2015-07-11 14:55:22 +00:00
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
|
2016-10-20 18:54:38 +00:00
|
|
|
with import <stockholm/lib>;
|
2015-07-11 14:55:22 +00:00
|
|
|
|
|
|
|
{
|
2015-07-24 19:27:19 +00:00
|
|
|
krebs.enable = true;
|
|
|
|
|
2015-11-06 21:36:01 +00:00
|
|
|
krebs.build = {
|
|
|
|
user = config.krebs.users.tv;
|
2016-07-16 19:43:38 +00:00
|
|
|
source = let inherit (config.krebs.build) host; in {
|
|
|
|
nixos-config.symlink = "stockholm/tv/1systems/${host.name}.nix";
|
|
|
|
secrets.file = "/home/tv/secrets/${host.name}";
|
|
|
|
secrets-common.file = "/home/tv/secrets/common";
|
|
|
|
stockholm.file = "/home/tv/stockholm";
|
|
|
|
nixpkgs.git = {
|
2016-02-01 02:00:48 +00:00
|
|
|
url = https://github.com/NixOS/nixpkgs;
|
2016-10-23 19:33:45 +00:00
|
|
|
ref = "e4fb65a3627f8c17a2f92c08bf302dc30f0a8db9";
|
2015-11-06 21:36:01 +00:00
|
|
|
};
|
2016-07-16 19:43:38 +00:00
|
|
|
} // optionalAttrs host.secure {
|
|
|
|
secrets-master.file = "/home/tv/secrets/master";
|
|
|
|
};
|
2015-11-06 21:36:01 +00:00
|
|
|
};
|
|
|
|
|
2015-07-24 23:38:26 +00:00
|
|
|
networking.hostName = config.krebs.build.host.name;
|
|
|
|
|
2015-07-11 14:55:22 +00:00
|
|
|
imports = [
|
2015-11-08 10:53:29 +00:00
|
|
|
<secrets>
|
2016-06-30 19:11:13 +00:00
|
|
|
./audit.nix
|
2015-12-28 18:43:31 +00:00
|
|
|
./backup.nix
|
2016-07-23 11:11:33 +00:00
|
|
|
./bash.nix
|
2016-03-05 11:57:46 +00:00
|
|
|
./nginx
|
2016-07-23 10:18:46 +00:00
|
|
|
./ssh.nix
|
2016-07-23 11:11:50 +00:00
|
|
|
./sshd.nix
|
2015-11-01 12:28:16 +00:00
|
|
|
./vim.nix
|
2016-07-23 11:19:44 +00:00
|
|
|
./xdg.nix
|
2015-10-21 23:25:02 +00:00
|
|
|
{
|
|
|
|
# stockholm dependencies
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
|
|
git
|
2016-10-06 17:16:42 +00:00
|
|
|
populate
|
2015-10-21 23:25:02 +00:00
|
|
|
];
|
|
|
|
}
|
2015-07-11 14:55:22 +00:00
|
|
|
{
|
2015-11-08 10:53:29 +00:00
|
|
|
users = {
|
|
|
|
defaultUserShell = "/run/current-system/sw/bin/bash";
|
|
|
|
mutableUsers = false;
|
|
|
|
users = {
|
|
|
|
tv = {
|
2016-02-21 05:56:57 +00:00
|
|
|
inherit (config.krebs.users.tv) home uid;
|
2015-11-08 10:53:29 +00:00
|
|
|
isNormalUser = true;
|
2016-02-13 18:57:45 +00:00
|
|
|
extraGroups = [ "tv" ];
|
2015-11-08 10:53:29 +00:00
|
|
|
};
|
2015-07-11 14:55:22 +00:00
|
|
|
};
|
|
|
|
};
|
|
|
|
}
|
|
|
|
{
|
2016-10-13 18:41:17 +00:00
|
|
|
security.hideProcessInformation = true;
|
2015-07-11 14:55:22 +00:00
|
|
|
security.sudo.extraConfig = ''
|
2016-02-25 12:45:23 +00:00
|
|
|
Defaults env_keep+="SSH_CLIENT"
|
2015-07-24 23:06:13 +00:00
|
|
|
Defaults mailto="${config.krebs.users.tv.mail}"
|
2016-02-17 21:28:02 +00:00
|
|
|
Defaults !lecture
|
2015-07-11 14:55:22 +00:00
|
|
|
'';
|
|
|
|
time.timeZone = "Europe/Berlin";
|
|
|
|
}
|
2016-02-27 14:13:44 +00:00
|
|
|
|
2015-07-11 14:55:22 +00:00
|
|
|
{
|
|
|
|
# TODO check if both are required:
|
2016-10-06 17:16:42 +00:00
|
|
|
nix.sandboxPaths = [ "/etc/protocols" pkgs.iana_etc.outPath ];
|
2015-07-11 14:55:22 +00:00
|
|
|
|
2016-02-27 14:13:44 +00:00
|
|
|
nix.requireSignedBinaryCaches = true;
|
|
|
|
|
|
|
|
nix.binaryCaches = ["https://cache.nixos.org"];
