stockholm/tv/2configs/default.nix

160 lines
3.8 KiB
Nix
Raw Normal View History

2015-07-11 14:55:22 +00:00
{ config, lib, pkgs, ... }:
2016-10-20 18:54:38 +00:00
with import <stockholm/lib>;
2015-07-11 14:55:22 +00:00
{
krebs.enable = true;
2015-11-06 21:36:01 +00:00
krebs.build = {
user = config.krebs.users.tv;
source = let inherit (config.krebs.build) host; in {
nixos-config.symlink = "stockholm/tv/1systems/${host.name}.nix";
secrets.file = "/home/tv/secrets/${host.name}";
secrets-common.file = "/home/tv/secrets/common";
stockholm.file = "/home/tv/stockholm";
nixpkgs.git = {
url = https://github.com/NixOS/nixpkgs;
2016-10-23 19:33:45 +00:00
ref = "e4fb65a3627f8c17a2f92c08bf302dc30f0a8db9";
2015-11-06 21:36:01 +00:00
};
} // optionalAttrs host.secure {
secrets-master.file = "/home/tv/secrets/master";
};
2015-11-06 21:36:01 +00:00
};
networking.hostName = config.krebs.build.host.name;
2015-07-11 14:55:22 +00:00
imports = [
2015-11-08 10:53:29 +00:00
<secrets>
2016-06-30 19:11:13 +00:00
./audit.nix
2015-12-28 18:43:31 +00:00
./backup.nix
2016-07-23 11:11:33 +00:00
./bash.nix
2016-03-05 11:57:46 +00:00
./nginx
2016-07-23 10:18:46 +00:00
./ssh.nix
2016-07-23 11:11:50 +00:00
./sshd.nix
2015-11-01 12:28:16 +00:00
./vim.nix
2016-07-23 11:19:44 +00:00
./xdg.nix
2015-10-21 23:25:02 +00:00
{
# stockholm dependencies
environment.systemPackages = with pkgs; [
git
2016-10-06 17:16:42 +00:00
populate
2015-10-21 23:25:02 +00:00
];
}
2015-07-11 14:55:22 +00:00
{
2015-11-08 10:53:29 +00:00
users = {
defaultUserShell = "/run/current-system/sw/bin/bash";
mutableUsers = false;
users = {
tv = {
2016-02-21 05:56:57 +00:00
inherit (config.krebs.users.tv) home uid;
2015-11-08 10:53:29 +00:00
isNormalUser = true;
extraGroups = [ "tv" ];
2015-11-08 10:53:29 +00:00
};
2015-07-11 14:55:22 +00:00
};
};
}
{
security.hideProcessInformation = true;
2015-07-11 14:55:22 +00:00
security.sudo.extraConfig = ''
2016-02-25 12:45:23 +00:00
Defaults env_keep+="SSH_CLIENT"
2015-07-24 23:06:13 +00:00
Defaults mailto="${config.krebs.users.tv.mail}"
2016-02-17 21:28:02 +00:00
Defaults !lecture
2015-07-11 14:55:22 +00:00
'';
time.timeZone = "Europe/Berlin";
}
2015-07-11 14:55:22 +00:00
{
# TODO check if both are required:
2016-10-06 17:16:42 +00:00
nix.sandboxPaths = [ "/etc/protocols" pkgs.iana_etc.outPath ];
2015-07-11 14:55:22 +00:00
nix.requireSignedBinaryCaches = true;
nix.binaryCaches = ["https://cache.nixos.org"];
2015-07-11 14:55:22 +00:00
2016-10-06 17:16:42 +00:00
nix.useSandbox = true;
2015-07-11 14:55:22 +00:00
}
2016-02-02 19:12:06 +00:00
{
nixpkgs.config.allowUnfree = false;
}
{
environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
environment.systemPackages = with pkgs; [
rxvt_unicode.terminfo
];
2015-07-16 04:26:41 +00:00
environment.shellAliases = mkForce {
2015-07-11 14:55:22 +00:00
# alias cal='cal -m3'
gp = "${pkgs.pari}/bin/gp -q";
df = "df -h";
du = "du -h";
# alias grep='grep --color=auto'
# TODO alias cannot contain #\'
# "ps?" = "ps ax | head -n 1;ps ax | fgrep -v ' grep --color=auto ' | grep";
# alias la='ls -lA'
lAtr = "ls -lAtr";
# alias ll='ls -l'
ls = "ls -h --color=auto --group-directories-first";
dmesg = "dmesg -L --reltime";
2015-11-01 12:28:16 +00:00
view = "vim -R";
2015-11-10 11:44:30 +00:00
reload = "systemctl reload";
restart = "systemctl restart";
start = "systemctl start";
status = "systemctl status";
stop = "systemctl stop";
2015-07-11 14:55:22 +00:00
};
2015-11-08 11:28:53 +00:00
environment.variables = {
NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src";
2015-11-08 11:28:53 +00:00
};
2015-07-11 14:55:22 +00:00
}
(let ca-bundle = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; in {
environment.variables = {
CURL_CA_BUNDLE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
GIT_SSL_CAINFO = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
};
})
2015-07-11 14:55:22 +00:00
{
services.cron.enable = false;
services.nscd.enable = false;
services.ntp.enable = false;
2016-07-03 19:35:34 +00:00
services.timesyncd.enable = true;
2015-07-11 14:55:22 +00:00
}
{
boot.kernel.sysctl = {
# Enable IPv6 Privacy Extensions
"net.ipv6.conf.all.use_tempaddr" = 2;
"net.ipv6.conf.default.use_tempaddr" = 2;
};
}
2016-02-01 16:40:25 +00:00
{
tv.iptables.enable = true;
2016-02-07 02:09:14 +00:00
tv.iptables.accept-echo-request = "internet";
2016-02-01 16:40:25 +00:00
}
{
services.journald.extraConfig = ''
SystemMaxUse=1G
RuntimeMaxUse=128M
'';
}
{
environment.systemPackages = [
pkgs.get
pkgs.krebszones
pkgs.nix-prefetch-scripts
pkgs.push
];
}
2015-07-11 14:55:22 +00:00
];
}