Mic92/stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge remote-tracking branch 'lass/master'

Browse Source
This commit is contained in:
makefu 2019-05-28 09:12:57 +02:00
commit 952aeb6c14
No known key found for this signature in database
GPG Key ID: 36F7711F3FC0F225
15 changed files with 308 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
krebs/3modules/mb/default.nix
View File

@ -3,7 +3,6 @@ with import <stockholm/lib>;
hostDefaults = hostName: host: flip recursiveUpdate host {
ci = true;
monitoring = true;
owner = config.krebs.users.mb;
};
@ -63,6 +62,59 @@ in {
};
};
};
gr33n = {
nets = {
retiolum = {
ip4.addr = "10.243.42.123";
aliases = [
"gr33n.r"
];
tinc.pubkey = ''
-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvcqecLfk8TlGFF7JJpv8
kjLFNgoNfu9FYRMNG4GSxWL5w+49n6b+GC5ciOC+RJ+N56jfB9JYE0MtbuOmkY5M
JUphuvgOCNhTbBJsjnmG9n02evpxZn9HWypNC3oQCvY2K7vHpIxGKR5PyTVKPO0P
OOYKAbCLD9F2bmuLaBQ/dFXFQxfu3tjvJI9mYDWBpSkh1mYeMZLw2xxnRZLs0bEO
ZWdzxCh9UM/mgb4WYuNED9+sz7MSsaMPAqquarFCguUxhjp6rElGFcNWjXaxA5zt
JGS6VompUViVSHjSaQ5/3VRKoIQjr4NOFYQqLpmB5S2OpiggV6I9OpB7QUGlvcYd
I3j+1AeK11HuEyPqSwxjNCCrI12bSIo3685BPHbl+AMhWGhzrCkAGcOCbAefreXQ
5v4SaKUIDlCYhN+vyNdlu2jvqQlxfJrPAfBt+jJBK6gMcAEKc7P/Oj4B9Fsl331X
s0kWH5G9t6OhO/Of8/kb2/P+YEbM6zi1QQdZAOr6Cg0y4cMt9zxLWknaM4yEDAXH
oSM33PTv9DOvBjfxRXqOHqOHRq5ayqZdIFgfLUlPTdbWRkhNzjG8f7k7p32m20A6
Kal+OF//I2c9E9vKFzyepyTcnwi3B8+cFJ74+XYaNApdwHSb1BU/+c3O9RJExZGV
jtTSbSJHU5esECtAuXy1XH8CAwEAAQ==
-----END PUBLIC KEY-----
'';
};
};
};
sunsh1n3 = {
ci = false;
nets = {
retiolum = {
ip4.addr = "10.243.42.142";
aliases = [
"sunsh1n3.r"
];
tinc.pubkey = ''
-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAo2VCqp6mUbyo3n+1XpKf
QavpgRYQyv9wAZzYSYHjxThuLmNb/wERPbWJFMZfAGuku0blKWJISSgFWd9YL7dU
pZQZxfqo/9xnS/r0xIKrKSsBiTZt7JZmTQzj1ri11TIO0S1QPjIP5HsxlZZAw0nz
idEDlKmgWs74FPdezlXqvJyEUKDqL/ZQBtdhZZIDMkSJnCdBzXxKwv+uLVE46ZBf
4HrtQjcj+dyVMogMIoseAgf5lS6V3pyCM7/NHZFxrIxoIAxSsUoB59i2EbK6aUK5
yuiWHI6ZHToxN2K/0SX96hzxcwrUmdk49tTHBY0Zhn2ku6NjQPU3LuxgIwrSaSJD
/KWh6XkqR7EsCVN0AIsLvFelI2ckSyNyAlnYbMAHDt7GwHlNp4Lsy+x4ZQ6m0xTY
Z+/jt6sfoMiulPcwWEpqNCCf5A65lF77DldQhH3qYrdQ756n/kOqSfQtPCnVNYXy
LlN5rKCOgxKxxtKkwMUif2OM9RPHpM7wS09Rvek6zpL9ymhU5THF7UylLKxKGjYj
6dTooyRVQRJdrwIYLrJIy0MfGyYiGAJxf/C0KOOZnJPCW2b51+bo5Zh+BhKZYN8H
C2DEGc8+4h5hX1TAaUfTpfVm3mMTh8H2m9N8Pdl5ji+A0m0IwHDLQyaoskcxSjvU
9IxYLfkSD6AJqasnHlz0L08CAwEAAQ==
-----END PUBLIC KEY-----
'';
};
};
};
};
users = {
mb = {

