2016-10-20 18:54:38 +00:00
|
|
|
with import <stockholm/lib>;
|
2017-12-31 01:44:20 +00:00
|
|
|
{ config, pkgs, ... }:
|
2015-07-16 13:51:01 +00:00
|
|
|
{
|
|
|
|
imports = [
|
2018-01-15 23:08:01 +00:00
|
|
|
./binary-cache/client.nix
|
|
|
|
./gc.nix
|
|
|
|
./mc.nix
|
|
|
|
./vim.nix
|
|
|
|
./zsh.nix
|
2017-03-07 21:57:21 +00:00
|
|
|
./htop.nix
|
2017-02-25 23:02:06 +00:00
|
|
|
./security-workarounds.nix
|
2018-12-16 15:11:02 +00:00
|
|
|
./wiregrill.nix
|
2015-07-16 13:51:01 +00:00
|
|
|
{
|
|
|
|
users.extraUsers =
|
|
|
|
mapAttrs (_: h: { hashedPassword = h; })
|
2016-03-23 12:44:21 +00:00
|
|
|
(import <secrets/hashedPasswords.nix>);
|
2015-07-16 13:51:01 +00:00
|
|
|
}
|
2015-07-21 16:57:58 +00:00
|
|
|
{
|
|
|
|
users.extraUsers = {
|
|
|
|
root = {
|
2015-10-31 14:09:43 +00:00
|
|
|
openssh.authorizedKeys.keys = [
|
2021-10-25 14:23:03 +00:00
|
|
|
config.krebs.users.lass.pubkey
|
2018-05-16 21:08:00 +00:00
|
|
|
config.krebs.users.lass-blue.pubkey
|
2021-01-23 16:34:29 +00:00
|
|
|
config.krebs.users.lass-green.pubkey
|
2015-07-21 16:57:58 +00:00
|
|
|
];
|
|
|
|
};
|
|
|
|
mainUser = {
|
|
|
|
name = "lass";
|
|
|
|
uid = 1337;
|
|
|
|
home = "/home/lass";
|
|
|
|
group = "users";
|
|
|
|
createHome = true;
|
|
|
|
useDefaultShell = true;
|
2021-06-03 18:18:42 +00:00
|
|
|
isNormalUser = true;
|
2015-07-21 16:57:58 +00:00
|
|
|
extraGroups = [
|
2016-12-20 23:17:20 +00:00
|
|
|
"audio"
|
2021-10-25 14:23:03 +00:00
|
|
|
"video"
|
2016-05-31 22:10:53 +00:00
|
|
|
"fuse"
|
2017-07-11 15:34:36 +00:00
|
|
|
"wheel"
|
2015-07-21 16:57:58 +00:00
|
|
|
];
|
2015-10-31 14:09:43 +00:00
|
|
|
openssh.authorizedKeys.keys = [
|
2021-10-25 14:23:03 +00:00
|
|
|
config.krebs.users.lass.pubkey
|
2018-05-16 21:08:00 +00:00
|
|
|
config.krebs.users.lass-blue.pubkey
|
2021-01-23 16:34:29 +00:00
|
|
|
config.krebs.users.lass-green.pubkey
|
2020-09-27 13:33:14 +00:00
|
|
|
];
|
|
|
|
};
|
2015-07-21 16:57:58 +00:00
|
|
|
};
|
|
|
|
}
|
2016-08-04 22:00:43 +00:00
|
|
|
{
|
|
|
|
environment.variables = {
|
|
|
|
NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src";
|
|
|
|
};
|
|
|
|
}
|
2017-10-18 17:52:37 +00:00
|
|
|
(let ca-bundle = "/etc/ssl/certs/ca-bundle.crt"; in {
|
2016-10-27 10:50:03 +00:00
|
|
|
environment.variables = {
|
|
|
|
CURL_CA_BUNDLE = ca-bundle;
|
|
|
|
GIT_SSL_CAINFO = ca-bundle;
|
|
|
|
SSL_CERT_FILE = ca-bundle;
|
|
|
|
};
|
|
|
|
})
|
2017-01-10 16:27:07 +00:00
|
|
|
{
|
|
|
|
#for sshuttle
|
|
|
|
environment.systemPackages = [
|
2021-10-25 14:25:40 +00:00
|
|
|
pkgs.python3Packages.python
|
2017-01-10 16:27:07 +00:00
|
|
|
];
|
|
|
|
}
|
2015-07-16 13:51:01 +00:00
|
|
|
];
|
|
|
|
|
2015-10-19 12:00:15 +00:00
|
|
|
networking.hostName = config.krebs.build.host.name;
|
|
|
|
nix.maxJobs = config.krebs.build.host.cores;
|
|
|
|
|
2015-07-27 15:03:20 +00:00
|
|
|
krebs = {
|
|
|
|
enable = true;
|
2017-07-11 09:26:24 +00:00
|
|
|
build.user = config.krebs.users.lass;
|
2015-07-27 15:03:20 +00:00
|
|
|
};
|
|
|
|
|
2016-10-11 15:41:03 +00:00
|
|
|
nix.useSandbox = true;
|
2015-07-16 13:51:01 +00:00
|
|
|
|
|
|
|
users.mutableUsers = false;
|
|
|
|
|
2017-12-31 01:44:20 +00:00
|
|
|
services.timesyncd.enable = mkForce true;
|
2016-03-15 13:30:23 +00:00
|
