2015-07-16 13:51:01 +00:00
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
|
2016-02-14 15:43:44 +00:00
|
|
|
with config.krebs.lib;
|
2015-07-16 13:51:01 +00:00
|
|
|
{
|
|
|
|
imports = [
|
2015-07-28 20:20:59 +00:00
|
|
|
../2configs/vim.nix
|
2015-09-19 21:40:51 +00:00
|
|
|
../2configs/zsh.nix
|
2015-09-23 12:58:15 +00:00
|
|
|
../2configs/mc.nix
|
2015-10-17 13:58:37 +00:00
|
|
|
../2configs/retiolum.nix
|
2016-06-11 12:53:18 +00:00
|
|
|
../2configs/nixpkgs.nix
|
2016-06-25 16:56:39 +00:00
|
|
|
../2configs/binary-cache/client.nix
|
2016-06-25 17:41:49 +00:00
|
|
|
../2configs/gc.nix
|
2016-04-11 14:52:15 +00:00
|
|
|
./backups.nix
|
2015-07-16 13:51:01 +00:00
|
|
|
{
|
|
|
|
users.extraUsers =
|
|
|
|
mapAttrs (_: h: { hashedPassword = h; })
|
2016-03-23 12:44:21 +00:00
|
|
|
(import <secrets/hashedPasswords.nix>);
|
2015-07-16 13:51:01 +00:00
|
|
|
}
|
2015-07-21 16:57:58 +00:00
|
|
|
{
|
|
|
|
users.extraUsers = {
|
|
|
|
root = {
|
2015-10-31 14:09:43 +00:00
|
|
|
openssh.authorizedKeys.keys = [
|
|
|
|
config.krebs.users.lass.pubkey
|
2016-02-08 02:23:28 +00:00
|
|
|
config.krebs.users.lass-uriel.pubkey
|
2016-05-21 11:51:06 +00:00
|
|
|
config.krebs.users.lass-shodan.pubkey
|
2015-07-21 16:57:58 +00:00
|
|
|
];
|
|
|
|
};
|
|
|
|
mainUser = {
|
|
|
|
name = "lass";
|
|
|
|
uid = 1337;
|
|
|
|
home = "/home/lass";
|
|
|
|
group = "users";
|
|
|
|
createHome = true;
|
|
|
|
useDefaultShell = true;
|
|
|
|
extraGroups = [
|
2016-05-31 22:10:53 +00:00
|
|
|
"fuse"
|
2015-07-21 16:57:58 +00:00
|
|
|
];
|
2015-10-31 14:09:43 +00:00
|
|
|
openssh.authorizedKeys.keys = [
|
|
|
|
config.krebs.users.lass.pubkey
|
2016-02-08 02:23:28 +00:00
|
|
|
config.krebs.users.lass-uriel.pubkey
|
2016-05-21 11:51:06 +00:00
|
|
|
config.krebs.users.lass-shodan.pubkey
|
2015-07-21 16:57:58 +00:00
|
|
|
];
|
|
|
|
};
|
|
|
|
};
|
|
|
|
}
|
2015-07-16 13:51:01 +00:00
|
|
|
];
|
|
|
|
|
2015-10-19 12:00:15 +00:00
|
|
|
networking.hostName = config.krebs.build.host.name;
|
|
|
|
nix.maxJobs = config.krebs.build.host.cores;
|
|
|
|
|
2015-07-27 15:03:20 +00:00
|
|
|
krebs = {
|
|
|
|
enable = true;
|
|
|
|
search-domain = "retiolum";
|
2015-10-19 12:00:15 +00:00
|
|
|
build = {
|
|
|
|
user = config.krebs.users.lass;
|
2016-07-16 19:43:38 +00:00
|
|
|
source = let inherit (config.krebs.build) host; in {
|
|
|
|
nixos-config.symlink = "stockholm/lass/1systems/${host.name}.nix";
|
|
|
|
secrets.file =
|
|
|
|
if getEnv "dummy_secrets" == "true"
|
|
|
|
then toString <stockholm/lass/2configs/tests/dummy-secrets>
|
|
|
|
else "/home/lass/secrets/${host.name}";
|
|
|
|
stockholm.file = getEnv "PWD";
|
|
|
|
};
|
2015-08-24 13:50:39 +00:00
|
|
|
};
|
2015-07-27 15:03:20 +00:00
|
|
|
};
|
|
|
|
|
2016-07-05 07:19:19 +00:00
|
|
|
nix.useChroot = true;
|
2015-07-16 13:51:01 +00:00
|
|
|
|
|
|
|
users.mutableUsers = false;
|
|
|
|
|
2016-03-15 13:30:23 +00:00
|
|
|
services.timesyncd.enable = true;
|
|
|
|
|
2015-08-22 14:49:37 +00:00
|
|
|
#why is this on in the first place?
