From 6451e650ec81e671c5c283005fd6eae7e0b5d271 Mon Sep 17 00:00:00 2001 From: mb Date: Sat, 8 Jun 2019 11:35:38 +0200 Subject: mb suns1n3.r: add configs; update users --- mb/1systems/sunsh1n3/configuration.nix | 180 ++++++++++++++++++++++++ mb/1systems/sunsh1n3/hardware-configuration.nix | 29 ++++ mb/2configs/default.nix | 23 +++ 3 files changed, 232 insertions(+) create mode 100644 mb/1systems/sunsh1n3/configuration.nix create mode 100644 mb/1systems/sunsh1n3/hardware-configuration.nix diff --git a/mb/1systems/sunsh1n3/configuration.nix b/mb/1systems/sunsh1n3/configuration.nix new file mode 100644 index 00000000..d0a609f1 --- /dev/null +++ b/mb/1systems/sunsh1n3/configuration.nix @@ -0,0 +1,180 @@ + +{ config, pkgs, ... }: let + unstable = import { config = { allowUnfree = true; }; }; +in { + imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + + ]; + + krebs.build.host = config.krebs.hosts.sunsh1n3; + + boot.kernelPackages = pkgs.linuxPackages_latest; + + # Use the systemd-boot EFI boot loader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + fileSystems."/".options = [ "noatime" "nodiratime" "discard" ]; + + boot.initrd.luks.devices = [ + { + name = "root"; + device = "/dev/disk/by-uuid/5354ba31-c7de-4b55-8f86-a2a437dfbb21"; + preLVM = true; + allowDiscards = true; + } + ]; + + i18n = { + consoleFont = "Lat2-Terminus16"; + consoleKeyMap = "de"; + defaultLocale = "en_US.UTF-8"; + }; + + time.timeZone = "Europe/Berlin"; + + nixpkgs.config.packageOverrides = super : { + openvpn = super.openvpn.override { pkcs11Support = true; useSystemd = true ; }; + }; + + nixpkgs.config.allowUnfree = true; + + fonts = { + enableCoreFonts = true; + enableGhostscriptFonts = true; + fonts = with pkgs; [ + anonymousPro + corefonts + dejavu_fonts + envypn-font + fira + gentium + gohufont + inconsolata + liberation_ttf + powerline-fonts + source-code-pro + terminus_font + ttf_bitstream_vera + ubuntu_font_family + unifont + unstable.cherry + xorg.fontbitstream100dpi + xorg.fontbitstream75dpi + xorg.fontbitstreamtype1 + ]; + }; + + environment.systemPackages = with pkgs; [ + wget vim git curl fish + ag + chromium + firefox + gimp + p7zip + htop + mpv + mpvc + nmap + ntfs3g + keepassx2 + sshfs + #unstable.skrooge + skrooge + unstable.alacritty + tmux + tree + wcalc + virtmanager + virt-viewer + (wine.override { wineBuild = "wineWow"; }) + xz + ]; + + virtualisation.libvirtd.enable = true; + virtualisation.kvmgt.enable = true; + + # Some programs need SUID wrappers, can be configured further or are + # started in user sessions. + # programs.mtr.enable = true; + + programs.gnupg.agent = { enable = true; enableSSHSupport = true; }; + programs.dconf.enable = true; + + # Enable the OpenSSH daemon. + services.openssh.enable = true; + services.openssh.passwordAuthentication = false; + + krebs.iptables.enable = true; + #networking.wireless.enable = true; + networking.networkmanager.enable = true; + networking.enableIPv6 = false; + + # Enable sound. + sound.enable = true; + hardware.pulseaudio.enable = true; + hardware.pulseaudio.support32Bit = true; + nixpkgs.config.pulseaudio = true; + + services.xserver.enable = true; + services.xserver.layout = "de"; + services.xserver.xkbOptions = "nodeadkeys"; + services.xserver.libinput.enable = true; + + # Enable the KDE Desktop