2
krebs/5pkgs/haskell/blessings.nix
View File

@ -14,7 +14,7 @@ with import <stockholm/lib>;
version = "2.2.0";
sha256 = "1pb56dgf3jj2kq3cbbppwzyg3ccgqy9xara62hkjwyxzdx20clk1";
};
}.${versions.majorMinor nixpkgsVersion};
}.${versions.majorMinor version};
in mkDerivation {
pname = "blessings";

2
krebs/5pkgs/haskell/email-header.nix
View File

@ -20,7 +20,7 @@ with import <stockholm/lib>;
rev = "refs/tags/v${cfg.version}";
sha256 = "11xjivpj495r2ss9aqljnpzzycb57cm4sr7yzmf939rzwsd3ib0x";
};
}.${versions.majorMinor nixpkgsVersion};
}.${versions.majorMinor version};
in mkDerivation {
pname = "email-header";

55
krebs/5pkgs/simple/ssh-audit.nix Normal file
View File

@ -0,0 +1,55 @@
{ fetchFromGitHub, python3Packages, stdenv }:
python3Packages.buildPythonPackage rec {
inherit (meta) version;
pname = "ssh-audit";
src = fetchFromGitHub {
owner = "arthepsy";
repo = pname;
rev = "refs/tags/v${meta.version}";
sha256 = "0akrychkdym9f6830ysq787c9nc0bkyqvy4h72498lyghwvwc2ms";
};
checkInputs = [
python3Packages.pytest
python3Packages.pytestcov
];
checkPhase = ''
py.test --cov-report= --cov=ssh-audit -v test
'';
postPatch = ''
printf %s "$setupPy" > setup.py
mkdir scripts
cp ssh-audit.py scripts/ssh-audit
mkdir ssh-audit
cp ssh-audit.py ssh-audit/__init__.py
'';
setupPy = /* py */ ''
from distutils.core import setup
setup(
author='arthepsy',
description='${meta.description}',
license='${meta.license.spdxId}',
name='${pname}',
packages=['ssh-audit'],
scripts=['scripts/ssh-audit'],
url='${meta.homepage}',
version='${version}',
)
'';
meta = {
description = "tool for ssh server auditing";
homepage = "https://github.com/arthepsy/ssh-audit";
license = stdenv.lib.licenses.mit;
maintainers = [
stdenv.lib.maintainers.tv
];
version = "1.7.0";
};
}

6
krebs/nixpkgs.json
View File

@ -1,7 +1,7 @@
{
"url": "https://github.com/NixOS/nixpkgs-channels",
"rev": "cf3e277dd0bd710af0df667e9364f4bd80c72713",
"date": "2019-04-24T23:55:21+02:00",
"sha256": "1abyadl3sxf67yi65758hq6hf2j07afgp1fmkk7kd94dadx6r6f4",
"rev": "705986f5a986be5c5ae13193b487c7ec8ca05f16",
"date": "2019-05-18T20:38:59-04:00",
"sha256": "0zpch2cpl2yx0mp7hnyjd03hqs7rxza9wc2p97njsdzhi56gxwxp",
"fetchSubmodules": false
}

13
lass/2configs/vim.nix
View File

@ -11,6 +11,9 @@ let
(hiPrio (pkgs.python3.withPackages (ps: [
ps.python-language-server
ps.pyls-isort
ps.pyflakes
ps.flake8
ps.yapf
])))
];
@ -72,10 +75,6 @@ let
au BufRead,BufNewFile /dev/shm/* set nobackup nowritebackup noswapfile
"Syntastic config
"let g:syntastic_python_checkers=['flake8']
"let g:syntastic_python_flake8_post_args='--ignore=E501'
nnoremap <F5> :call LanguageClient_contextMenu()<CR>
set hidden
let g:LanguageClient_serverCommands = {
@ -83,7 +82,10 @@ let
\ 'go': ['~/go/bin/go-langserver']
\ }
let g:LanguageClient_diagnosticsDisplay = { 2: { "signText": "W" } }
let g:LanguageClient_diagnosticsDisplay = {
\ 1: { "signText": "E" },
\ 2: { "signText": "W" }
\ }
nmap <esc>q :buffer
nmap <M-q> :buffer
@ -126,7 +128,6 @@ let
extra-runtimepath = concatMapStringsSep "," (pkg: "${pkg.rtp}") [
pkgs.vimPlugins.ack-vim
pkgs.vimPlugins.Gundo
#pkgs.vimPlugins.Syntastic
pkgs.vimPlugins.undotree
pkgs.vimPlugins.vim-go
pkgs.vimPlugins.fzf-vim