|
2015-09-23 13:00:13 +00:00
|
|
|
services.nscd.enable = false;
|
2015-08-22 14:49:37 +00:00
|
|
|
|
2015-07-16 13:51:01 +00:00
|
|
|
boot.tmpOnTmpfs = true;
|
|
|
|
# see tmpfiles.d(5)
|
|
|
|
systemd.tmpfiles.rules = [
|
|
|
|
"d /tmp 1777 root root - -"
|
|
|
|
];
|
|
|
|
|
|
|
|
# multiple-definition-problem when defining environment.variables.EDITOR
|
|
|
|
environment.extraInit = ''
|
|
|
|
EDITOR=vim
|
2016-03-15 12:25:15 +00:00
|
|
|
MANPAGER=most
|
2015-07-16 13:51:01 +00:00
|
|
|
'';
|
|
|
|
|
2016-04-09 12:16:21 +00:00
|
|
|
nixpkgs.config.allowUnfree = true;
|
|
|
|
|
2015-07-16 13:51:01 +00:00
|
|
|
environment.systemPackages = with pkgs; [
|
2015-10-01 20:57:15 +00:00
|
|
|
#stockholm
|
2015-07-16 13:51:01 +00:00
|
|
|
git
|
2016-03-22 16:40:59 +00:00
|
|
|
gnumake
|
2015-10-01 20:57:15 +00:00
|
|
|
jq
|
|
|
|
parallel
|
2016-02-06 18:28:56 +00:00
|
|
|
proot
|
2015-10-01 20:57:15 +00:00
|
|
|
|
|
|
|
#style
|
2015-07-16 13:51:01 +00:00
|
|
|
most
|
|
|
|
rxvt_unicode.terminfo
|
|
|
|
|
2015-11-13 10:10:34 +00:00
|
|
|
#monitoring tools
|
|
|
|
htop
|
|
|
|
iotop
|
|
|
|
|
2015-07-16 13:51:01 +00:00
|
|
|
#network
|
|
|
|
iptables
|
2016-04-20 11:58:10 +00:00
|
|
|
iftop
|
2015-10-20 23:34:27 +00:00
|
|
|
|
|
|
|
#stuff for dl
|
|
|
|
aria2
|
2016-02-27 14:51:25 +00:00
|
|
|
|
|
|
|
#neat utils
|
|
|
|
krebspaste
|
2016-06-10 22:28:09 +00:00
|
|
|
pciutils
|
2016-07-10 16:06:35 +00:00
|
|
|
pop
|
2016-05-04 15:20:15 +00:00
|
|
|
psmisc
|
2016-06-25 11:18:46 +00:00
|
|
|
q
|
2016-06-13 21:01:56 +00:00
|
|
|
rs
|
2016-06-10 22:28:09 +00:00
|
|
|
tmux
|
2016-05-19 22:12:43 +00:00
|
|
|
untilport
|
2016-06-10 22:28:09 +00:00
|
|
|
usbutils
|
2016-04-09 12:16:21 +00:00
|
|
|
|
|
|
|
#unpack stuff
|
|
|
|
p7zip
|
|
|
|
unzip
|
|
|
|
unrar
|
2015-07-16 13:51:01 +00:00
|
|
|
];
|
|
|
|
|
|
|
|
programs.bash = {
|
|
|
|
enableCompletion = true;
|
|
|
|
interactiveShellInit = ''
|
|
|
|
HISTCONTROL='erasedups:ignorespace'
|
|
|
|
HISTSIZE=65536
|
|
|
|
HISTFILESIZE=$HISTSIZE
|
|
|
|
|
|
|
|
shopt -s checkhash
|
|
|
|
shopt -s histappend histreedit histverify
|
|
|
|
shopt -s no_empty_cmd_completion
|
|
|
|
complete -d cd
|
|
|
|
|
|
|
|
#fancy colors
|
|
|
|
if [ -e ~/LS_COLORS ]; then
|
|
|
|
eval $(dircolors ~/LS_COLORS)
|
|
|
|
fi
|
|
|
|
|
|
|
|
if [ -e /etc/nixos/dotfiles/link ]; then
|
|
|
|
/etc/nixos/dotfiles/link