Environment. + services.xserver.displayManager.sddm.enable = true; + services.xserver.desktopManager.plasma5.enable = true; + + programs.fish = { + enable = true; + shellInit = '' + function ssh_agent --description 'launch the ssh-agent and add the id_rsa identity' + if begin + set -q SSH_AGENT_PID + and kill -0 $SSH_AGENT_PID + and grep -q '^ssh-agent' /proc/$SSH_AGENT_PID/cmdline + end + echo "ssh-agent running on pid $SSH_AGENT_PID" + else + eval (command ssh-agent -c | sed 's/^setenv/set -Ux/') + end + set -l identity $HOME/.ssh/id_rsa + set -l fingerprint (ssh-keygen -lf $identity | awk '{print $2}') + ssh-add -l | grep -q $fingerprint + or ssh-add $identity + end + ''; + promptInit = '' + function fish_prompt --description 'Write out the prompt' + set -l color_cwd + set -l suffix + set -l nix_shell_info ( + if test "$IN_NIX_SHELL" != "" + echo -n " " + end + ) + switch "$USER" + case root toor + if set -q fish_color_cwd_root + set color_cwd $fish_color_cwd_root + else + set color_cwd $fish_color_cwd + end + set suffix '#' + case '*' + set color_cwd $fish_color_cwd + set suffix '>' + end + + echo -n -s "$USER" @ (set_color yellow) (prompt_hostname) (set_color normal) "$nix_shell_info" ' ' (set_color $color_cwd) (prompt_pwd) (set_color normal) "$suffix " + end + ''; + }; + + nix.buildCores = 4; + + system.stateVersion = "19.09"; + +} diff --git a/mb/1systems/sunsh1n3/hardware-configuration.nix b/mb/1systems/sunsh1n3/hardware-configuration.nix new file mode 100644 index 00000000..2beee7c4 --- /dev/null +++ b/mb/1systems/sunsh1n3/hardware-configuration.nix @@ -0,0 +1,29 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, ... }: + +{ + imports = + [ + ]; + + boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "usb_storage" "sd_mod" "sdhci_pci" "rtsx_usb_sdmmc" ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/a3257922-d2d4-45ae-87cc-cc38d32e0774"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/60A6-4DAB"; + fsType = "vfat"; + }; + + swapDevices = [ ]; + + nix.maxJobs = lib.mkDefault 4; + powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; +} diff --git a/mb/2configs/default.nix b/mb/2configs/default.nix index ab11495c..3066d1c3 100644 --- a/mb/2configs/default.nix +++ b/mb/2configs/default.nix @@ -21,6 +21,29 @@ with import ; "video" "fuse" "wheel" + "kvm" + "qemu-libvirtd" + "libvirtd" + ]; + openssh.authorizedKeys.keys = [ + config.krebs.users.mb.pubkey + ]; + }; + xo = { + name = "xo"; + uid = 2323; + home = "/home/xo"; + group = "users"; + createHome = true; + shell = "/run/current-system/sw/bin/fish"; + extraGroups = [ + "audio" + "video" + "fuse" + "wheel" + "kvm" + "qemu-libvirtd" + "libvirtd" ]; openssh.authorizedKeys.keys = [ config.krebs.users.mb.pubkey -- cgit v1.2.3 From 7351d5cff1f834990ee3dd698f36a1277e7d7cad Mon Sep 17 00:00:00 2001 From: magenbluten Date: Wed, 19 Jun 2019 20:06:35 +0200 Subject: mb: update host configs --- mb/1systems/gr33n/configuration.nix | 1 + mb/1systems/orange/configuration.nix | 1 + mb/1systems/p1nk/configuration.nix | 1 + mb/1systems/sunsh1n3/configuration.nix | 1 + 4 files changed, 4 insertions(+) diff --git a/mb/1systems/gr33n/configuration.nix b/mb/1systems/gr33n/configuration.nix index 4342ba0e..e20503ae 100644 --- a/mb/1systems/gr33n/configuration.nix +++ b/mb/1systems/gr33n/configuration.nix @@ -62,6 +62,7 @@ in { wcalc