130
mb/1systems/gr33n/configuration.nix Normal file
View File

@ -0,0 +1,130 @@
{ config, pkgs, callPackage, ... }: let
unstable = import <nixpkgs-unstable> { config = { allowUnfree = true; }; };
in {
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
<stockholm/mb>
];
krebs.build.host = config.krebs.hosts.gr33n;
boot.kernelPackages = pkgs.linuxPackages_latest;
boot.extraModulePackages = with config.boot.kernelPackages; [ wireguard ];
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
fileSystems."/".options = [ "noatime" "nodiratime" "discard" ];
fileSystems."/mnt/public" = {
device = "//192.168.0.4/public";
fsType = "cifs";
options = let
automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
in [ "${automount_opts},user,rw,username=mb0,iocharset=utf8,credentials=${config.users.users.mb.home}/.smbcredentials" ];
};
i18n = {
consoleFont = "Lat2-Terminus16";
consoleKeyMap = "de";
defaultLocale = "en_US.UTF-8";
};
time.timeZone = "Europe/Berlin";
nixpkgs.config.allowUnfree = true;
nixpkgs.config.packageOverrides = super: {
openvpn = super.openvpn.override {
pkcs11Support = true;
useSystemd = false;
};
};
environment.shellAliases = {
ll = "ls -alh";
ls = "ls --color=tty";
};
environment.systemPackages = with pkgs; [
curl
fish
git
htop
nmap
ranger
tcpdump
tmux
traceroute
tree
vim
wcalc
wget
xz
];
programs.gnupg.agent = { enable = true; enableSSHSupport = true; };
sound.enable = false;
services.openssh.enable = true;
services.openssh.passwordAuthentication = false;
networking.wireless.enable = false;
networking.networkmanager.enable = false;
krebs.iptables.enable = true;
networking.enableIPv6 = false;
programs.fish = {
enable = true;
shellInit = ''
function ssh_agent --description 'launch the ssh-agent and add the id_rsa identity'
if begin
set -q SSH_AGENT_PID
and kill -0 $SSH_AGENT_PID
and grep -q '^ssh-agent' /proc/$SSH_AGENT_PID/cmdline
end
echo "ssh-agent running on pid $SSH_AGENT_PID"
else
eval (command ssh-agent -c | sed 's/^setenv/set -Ux/')
end
set -l identity $HOME/.ssh/id_rsa
set -l fingerprint (ssh-keygen -lf $identity | awk '{print $2}')
ssh-add -l | grep -q $fingerprint
or ssh-add $identity
end
'';
promptInit = ''
function fish_prompt --description 'Write out the prompt'
set -l color_cwd
set -l suffix
set -l nix_shell_info (
if test "$IN_NIX_SHELL" != ""
echo -n " <nix-shell>"
end
)
switch "$USER"
case root toor
if set -q fish_color_cwd_root
set color_cwd $fish_color_cwd_root
else
set color_cwd $fish_color_cwd
end
set suffix '#'
case '*'
set color_cwd $fish_color_cwd
set suffix '>'
end
echo -n -s "$USER" @ (set_color green) (prompt_hostname) (set_color normal) "$nix_shell_info" ' ' (set_color $color_cwd) (prompt_pwd) (set_color normal) "$suffix "
end
'';
};
nix.buildCores = 4;
system.autoUpgrade.enable = false;
system.autoUpgrade.channel = "https://nixos.org/channels/nixos-19.03";
system.stateVersion = "19.03";
}

37
mb/1systems/gr33n/hardware-configuration.nix Normal file
View File

@ -0,0 +1,37 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, ... }:
{
imports =
[ <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
];
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
boot.initrd.mdadmConf = ''
ARRAY /dev/md0 level=raid6 num-devices=4 metadata=1.2 name=gr33n:0 UUID=5b715fd9:0be6bfa6:19f07db4:c16836d6
devices=/dev/sda1,/dev/sdb1,/dev/sdc1,/dev/sdd1
'';
fileSystems."/" =
{ device = "/dev/disk/by-uuid/a9f2c19b-f60f-450c-87f1-146a54c4198b";
fsType = "ext4";
};
fileSystems."/storage" =
{ device = "/dev/disk/by-label/storage";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/93EB-BCA3";
fsType = "vfat";
};
swapDevices = [ ];
nix.maxJobs = lib.mkDefault 4;
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
}