|
|
|
2015-07-16 13:51:01 +00:00
|
|
|
# multiple-definition-problem when defining environment.variables.EDITOR
|
|
|
|
environment.extraInit = ''
|
|
|
|
EDITOR=vim
|
|
|
|
'';
|
|
|
|
|
2016-04-09 12:16:21 +00:00
|
|
|
nixpkgs.config.allowUnfree = true;
|
|
|
|
|
2015-07-16 13:51:01 +00:00
|
|
|
environment.systemPackages = with pkgs; [
|
2015-10-01 20:57:15 +00:00
|
|
|
#stockholm
|
2020-08-12 19:38:32 +00:00
|
|
|
deploy
|
2015-07-16 13:51:01 +00:00
|
|
|
git
|
2021-10-25 14:26:05 +00:00
|
|
|
git-preview
|
2016-03-22 16:40:59 +00:00
|
|
|
gnumake
|
2015-10-01 20:57:15 +00:00
|
|
|
jq
|
|
|
|
|
|
|
|
#style
|
2015-07-16 13:51:01 +00:00
|
|
|
rxvt_unicode.terminfo
|
|
|
|
|
2015-11-13 10:10:34 +00:00
|
|
|
#monitoring tools
|
|
|
|
htop
|
|
|
|
iotop
|
|
|
|
|
2015-07-16 13:51:01 +00:00
|
|
|
#network
|
|
|
|
iptables
|
2016-04-20 11:58:10 +00:00
|
|
|
iftop
|
2019-01-22 15:30:57 +00:00
|
|
|
tcpdump
|
2021-06-15 19:11:52 +00:00
|
|
|
mosh
|
2021-09-22 09:24:32 +00:00
|
|
|
sshify
|
2015-10-20 23:34:27 +00:00
|
|
|
|
|
|
|
#stuff for dl
|
|
|
|
aria2
|
2016-02-27 14:51:25 +00:00
|
|
|
|
|
|
|
#neat utils
|
2017-10-09 11:22:42 +00:00
|
|
|
file
|
2020-01-11 19:42:43 +00:00
|
|
|
hashPassword
|
2017-04-11 19:41:20 +00:00
|
|
|
kpaste
|
2021-10-25 14:26:05 +00:00
|
|
|
cyberlocker-tools
|
2016-06-10 22:28:09 +00:00
|
|
|
pciutils
|
2016-07-10 16:06:35 +00:00
|
|
|
pop
|
2016-06-25 11:18:46 +00:00
|
|
|
q
|
2016-06-13 21:01:56 +00:00
|
|
|
rs
|
2016-05-19 22:12:43 +00:00
|
|
|
untilport
|
2016-06-10 22:28:09 +00:00
|
|
|
usbutils
|
2017-04-27 16:58:23 +00:00
|
|
|
logify
|
2017-05-02 18:13:07 +00:00
|
|
|
goify
|
2016-04-09 12:16:21 +00:00
|
|
|
|
|
|
|
#unpack stuff
|
2021-06-15 19:11:52 +00:00
|
|
|
libarchive
|
2017-04-16 21:34:25 +00:00
|
|
|
|
|
|
|
(pkgs.writeDashBin "sshn" ''
|
|
|
|
${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
|
|
|
|
'')
|
2015-07-16 13:51:01 +00:00
|
|
|
];
|
|
|
|
|
2021-06-15 19:11:52 +00:00
|
|
|
environment.shellAliases = {
|
|
|
|
ll = "ls -l";
|
|
|
|
la = "ls -la";
|
|
|
|
ls = "ls --color";
|
|
|
|
ip = "ip -color=auto";
|
|
|
|
grep = "grep --color=auto";
|
|
|
|
};
|
|
|
|
|
2015-07-16 13:51:01 +00:00
|
|
|
programs.bash = {
|
|
|
|
enableCompletion = true;
|
|
|
|
interactiveShellInit = ''
|
|
|
|
HISTCONTROL='erasedups:ignorespace'
|
|
|
|
HISTSIZE=65536
|
|
|
|
HISTFILESIZE=$HISTSIZE
|
|
|
|
|
|
|
|
shopt -s checkhash
|
|
|
|
shopt -s histappend histreedit histverify
|
|
|
|
shopt -s no_empty_cmd_completion
|
|
|
|
complete -d cd
|
2017-02-15 23:06:38 +00:00
|
|
|
LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
|
2015-07-16 13:51:01 +00:00
|
|
|
'';
|
|
|
|
promptInit = ''
|
|
|
|
if test $UID = 0; then
|
|
|
|
PS1='\[\033[1;31m\]\w\[\033[0m\] '
|
2017-01-17 14:57:38 +00:00
|
|
|
PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
|
2015-07-16 13:51:01 +00:00
|
|
|
elif test $UID = 1337; then
|
|
|
|
PS1='\[\033[1;32m\]\w\[\033[0m\] '
|
2017-01-17 14:57:38 +00:00
|
|
|
PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
|
2015-07-16 13:51:01 +00:00
|
|
|
else
|
|
|
|
PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
|
2017-01-17 14:57:38 +00:00
|
|
|
PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
|