wget xz + zbackup ]; programs.gnupg.agent = { enable = true; enableSSHSupport = true; }; diff --git a/mb/1systems/orange/configuration.nix b/mb/1systems/orange/configuration.nix index 3e90f89a..a6e5d0dc 100644 --- a/mb/1systems/orange/configuration.nix +++ b/mb/1systems/orange/configuration.nix @@ -131,6 +131,7 @@ in { wcalc wget xz + zbackup ]; environment.shellAliases = { diff --git a/mb/1systems/p1nk/configuration.nix b/mb/1systems/p1nk/configuration.nix index 905630e7..dff4efaa 100644 --- a/mb/1systems/p1nk/configuration.nix +++ b/mb/1systems/p1nk/configuration.nix @@ -125,6 +125,7 @@ in { wcalc wget xz + zbackup ]; environment.shellAliases = { diff --git a/mb/1systems/sunsh1n3/configuration.nix b/mb/1systems/sunsh1n3/configuration.nix index d0a609f1..633d122e 100644 --- a/mb/1systems/sunsh1n3/configuration.nix +++ b/mb/1systems/sunsh1n3/configuration.nix @@ -91,6 +91,7 @@ in { virt-viewer (wine.override { wineBuild = "wineWow"; }) xz + zbackup ]; virtualisation.libvirtd.enable = true; -- cgit v1.2.3 From cc470ff1580cdca5aa279c2f745c1bb07d20e24c Mon Sep 17 00:00:00 2001 From: magenbluten Date: Sat, 22 Jun 2019 09:01:31 +0200 Subject: mb: add neovim config --- mb/1systems/orange/configuration.nix | 2 +- mb/1systems/p1nk/configuration.nix | 2 +- mb/2configs/neovimrc | 446 +++++++++++++++++++++++++++++++++++ mb/2configs/nvim.nix | 70 ++++++ 4 files changed, 518 insertions(+), 2 deletions(-) create mode 100644 mb/2configs/neovimrc create mode 100644 mb/2configs/nvim.nix diff --git a/mb/1systems/orange/configuration.nix b/mb/1systems/orange/configuration.nix index a6e5d0dc..cabbc6fc 100644 --- a/mb/1systems/orange/configuration.nix +++ b/mb/1systems/orange/configuration.nix @@ -5,6 +5,7 @@ in { [ # Include the results of the hardware scan. ./hardware-configuration.nix + ]; krebs.build.host = config.krebs.hosts.orange; @@ -124,7 +125,6 @@ in { unstable.ponyc unstable.sublime3 unstable.youtube-dl - vim virt-viewer virtmanager vulnix diff --git a/mb/1systems/p1nk/configuration.nix b/mb/1systems/p1nk/configuration.nix index dff4efaa..ba11c85f 100644 --- a/mb/1systems/p1nk/configuration.nix +++ b/mb/1systems/p1nk/configuration.nix @@ -5,6 +5,7 @@ in { [ # Include the results of the hardware scan. ./hardware-configuration.nix + ]; krebs.build.host = config.krebs.hosts.p1nk; @@ -118,7 +119,6 @@ in { unstable.ponyc unstable.sublime3 youtube-dl - vim virt-viewer virtmanager vulnix diff --git a/mb/2configs/neovimrc b/mb/2configs/neovimrc new file mode 100644 index 00000000..8dbeaec7 --- /dev/null +++ b/mb/2configs/neovimrc @@ -0,0 +1,446 @@ + +"***************************************************************************** +"" Functions +"***************************************************************************** + +function! GetBufferList() + redir =>buflist + silent! ls! + redir END + return buflist +endfunction + +function! ToggleList(bufname, pfx) + let buflist = GetBufferList() + for bufnum in map(filter(split(buflist, '\n'), 'v:val =~ "'.a:bufname.'"'), 'str2nr(matchstr(v:val, "\\d\\+"))') + if bufwinnr(bufnum) != -1 + exec(a:pfx.'close') + return + endif + endfor + if a:pfx == 'l' && len(getloclist(0)) == 0 + echohl ErrorMsg + echo "Location List is Empty." + return + endif + let winnr = winnr() + exec(a:pfx.'open') + if winnr() != winnr + wincmd p + endif +endfunction + + +"***************************************************************************** +"" Basic Setup +"*****************************************************************************" +" General +let no_buffers_menu=1 +syntax on +set ruler +set number +set mousemodel=popup +set t_Co=256 +set guioptions=egmrti +set gfn=Monospace\ 10 + +" TODO: Testing if this works against automatically setting paste mode +" Issue: https://github.com/neovim/neovim/issues/7994 +au InsertLeave * set nopaste + + +" undofile - This allows you to use undos after exiting and restarting +" This, like swap and backups, uses .vim-undo first, then ~/.vim/undo +" :help undo-persistence +if exists("+undofile") + if isdirectory($HOME . '/.vim/undo') == 0 + :silent !mkdir -p ~/.vim/undo > /dev/null 2>&1 + endif + set undodir=./.vim-undo// + set undodir+=~/.vim/undo// + set undofile +endif + +" Encoding +set encoding=utf-8 +set fileencoding=utf-8 +set fileencodings=utf-8 +set bomb +set binary + +" Fix backspace indent +set backspace=indent,eol,start + +" Tabs. May be overriten by autocmd rules +set tabstop=4 +set softtabstop=0 +set shiftwidth=4 +set expandtab + +" Map leader to , +let mapleader=',' + +" Enable hidden buffers +set hidden + +" Searching +set hlsearch +set incsearch +set ignorecase +set smartcase + +" Directories for swp files +set nobackup +set noswapfile + +set fileformats=unix,dos,mac + +" File overview +set wildmode=list:longest,list:full +set wildignore+=*.o,*.obj,.git,*.rbc,*.pyc,__pycache__ + +" Shell to emulate +if exists('$SHELL') + set shell=$SHELL +else + set shell=/bin/bash +endif + +" Set color scheme +colorscheme molokai + +"Show always Status bar +set laststatus=2 + +" Use modeline overrides +set modeline +set modelines=10 + +" Set terminal title +set title +set titleold="Terminal" +set titlestring=%F + +" search will center on the line it's found in. +nnoremap n nzzzv +nnoremap N Nzzzv + + + +"***************************************************************************** +"" Abbreviations +"***************************************************************************** +" no one is really happy until you have this shortcuts +cnoreabbrev W! w! +cnoreabbrev Q! q! +cnoreabbrev Qall! qall! +cnoreabbrev Wq wq +cnoreabbrev Wa wa +cnoreabbrev wQ wq +cnoreabbrev WQ wq +cnoreabbrev W w +cnoreabbrev Q q +cnoreabbrev Qall qall + +" NERDTree configuration +let g:NERDTreeChDirMode=2 +let g:NERDTreeIgnore=['\.rbc$', '\~$', '\.pyc$', '\.db$', '\.sqlite$', '__pycache__'] +let g:NERDTreeSortOrder=['^__\.py$', '\/$', '*', '\.swp$', '\.bak$', '\~$'] +let g:NERDTreeShowBookmarks=1 +let g:nerdtree_tabs_focus_on_files=1 +let g:NERDTreeMapOpenInTabSilent = '' +let g:NERDTreeWinSize = 50 +set wildignore+=*/tmp/*,*.so,*.swp,*.zip,*.pyc,*.db,*.sqlite +nnoremap :NERDTreeFind +nnoremap :NERDTreeToggle + +" open terminal emulation +nnoremap sh :terminal:startinsert + +"***************************************************************************** +"" Autocmd Rules +"***************************************************************************** +"" The PC is fast enough, do syntax highlight syncing from start unless 200 lines +augroup vimrc-sync-fromstart + autocmd! + autocmd BufEnter * :syntax sync maxlines=200 +augroup END + +" Nasm filetype +augroup nasm + autocmd! + autocmd BufRead,BufNewFile *.nasm set