stockholm/lass/2configs/default.nix

222 lines
5.6 KiB
Nix
Raw Normal View History

2016-10-20 18:54:38 +00:00
with import <stockholm/lib>;
2017-12-31 01:44:20 +00:00
{ config, pkgs, ... }:
2015-07-16 13:51:01 +00:00
{
imports = [
2019-01-27 02:32:55 +00:00
<stockholm/krebs/2configs/nscd-fix.nix>
2018-01-15 23:08:01 +00:00
./binary-cache/client.nix
./gc.nix
./mc.nix
./vim.nix
2018-04-27 17:34:36 +00:00
./monitoring/node-exporter.nix
2018-01-15 23:08:01 +00:00
./zsh.nix
2017-03-07 21:57:21 +00:00
./htop.nix
2017-02-25 23:02:06 +00:00
./security-workarounds.nix
2018-12-16 15:11:02 +00:00
./wiregrill.nix
2015-07-16 13:51:01 +00:00
{
users.extraUsers =
mapAttrs (_: h: { hashedPassword = h; })
2016-03-23 12:44:21 +00:00
(import <secrets/hashedPasswords.nix>);
2015-07-16 13:51:01 +00:00
}
2015-07-21 16:57:58 +00:00
{
users.extraUsers = {
root = {
2015-10-31 14:09:43 +00:00
openssh.authorizedKeys.keys = [
2018-05-16 21:08:00 +00:00
config.krebs.users.lass-mors.pubkey
config.krebs.users.lass-blue.pubkey
2016-05-21 11:51:06 +00:00
config.krebs.users.lass-shodan.pubkey
2016-12-29 17:13:46 +00:00
config.krebs.users.lass-icarus.pubkey
2015-07-21 16:57:58 +00:00
];
};
mainUser = {
name = "lass";
uid = 1337;
home = "/home/lass";
group = "users";
createHome = true;
useDefaultShell = true;
extraGroups = [
2016-12-20 23:17:20 +00:00
"audio"
2016-05-31 22:10:53 +00:00
"fuse"
2017-07-11 15:34:36 +00:00
"wheel"
2015-07-21 16:57:58 +00:00
];
2015-10-31 14:09:43 +00:00
openssh.authorizedKeys.keys = [
2018-05-16 21:08:00 +00:00
config.krebs.users.lass-mors.pubkey
config.krebs.users.lass-blue.pubkey
2016-05-21 11:51:06 +00:00
config.krebs.users.lass-shodan.pubkey
2016-12-29 17:13:46 +00:00
config.krebs.users.lass-icarus.pubkey
2015-07-21 16:57:58 +00:00
];
};
};
}
2016-08-04 22:00:43 +00:00
{
environment.variables = {
NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src";
};
}
2017-10-18 17:52:37 +00:00
(let ca-bundle = "/etc/ssl/certs/ca-bundle.crt"; in {
2016-10-27 10:50:03 +00:00
environment.variables = {
CURL_CA_BUNDLE = ca-bundle;
GIT_SSL_CAINFO = ca-bundle;
SSL_CERT_FILE = ca-bundle;
};
})
2017-01-10 16:27:07 +00:00
{
#for sshuttle
environment.systemPackages = [
pkgs.pythonPackages.python
];
}
2015-07-16 13:51:01 +00:00
];
2015-10-19 12:00:15 +00:00
networking.hostName = config.krebs.build.host.name;
nix.maxJobs = config.krebs.build.host.cores;
2015-07-27 15:03:20 +00:00
krebs = {
enable = true;
build.user = config.krebs.users.lass;
2015-07-27 15:03:20 +00:00
};
2016-10-11 15:41:03 +00:00
nix.useSandbox = true;
2015-07-16 13:51:01 +00:00
users.mutableUsers = false;
2017-12-31 01:44:20 +00:00
services.timesyncd.enable = mkForce true;
2016-03-15 13:30:23 +00:00
2015-07-16 13:51:01 +00:00
systemd.tmpfiles.rules = [
"d /tmp 1777 root root - -"
];
# multiple-definition-problem when defining environment.variables.EDITOR
environment.extraInit = ''
EDITOR=vim
'';
2016-04-09 12:16:21 +00:00
nixpkgs.config.allowUnfree = true;
2015-07-16 13:51:01 +00:00
environment.systemPackages = with pkgs; [
2015-10-01 20:57:15 +00:00
#stockholm
2015-07-16 13:51:01 +00:00
git
gnumake
2015-10-01 20:57:15 +00:00
jq
parallel
proot
2016-10-11 15:42:08 +00:00
populate
2015-10-01 20:57:15 +00:00
#style
2015-07-16 13:51:01 +00:00
most
rxvt_unicode.terminfo
2015-11-13 10:10:34 +00:00
#monitoring tools
htop
iotop
2015-07-16 13:51:01 +00:00
#network
iptables
2016-04-20 11:58:10 +00:00
iftop
2019-01-22 15:30:57 +00:00
tcpdump
2015-10-20 23:34:27 +00:00
#stuff for dl
aria2
2016-02-27 14:51:25 +00:00
#neat utils
2017-10-09 11:22:42 +00:00