|
|
|
|
fi
|
|
|
|
'';
|
|
|
|
promptInit = ''
|
|
|
|
if test $UID = 0; then
|
|
|
|
PS1='\[\033[1;31m\]\w\[\033[0m\] '
|
|
|
|
elif test $UID = 1337; then
|
|
|
|
PS1='\[\033[1;32m\]\w\[\033[0m\] '
|
|
|
|
else
|
|
|
|
PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
|
|
|
|
fi
|
|
|
|
if test -n "$SSH_CLIENT"; then
|
|
|
|
PS1='\[\033[35m\]\h'" $PS1"
|
|
|
|
fi
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
services.openssh = {
|
|
|
|
enable = true;
|
|
|
|
hostKeys = [
|
|
|
|
# XXX bits here make no science
|
|
|
|
{ bits = 8192; type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
|
|
|
|
];
|
|
|
|
};
|
|
|
|
|
|
|
|
services.journald.extraConfig = ''
|
|
|
|
SystemMaxUse=1G
|
|
|
|
RuntimeMaxUse=128M
|
|
|
|
'';
|
|
|
|
|
2015-10-01 20:13:40 +00:00
|
|
|
krebs.iptables = {
|
2015-07-16 13:51:01 +00:00
|
|
|
enable = true;
|
|
|
|
tables = {
|
2016-04-12 13:11:31 +00:00
|
|
|
nat.PREROUTING.rules = [
|
|
|
|
{ predicate = "! -i retiolum -p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; precedence = 100; }
|
|
|
|
{ predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 99; }
|
|
|
|
];
|
|
|
|
nat.OUTPUT.rules = [
|
|
|
|
{ predicate = "-o lo -p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 100; }
|
|
|
|
];
|
2015-07-16 13:51:01 +00:00
|
|
|
filter.INPUT.policy = "DROP";
|
|
|
|
filter.FORWARD.policy = "DROP";
|
|
|
|
filter.INPUT.rules = [
|
2015-07-23 00:19:24 +00:00
|
|
|
{ predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; precedence = 10001; }
|
|
|
|
{ predicate = "-p icmp"; target = "ACCEPT"; precedence = 10000; }
|
|
|
|
{ predicate = "-i lo"; target = "ACCEPT"; precedence = 9999; }
|
|
|
|
{ predicate = "-p tcp --dport 22"; target = "ACCEPT"; precedence = 9998; }
|
2015-08-17 12:38:32 +00:00
|
|
|
{ predicate = "-i retiolum"; target = "REJECT"; precedence = -10000; }
|
2015-07-16 13:51:01 +00:00
|
|
|
];
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2015-09-13 14:37:11 +00:00
|
|
|
networking.dhcpcd.extraConfig = ''
|
|
|
|
noipv4ll
|
|
|
|
'';
|
|
|
|
|
2016-01-17 12:10:14 +00:00
|
|
|
#CVE-2016-0777 and CVE-2016-0778 workaround
|
|
|
|
#https://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-0778/openssh-cve-2016-0777-cve-2016-0778.txt
|
|
|
|
programs.ssh.extraConfig = ''
|
|
|
|
UseRoaming no
|
|
|
|
'';
|
|
|
|
|
2015-07-16 13:51:01 +00:00
|
|
|
}
|