ft=nasm +augroup END + +" Binary filetype +augroup Binary + au! + au BufReadPre *.bin,*.exe,*.elf let &bin=1 + au BufReadPost *.bin,*.exe,*.elf if &bin | %!xxd + au BufReadPost *.bin,*.exe,*.elf set ft=xxd | endif + au BufWritePre *.bin,*.exe,*.elf if &bin | %!xxd -r + au BufWritePre *.bin,*.exe,*.elf endif + au BufWritePost *.bin,*.exe,*.elf if &bin | %!xxd + au BufWritePost *.bin,*.exe,*.elf set nomod | endif +augroup END + +" Binary filetype +augroup fasm + au! + au BufReadPost *.fasm set ft=fasm +augroup END + +augroup deoplete-update + autocmd! + autocmd VimEnter * UpdateRemotePlugin +augroup END + +"" Remember cursor position +augroup vimrc-remember-cursor-position + autocmd! + autocmd BufReadPost * if line("'\"") > 1 && line("'\"") <= line("$") | exe "normal! g`\"" | endif +augroup END + +"" txt +" augroup vimrc-wrapping +" autocmd! +" autocmd BufRead,BufNewFile *.txt call s:setupWrapping() +" augroup END + +"" make/cmake +augroup vimrc-make-cmake + autocmd! + autocmd FileType make setlocal noexpandtab + autocmd BufNewFile,BufRead CMakeLists.txt setlocal filetype=cmake +augroup END + +set autoread + +"***************************************************************************** +"" Mappings +"***************************************************************************** + +" Split +noremap h :split +noremap v :vsplit + +" Git +noremap ga :Gwrite +noremap gc :Gcommit +noremap gsh :Gpush +noremap gll :Gpull +noremap gs :Gstatus +noremap gb :Gblame +noremap gd :Gvdiff +noremap gr :Gremove + +" Tabs +nnoremap gt +nnoremap gT +nnoremap :tabnew + +" Set working directory +nnoremap . :lcd %:p:h + +" Opens an edit command with the path of the currently edited file filled in +noremap e :e =expand("%:p:h") . "/" + +" Opens a tab edit command with the path of the currently edited file filled +noremap te :tabe =expand("%:p:h") . "/" + +" Tagbar +nmap :TagbarToggle +let g:tagbar_autofocus = 1 + +" Copy/Paste/Cut +set clipboard^=unnamed,unnamedplus + +noremap YY "+y +noremap p "+gP +noremap XX "+x + +" Enable mouse for vim +set mouse=a + +" Buffer nav +noremap z :bp +noremap q :bp +noremap x :bn +noremap w :bn + +" Close buffer +noremap c :bd + +" Clean search (highlight) +nnoremap :noh + +" Switching windows +noremap j +noremap k +noremap l +noremap h + +" Vmap for maintain Visual Mode after shifting > and < +vmap < >gv + +" Move visual block +vnoremap J :m '>+1gv=gv +vnoremap K :m '<-2gv=gv + +" Open current line on GitHub +nnoremap o :.Gbrowse + + +" Save on strg+s if not in paste mode +nmap :w +vmap gv +imap + +" Quit on strg+q in normal mode +nnoremap :q + +" Strg+d to replace word under cursor +nnoremap :%s/\<\>//g + +" Strg+f ro find word under cursor +nnoremap :/ + +" Remove unneccessary spaces +nnoremap :let _s=@/ :%s/\s\+$//e :let @/=_s :nohl :unlet _s + +" Reindent whole file with F6 +map mzgg=G`z + +" Toggle location list +nmap :call ToggleList("Quickfix List", 'c') + +" Replacing text in visual mode doesn't copy it anymore +xmap p ReplaceWithRegisterVisual +xmap ReplaceWithRegisterVisual + +" ALE mappings +nmap i (ale_hover) +nmap d (ale_go_to_definition_in_tab) +nmap rf (ale_find_references) +nmap (ale_fix) + +" Vim-Go mappings +au FileType go nmap i :GoDoc +au FileType go nmap d :GoDef +au FileType go nmap rf :GoReferrers + + +"" Opens an edit command with the