|
2015-07-11 14:55:22 +00:00
|
|
|
|
2016-10-06 17:16:42 +00:00
|
|
|
nix.useSandbox = true;
|
2015-07-11 14:55:22 +00:00
|
|
|
}
|
2016-02-02 19:12:06 +00:00
|
|
|
{
|
|
|
|
nixpkgs.config.allowUnfree = false;
|
|
|
|
}
|
2015-07-16 04:35:19 +00:00
|
|
|
{
|
2015-11-06 20:54:53 +00:00
|
|
|
environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
|
|
|
|
|
2015-07-16 04:35:19 +00:00
|
|
|
environment.systemPackages = with pkgs; [
|
|
|
|
rxvt_unicode.terminfo
|
|
|
|
];
|
2015-07-16 04:26:41 +00:00
|
|
|
|
2015-07-29 13:31:34 +00:00
|
|
|
environment.shellAliases = mkForce {
|
2015-07-11 14:55:22 +00:00
|
|
|
# alias cal='cal -m3'
|
|
|
|
gp = "${pkgs.pari}/bin/gp -q";
|
|
|
|
df = "df -h";
|
|
|
|
du = "du -h";
|
|
|
|
# alias grep='grep --color=auto'
|
|
|
|
|
|
|
|
# TODO alias cannot contain #\'
|
|
|
|
# "ps?" = "ps ax | head -n 1;ps ax | fgrep -v ' grep --color=auto ' | grep";
|
|
|
|
|
|
|
|
# alias la='ls -lA'
|
|
|
|
lAtr = "ls -lAtr";
|
|
|
|
# alias ll='ls -l'
|
|
|
|
ls = "ls -h --color=auto --group-directories-first";
|
|
|
|
dmesg = "dmesg -L --reltime";
|
2015-11-01 12:28:16 +00:00
|
|
|
view = "vim -R";
|
2015-11-10 11:44:30 +00:00
|
|
|
|
|
|
|
reload = "systemctl reload";
|
|
|
|
restart = "systemctl restart";
|
|
|
|
start = "systemctl start";
|
|
|
|
status = "systemctl status";
|
|
|
|
stop = "systemctl stop";
|
2015-07-11 14:55:22 +00:00
|
|
|
};
|
|
|
|
|
2015-11-08 11:28:53 +00:00
|
|
|
environment.variables = {
|
2016-02-04 04:40:26 +00:00
|
|
|
NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src";
|
2015-11-08 11:28:53 +00:00
|
|
|
};
|
2015-07-11 14:55:22 +00:00
|
|
|
}
|
|
|
|
|
2016-10-23 16:10:00 +00:00
|
|
|
(let ca-bundle = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; in {
|
|
|
|
environment.variables = {
|
|
|
|
CURL_CA_BUNDLE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
|
|
|
|
GIT_SSL_CAINFO = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
|
|
|
|
SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
|
|
|
|
};
|
|
|
|
})
|
|
|
|
|
2015-07-11 14:55:22 +00:00
|
|
|
{
|
|
|
|
services.cron.enable = false;
|
|
|
|
services.nscd.enable = false;
|
|
|
|
services.ntp.enable = false;
|
2016-07-03 19:35:34 +00:00
|
|
|
services.timesyncd.enable = true;
|
2015-07-11 14:55:22 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
{
|
|
|
|
boot.kernel.sysctl = {
|
|
|
|
# Enable IPv6 Privacy Extensions
|
|
|
|
"net.ipv6.conf.all.use_tempaddr" = 2;
|
|
|
|
"net.ipv6.conf.default.use_tempaddr" = 2;
|
|
|
|
};
|
|
|
|
}
|
|
|
|
|
2016-02-01 16:40:25 +00:00
|
|
|
{
|
|
|
|
tv.iptables.enable = true;
|
2016-02-07 02:09:14 +00:00
|
|
|
tv.iptables.accept-echo-request = "internet";
|
2016-02-01 16:40:25 +00:00
|
|
|
}
|
|
|
|
|
2016-07-03 19:30:46 +00:00
|
|
|
{
|
|
|
|
services.journald.extraConfig = ''
|
|
|
|
SystemMaxUse=1G
|
|
|
|
RuntimeMaxUse=128M
|
|
|
|
'';
|
|
|
|
}
|
|
|
|
|
2016-02-13 16:58:02 +00:00
|
|
|
{
|
|
|
|
environment.systemPackages = [
|
|
|
|
pkgs.get
|
|
|
|
pkgs.krebszones
|
|
|
|
pkgs.nix-prefetch-scripts
|
|
|
|
pkgs.push
|
|
|
|
];
|
|
|
|
}
|
2015-07-11 14:55:22 +00:00
|
|
|
];
|
|
|
|
}
|