file
2017-04-11 19:41:20 +00:00
kpaste
2016-02-27 14:51:25 +00:00
krebspaste
2017-03-04 19:04:39 +00:00
mosh
2016-06-10 22:28:09 +00:00
pciutils
2016-07-10 16:06:35 +00:00
pop
2016-05-04 15:20:15 +00:00
psmisc
2016-06-25 11:18:46 +00:00
q
2016-06-13 21:01:56 +00:00
rs
2016-06-10 22:28:09 +00:00
tmux
2016-05-19 22:12:43 +00:00
untilport
2016-06-10 22:28:09 +00:00
usbutils
2017-04-27 16:58:23 +00:00
logify
2017-05-02 18:13:07 +00:00
goify
2016-04-09 12:16:21 +00:00
#unpack stuff
p7zip
unzip
unrar
2017-04-16 21:34:25 +00:00
(pkgs.writeDashBin "sshn" ''
${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
'')
2015-07-16 13:51:01 +00:00
];
programs.bash = {
enableCompletion = true;
interactiveShellInit = ''
HISTCONTROL='erasedups:ignorespace'
HISTSIZE=65536
HISTFILESIZE=$HISTSIZE
shopt -s checkhash
shopt -s histappend histreedit histverify
shopt -s no_empty_cmd_completion
complete -d cd
2017-02-15 23:06:38 +00:00
LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
2015-07-16 13:51:01 +00:00
'';
promptInit = ''
if test $UID = 0; then
PS1='\[\033[1;31m\]\w\[\033[0m\] '
2017-01-17 14:57:38 +00:00
PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
2015-07-16 13:51:01 +00:00
elif test $UID = 1337; then
PS1='\[\033[1;32m\]\w\[\033[0m\] '
2017-01-17 14:57:38 +00:00
PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
2015-07-16 13:51:01 +00:00
else
PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
2017-01-17 14:57:38 +00:00
PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
2015-07-16 13:51:01 +00:00
fi
if test -n "$SSH_CLIENT"; then
PS1='\[\033[35m\]\h'" $PS1"
2017-01-17 14:57:38 +00:00
PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
2015-07-16 13:51:01 +00:00
fi
'';
};
services.openssh = {
enable = true;
hostKeys = [
# XXX bits here make no science
{ bits = 8192; type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
];
};
services.journald.extraConfig = ''
SystemMaxUse=1G
RuntimeMaxUse=128M
'';
2015-10-01 20:13:40 +00:00
krebs.iptables = {
2015-07-16 13:51:01 +00:00
enable = true;
tables = {
nat.PREROUTING.rules = [
{ predicate = "! -i retiolum -p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; precedence = 100; }
{ predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 99; }
];
nat.OUTPUT.rules = [
{ predicate = "-o lo -p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 100; }
];
2015-07-16 13:51:01 +00:00
filter.INPUT.policy = "DROP";
filter.FORWARD.policy = "DROP";
filter.INPUT.rules = [
2017-08-24 15:34:46 +00:00
{ predicate = "-i retiolum -p udp --dport 60000:61000"; target = "ACCEPT";}
{ predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; precedence = 10001; }
{ predicate = "-p icmp"; target = "ACCEPT"; precedence = 10000; }
2017-02-09 15:57:54 +00:00
{ predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; precedence = 10000; }
{ predicate = "-i lo"; target = "ACCEPT"; precedence = 9999; }
{ predicate = "-p tcp --dport 22"; target = "ACCEPT"; precedence = 9998; }
{ predicate = "-p tcp -i retiolum"; target = "REJECT --reject-with tcp-reset"; precedence = -10000; }
{ predicate = "-p udp -i retiolum"; target = "REJECT --reject-with icmp-port-unreachable"; v6 = false; precedence = -10000; }
{ predicate = "-i retiolum"; target = "REJECT --reject-with icmp-proto-unreachable"; v6 = false; precedence = -10000; }
2017-10-26 17:18:53 +00:00
{ predicate = "-i retiolum -p udp -m udp --dport 53"; target = "ACCEPT"; }
2015-07-16 13:51:01 +00:00
];
};
};
2015-09-13 14:37:11 +00:00
networking.dhcpcd.extraConfig = ''
noipv4ll
'';
2015-07-16 13:51:01 +00:00
}