path of the currently edited file filled in +noremap e :e =expand("%:p:h") . "/" + +" Use tab for navigatin in autocompletion window +inoremap pumvisible() ? "\" : "\" +inoremap pumvisible() ? "\" : "\" + + +"***************************************************************************** +"" Plugin settings +"***************************************************************************** + +" vim-airline +set statusline+=%{fugitive#statusline()} +let g:airline_theme = 'powerlineish' +let g:airline#extensions#syntastic#enabled = 1 +let g:airline#extensions#branch#enabled = 1 +let g:airline#extensions#tabline#enabled = 1 +let g:airline#extensions#tagbar#enabled = 1 +let g:airline_skip_empty_sections = 1 +let g:airline#extensions#ale#enabled = 1 + +" show indent lines +let g:indent_guides_enable_on_vim_startup = 1 +let g:indent_guides_auto_colors = 0 +hi IndentGuidesOdd ctermbg=235 +hi IndentGuidesEven ctermbg=235 +let g:indent_guides_guide_size = 1 +let g:indent_guides_start_level = 2 + +" Enable autocompletion +let g:deoplete#enable_at_startup = 1 +set completeopt-=preview + +" Ale no preview on hover +let g:ale_close_preview_on_insert = 0 +let g:ale_cursor_detail = 0 + +" Ale skip if file size over 2G +let g:ale_maximum_file_size = "2147483648" + +" Ale to loclist and quickfix +let g:ale_set_quickfix = 1 +" let g:ale_set_loclist = 1 + + +" Ale language server +let g:ale_linters = { + \ 'python': ['pyls'], + \ 'c': ['cquery'], + \ 'cpp': ['cquery'], + \ 'xml': ['xmllint'] + \ } + + +" ALE fixers +let g:ale_fixers = { '*': ['remove_trailing_lines', 'trim_whitespace'] } +let g:ale_fixers.python = ['black'] +let g:ale_fixers.go = ['gofmt'] +let g:ale_fixers.c = ['clang-format'] +let g:ale_fixers.cpp = ['clang-format'] +let g:ale_fixers.json = ['jq'] +let g:ale_fixers.xml = ['xmllint'] + +let g:ale_completion_enabled = 1 +let g:ale_sign_error = '⤫' +let g:ale_sign_warning = '⚠' +let g:ale_lint_on_insert_leave = 1 + +" Vim-Go Settings +let g:go_auto_sameids = 1 +let g:go_fmt_command = "goimports" +let g:go_auto_type_info = 1 + +" Disable syntastic for langserver supported languages +let g:syntastic_mode_map = { + \ "mode": "active", + \ "passive_filetypes": ["go", "python", "c", "cpp", "xml" ] + \ } +let g:syntastic_always_populate_loc_list = 1 +let g:syntastic_auto_loc_list = 2 +let g:syntastic_aggregate_errors = 1 +let g:syntastic_check_on_open = 1 +let g:syntastic_check_on_wq = 0 +let g:syntastic_error_symbol='✗' +let g:syntastic_warning_symbol='⚠' +let g:syntastic_style_error_symbol = '✗' +let g:syntastic_style_warning_symbol = '⚠' + +"***************************************************************************** +"" Shortcuts overview +"***************************************************************************** +" Shortcuts overview +" F1 --> Filetree find +" F2 --> Filetree toggle +" F3 --> Function overview +" F4 --> Toggle error bar + +" F5 --> Remove trailing whitespaces +" F6 --> Reindent whole file +" F7 --> Format and lint file +" ,i --> Information about function +" ,d --> Jump to definition +" ,r --> Rename in all occurences +" ,rf --> Find references of function/variable +" ,e --> Change current file +" ,te --> Open file in new tab +" strg+f --> Find current selected word +" strg+d --> Replace current selected word +" strg+s --> Save file +" strg+q --> Close current