9
mb/1systems/orange/configuration.nix
View File

@ -27,15 +27,13 @@ in {
fileSystems."/".options = [ "noatime" "nodiratime" "discard" ];
fileSystems."/mnt/public" = {
device = "//192.168.88.252/public";
device = "//192.168.0.4/public";
fsType = "cifs";
options = let
automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
in [ "${automount_opts},user,rw,username=mb0,iocharset=utf8,credentials=${config.users.users.mb.home}/.smbcredentials" ];
};
#networking.hostName = "0r4n93";
networking.wireless.enable = false;
# Select internationalisation properties.
i18n = {
@ -132,7 +130,6 @@ in {
vulnix
wcalc
wget
wireshark-gtk
xz
];
@ -151,6 +148,8 @@ in {
sound.enable = true;
hardware.pulseaudio.enable = true;
hardware.pulseaudio.support32Bit = true;
nixpkgs.config.pulseaudio = true;
services.xserver = {
enable = true;
@ -173,7 +172,9 @@ in {
#services.openssh.permitRootLogin = "yes";
services.openssh.passwordAuthentication = false;
networking.wireless.enable = false;
networking.networkmanager.enable = false;
krebs.iptables.enable = true;
#networking.nameservers = [ "8.8.8.8" "141.1.1.1" ];
networking.enableIPv6 = false;

8
mb/1systems/p1nk/configuration.nix
View File

@ -22,14 +22,13 @@ in {
];
fileSystems."/".options = [ "noatime" "nodiratime" "discard" ];
fileSystems."/mnt/public" = {
device = "//192.168.88.252/public";
device = "//192.168.0.4/public";
fsType = "cifs";
options = let
automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
in [ "${automount_opts},user,rw,username=mb0,iocharset=utf8,credentials=${config.users.users.mb.home}/.smbcredentials" ];
};
networking.wireless.enable = true;
i18n = {
consoleFont = "Lat2-Terminus16";
@ -143,11 +142,12 @@ in {
sound.enable = true;
hardware.pulseaudio.enable = true;
hardware.pulseaudio.support32Bit = true;
services.xserver = {
enable = true;
layout = "de";
xkbOptions = "neo";
xkbOptions = "nodeadkeys";
libinput.enable = true;
desktopManager = {
default = "xfce";
@ -164,7 +164,9 @@ in {
services.openssh.enable = true;
services.openssh.passwordAuthentication = false;
krebs.iptables.enable = true;
networking.networkmanager.enable = false;
networking.wireless.enable = true;
networking.nameservers = [ "8.8.8.8" "141.1.1.1" ];
networking.enableIPv6 = false;

3
mb/2configs/default.nix
View File

@ -49,7 +49,7 @@ with import <stockholm/lib>;
build.user = config.krebs.users.mb;
};
users.mutableUsers = false;
users.mutableUsers = true;
services.timesyncd.enable = mkForce true;
@ -67,6 +67,7 @@ with import <stockholm/lib>;
environment.systemPackages = with pkgs; [
#stockholm
git
git-preview
gnumake
jq
parallel

3
tv/2configs/urlwatch.nix
View File

@ -42,6 +42,9 @@ in {
# ref <stockholm/krebs/3modules>, services.openssh.knownHosts.github*
(json https://api.github.com/meta)
# ref <nixpkgs/pkgs/tools/security/ssh-audit>
(json https://api.github.com/repos/arthepsy/ssh-audit/tags)
# 2014-12-20 ref src/nixpkgs/pkgs/tools/networking/tlsdate/default.nix
(json https://api.github.com/repos/ioerror/tlsdate/tags)

4
tv/2configs/xserver/default.nix
View File

@ -72,6 +72,7 @@ in {
exec ${xmonad}
'';
xmonad-ready = pkgs.writeDash "xmonad-ready" ''
${pkgs.systemd}/bin/systemd-notify --ready
{
${pkgs.xorg.xhost}/bin/xhost +SI:localuser:${cfg.user.name}
${pkgs.xorg.xhost}/bin/xhost -LOCAL:
@ -119,6 +120,9 @@ in {
SyslogIdentifier = "xmonad";
User = cfg.user.name;
WorkingDirectory = cfg.user.home;
NotifyAccess = "all";
Type = "notify";
};
};

3
tv/3modules/Xresources.nix
View File

@ -21,8 +21,7 @@ in {
});
systemd.services.${if cfg.enable then "Xresources" else null} = {
wantedBy = [ "graphical.target" ];
after = [ "xserver.service" ];
requires = [ "xserver.service" ];
after = [ "xmonad.service" ];
environment = {
DISPLAY = ":${toString config.services.xserver.display}";
};

2
tv/5pkgs/default.nix
View File

@ -45,7 +45,7 @@ foldl' mergeAttrs {}
self.callPackage ./compat/18.03/pass {
pass-otp = self.callPackage ./compat/18.03/pass-otp {};
};
}.${versions.majorMinor nixpkgsVersion} or
}.${versions.majorMinor version} or
super.pass.withExtensions (ext: [
ext.pass-otp
]);