2015-07-16 13:51:01 +00:00
|
|
|
fi
|
|
|
|
if test -n "$SSH_CLIENT"; then
|
|
|
|
PS1='\[\033[35m\]\h'" $PS1"
|
2017-01-17 14:57:38 +00:00
|
|
|
PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
|
2015-07-16 13:51:01 +00:00
|
|
|
fi
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2019-10-14 13:13:33 +00:00
|
|
|
services.openssh.enable = true;
|
2015-07-16 13:51:01 +00:00
|
|
|
|
|
|
|
services.journald.extraConfig = ''
|
|
|
|
SystemMaxUse=1G
|
|
|
|
RuntimeMaxUse=128M
|
2021-10-25 14:26:22 +00:00
|
|
|
Storage=persistent
|
2015-07-16 13:51:01 +00:00
|
|
|
'';
|
|
|
|
|
2015-10-01 20:13:40 +00:00
|
|
|
krebs.iptables = {
|
2015-07-16 13:51:01 +00:00
|
|
|
enable = true;
|
|
|
|
tables = {
|
2016-04-12 13:11:31 +00:00
|
|
|
nat.PREROUTING.rules = [
|
2019-10-14 13:15:58 +00:00
|
|
|
{ predicate = "-i retiolum -p tcp -m tcp --dport 22"; target = "ACCEPT"; precedence = 101; }
|
|
|
|
{ predicate = "-i wiregrill -p tcp -m tcp --dport 22"; target = "ACCEPT"; precedence = 101; }
|
|
|
|
{ predicate = "-p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; precedence = 100; }
|
2016-04-12 13:11:31 +00:00
|
|
|
{ predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 99; }
|
|
|
|
];
|
|
|
|
nat.OUTPUT.rules = [
|
|
|
|
{ predicate = "-o lo -p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 100; }
|
|
|
|
];
|
2015-07-16 13:51:01 +00:00
|
|
|
filter.INPUT.policy = "DROP";
|
|
|
|
filter.FORWARD.policy = "DROP";
|
|
|
|
filter.INPUT.rules = [
|
2017-08-24 15:34:46 +00:00
|
|
|
{ predicate = "-i retiolum -p udp --dport 60000:61000"; target = "ACCEPT";}
|
2015-07-23 00:19:24 +00:00
|
|
|
{ predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; precedence = 10001; }
|
|
|
|
{ predicate = "-p icmp"; target = "ACCEPT"; precedence = 10000; }
|
2017-02-09 15:57:54 +00:00
|
|
|
{ predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; precedence = 10000; }
|
2015-07-23 00:19:24 +00:00
|
|
|
{ predicate = "-i lo"; target = "ACCEPT"; precedence = 9999; }
|
|
|
|
{ predicate = "-p tcp --dport 22"; target = "ACCEPT"; precedence = 9998; }
|
2016-11-26 18:10:23 +00:00
|
|
|
{ predicate = "-p tcp -i retiolum"; target = "REJECT --reject-with tcp-reset"; precedence = -10000; }
|
|
|
|
{ predicate = "-p udp -i retiolum"; target = "REJECT --reject-with icmp-port-unreachable"; v6 = false; precedence = -10000; }
|
|
|
|
{ predicate = "-i retiolum"; target = "REJECT --reject-with icmp-proto-unreachable"; v6 = false; precedence = -10000; }
|
2017-10-26 17:18:53 +00:00
|
|
|
{ predicate = "-i retiolum -p udp -m udp --dport 53"; target = "ACCEPT"; }
|
2019-04-07 17:18:46 +00:00
|
|
|
{ predicate = "-i retiolum -p tcp --dport 19999"; target = "ACCEPT"; }
|
2015-07-16 13:51:01 +00:00
|
|
|
];
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2015-09-13 14:37:11 +00:00
|
|
|
networking.dhcpcd.extraConfig = ''
|
|
|
|
noipv4ll
|
|
|
|
'';
|
2020-09-27 13:33:24 +00:00
|
|
|
|
|
|
|
# use 24:00 time format, the default got sneakily changed around 20.03
|
|
|
|
i18n.defaultLocale = mkDefault "C.UTF-8";
|
2021-10-25 14:26:30 +00:00
|
|
|
time.timeZone = mkDefault"Europe/Berlin";
|
|
|
|
|
2020-11-19 18:13:49 +00:00
|
|
|
system.stateVersion = mkDefault "20.03";
|
2015-07-16 13:51:01 +00:00
|
|
|
}
|