 environment.shellAliases = {
159 ll = "ls -l";
160 la = "ls -la";
161 ls = "ls --color";
162 ip = "ip -color=auto";
163 grep = "grep --color=auto";
164 };
165
166 programs.bash = {
167 enableCompletion = true;
168 interactiveShellInit = ''
169 HISTCONTROL='erasedups:ignorespace'
170 HISTSIZE=65536
171 HISTFILESIZE=$HISTSIZE
172
173 shopt -s checkhash
174 shopt -s histappend histreedit histverify
175 shopt -s no_empty_cmd_completion
176 complete -d cd
177 LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
178 '';
179 promptInit = ''
180 if test $UID = 0; then
181 PS1='\[\033[1;31m\]\w\[\033[0m\] '
182 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
183 elif test $UID = 1337; then
184 PS1='\[\033[1;32m\]\w\[\033[0m\] '
185 PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
186 else
187 PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
188 PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
189 fi
190 if test -n "$SSH_CLIENT"; then
191 PS1='\[\033[35m\]\h'" $PS1"
192 PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
193 fi
194 '';
195 };
196
197 services.openssh.enable = true;
198 services.openssh.hostKeys = [{
199 path = "${config.clan.password-store.targetDirectory}/ssh.id_ed25519";
200 type = "ed25519";
201 }];
202
203 services.journald.extraConfig = ''
204 SystemMaxUse=1G
205 RuntimeMaxUse=128M
206 Storage=persistent
207 '';
208
209 krebs.iptables = {
210 enable = true;
211 tables = {
212 nat.PREROUTING.rules = [
213 { predicate = "-i retiolum -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
214 { predicate = "-i wiregrill -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
215 { predicate = "-p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; }
216 { predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; }
217 ];
218 nat.OUTPUT.rules = [
219 { predicate = "-o lo -p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; }
220 ];
221 filter.INPUT.policy = "DROP";
222 filter.FORWARD.policy = "DROP";
223 filter.INPUT.rules = lib.mkMerge [
224 (lib.mkBefore [
225 { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
226 { predicate = "-p icmp"; target = "ACCEPT"; }
227 { predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; }
228 { predicate = "-i lo"; target = "ACCEPT"; }
229 { predicate = "-p tcp --dport 22"; target = "ACCEPT"; }
230 ])
231 (lib.mkOrder 1000 [
232 { predicate = "-i retiolum -p udp --dport 60000:61000"; target = "ACCEPT"; }
233 { predicate = "-i retiolum -p udp -m udp --dport 53"; target = "ACCEPT"; }
234 { predicate = "-i retiolum -p tcp --dport 19999"; target = "ACCEPT"; }
235 ])
236 (lib.mkAfter [
237 { predicate = "-p tcp -i retiolum"; target = "REJECT --reject-with tcp-reset"; }
238 { predicate = "-p udp -i retiolum"; target = "REJECT --reject-with icmp-port-unreachable"; v6 = false; }
239 { predicate = "-i retiolum"; target = "REJECT --reject-with icmp-proto-unreachable"; v6 = false; }
240 ])
241 ];
242 };
243 };
244
245 networking.dhcpcd.extraConfig = ''
246 noipv4ll
247 '';
248
249 networking.extraHosts = ''
250 10.42.0.1 styx.gg23
251 '';
252
253 nix.extraOptions = ''
254 experimental-features = nix-command flakes
255 '';
256
257 # use 24:00 time format, the default got sneakily changed around 20.03
258 i18n.defaultLocale = lib.mkDefault "C.UTF-8";
259 time.timeZone = lib.mkDefault"Europe/Berlin";
260
261 # disable doc usually
262 documentation.nixos.enable = lib.mkDefault false;
263}