file +" space+, --> Stop highlighting words after search + diff --git a/mb/2configs/nvim.nix b/mb/2configs/nvim.nix new file mode 100644 index 00000000..a8e4173e --- /dev/null +++ b/mb/2configs/nvim.nix @@ -0,0 +1,70 @@ +{ pkgs, config, ... }: let + #unstable = import { }; +in + +{ + environment.variables = { + EDITOR = ["nvim"]; + }; + + nixpkgs.config.packageOverrides = pkgs: with pkgs;{ + neovim_custom = neovim.override { + configure = { + customRC = builtins.readFile ./neovimrc; + + packages.myVimPackage = with pkgs.vimPlugins; + { + # loaded on launch + start = [ + nerdtree # file manager + commentary # comment stuff out based on language + fugitive # full git integration + vim-airline-themes # lean & mean status/tabline + vim-airline # status bar + gitgutter # git diff in the gutter (sign column) + vim-trailing-whitespace # trailing whitspaces in red + tagbar # F3 function overview + syntastic # Fallback to singlethreaded but huge syntax support + ReplaceWithRegister # For better copying/replacing + polyglot # Language pack + vim-indent-guides # for displaying indent levels + ale # threaded language client + vim-go # go linting + deoplete-go # go autocompletion completion + deoplete-nvim # general autocompletion + molokai # color scheme + ]; + + # manually loadable by calling `:packadd $plugin-name` + opt = []; + }; + }; + }; + }; + + environment.systemPackages = with pkgs; [ + ctags + neovim_custom + jq # For fixing json files + xxd # .bin files will be displayed with xxd + shellcheck # Shell linting + ansible-lint # Ansible linting + unzip # To vim into unzipped files + nodePackages.jsonlint # json linting + #python36Packages.python-language-server # python linting + #python36Packages.pyls-mypy # Python static type checker + #python36Packages.black # Python code formatter + #python37Packages.yamllint # For linting yaml files + #python37Packages.libxml2 # For fixing yaml files + cquery # C/C++ support + clang-tools # C++ fixer + ]; + + fonts = { + fonts = with pkgs; [ + font-awesome_5 + ]; + }; + +} + -- cgit v1.2.3 From 02ab71056896e651b6998b5211caf1d51f1d26b7 Mon Sep 17 00:00:00 2001 From: magenbluten Date: Sun, 14 Jul 2019 13:24:51 +0200 Subject: mb gr33n.r: add codimd --- mb/1systems/gr33n/configuration.nix | 13 +++++++++++++ mb/1systems/orange/configuration.nix | 4 ++++ 2 files changed, 17 insertions(+) diff --git a/mb/1systems/gr33n/configuration.nix b/mb/1systems/gr33n/configuration.nix index e20503ae..dcf98779 100644 --- a/mb/1systems/gr33n/configuration.nix +++ b/mb/1systems/gr33n/configuration.nix @@ -72,6 +72,19 @@ in { services.openssh.enable = true; services.openssh.passwordAuthentication = false; + services.codimd = { + enable = true; + workDir = "/storage/codimd"; + configuration = { + port = 1337; + host = "0.0.0.0"; + db = { + dialect = "sqlite"; + storage = "/storage/codimd/db.codimd.sqlite"; + }; + }; + }; + networking.wireless.enable = false; networking.networkmanager.enable = false; krebs.iptables.enable = true; diff --git a/mb/1systems/orange/configuration.nix b/mb/1systems/orange/configuration.nix index cabbc6fc..b43bd8a0 100644 --- a/mb/1systems/orange/configuration.nix +++ b/mb/1systems/orange/configuration.nix @@ -134,6 +134,10 @@ in { zbackup ]; + environment.variables = { + EDITOR = ["nvim"]; + }; + environment.shellAliases = { ll = "ls -alh"; ls = "ls --color=tty"; -- cgit v1.2.3 From 08b81051969e0b0e03dd240bd3c83e42e2619521 Mon Sep 17 00:00:00 2001 From: magenbluten Date: Sun, 14 Jul 2019 13:05:51 +0200 Subject: mb: add rofl.r --- krebs/3modules/mb/default.nix | 26 ++++ mb/1systems/rofl/configuration.nix | 103 +++++++++++++++ mb/2configs/google-compute-config.nix | 231 ++++++++++++++++++++++++++++++++++ mb/2configs/headless.nix | 25 ++++ mb/2configs/qemu-guest.nix | 19 +++ 5 files changed, 404 insertions(+) create mode 100644 mb/1systems/rofl/configuration.nix create mode 100644 mb/2configs/google-compute-config.nix create mode 100644 mb/2configs/headless.nix create mode 100644 mb/2configs/qemu-guest.nix diff --git a/krebs/3modules/mb/default.nix b/krebs/3modules/mb/default.nix index e77811f0..31e01c4a 100644 --- a/krebs/3modules/mb/default.nix +++ b/krebs/3modules/mb/default.nix @@ -36,6 +36,32 @@ in { }; }; }; + rofl = { + nets = { + retiolum = { + ip4.addr = "10.243.42.43"; + aliases = [ + "rofl.r" + ]; + tinc.pubkey = '' + -----BEGIN PUBLIC KEY----- + MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAnysdVVwxkmSroNUleYZm + xdaIB9EdZYCo2xj3WyhsD2lWMpj51FzSH6Y052Vy1V1TCuIXIwjidpmMohBvflG8 + txKCaBGQOZbVqRgzyCDXsNisbr05ayYuHcRrXTpn5ask4HN0Vtx2uJOn8YmOxA0D + VhyEnf8xWu+vi8dwDqRVR17QnPBYqgenzIBmAuRngvNqg6WZg+E9X2e1Dco/PMzb + VW0AgC2+zFCl4+G7dEW7uhsI6IJLy4LsJuEN4TlvWAf7tfdFEnBzTfODW8quGdts + 1Yzah4svPNNt9F1ZhOR/1bDsfVoOjI76BgB0G+ZZPQAGV1zxgn8DXSKi/tJTLNu1 + vj/n9sUJfXMYQdTAOkABghCyEDFUspPKCffQqUXUcJbLKY9fNssGGBeanMsobUQC + Ch9z7kIJ52JDcP/D58z9Yf62P5ENqXzeVPCcodIOey1EizOu/FH3jVo52we1M5sp + 1iM4hMc3ZINUBI9AA1nLWWlB3lBnErAXrhmMMHjcO4nO7/M0YU+EalkDB5eIhqiH + QJx7VnOE2UZYU9Y0vVNSWfYocU12aABK98T7lr5Tde4dI1J81sk2MUZcbNHger3f + NxpvNzOBpeC5xvq/ENCRR7MDf/59xWW5P5N7PbGprLQAi8cfdSoIEhSPz17Taq1f + 3aAAePgBsZvRQozxXZfqp58CAwEAAQ== + -----END PUBLIC KEY----- + ''; + }; + }; + }; p1nk = { nets = { retiolum = { diff --git a/mb/1systems/rofl/configuration.nix b/mb/1systems/rofl/configuration.nix new file mode 100644 index 00000000..3c5c56c8 --- /dev/null +++ b/mb/1systems/rofl/configuration.nix @@ -0,0 +1,103 @@ +{ config, pkgs, callPackage, ... }: let + unstable = import { config = { allowUnfree = true; }; }; +in { + imports = + [ # Include the results of the hardware scan. + + + ]; + + krebs.build.host = config.krebs.hosts.rofl; + + i18n = { + consoleFont = "Lat2-Terminus16"; + consoleKeyMap = "de"; + defaultLocale = "en_US.UTF-8"; + }; + + time.timeZone = "Europe/Berlin"; + + nixpkgs.config.allowUnfree = true; + + environment.shellAliases = { + ll = "ls -alh"; + ls = "ls --color=tty"; + }; + + environment.systemPackages = with pkgs; [ + curl + fish + git + htop + nmap + ranger + tcpdump + tmux + traceroute + tree + vim + xz + zbackup + ]; + + sound.enable = false; + + services.openssh.enable = true; + services.openssh.passwordAuthentication = false; + + networking.wireless.enable = false; + networking.networkmanager.enable = false; + krebs.iptables.enable = true; + networking.enableIPv6 = false; + + programs.fish = { + enable = true; + shellInit = '' + function ssh_agent --description 'launch the ssh-agent and add the id_rsa identity' + if begin + set -q SSH_AGENT_PID + and kill -0 $SSH_AGENT_PID + and grep -q '^ssh-agent' /proc/$SSH_AGENT_PID/cmdline + end + echo "ssh-agent running on pid $SSH_AGENT_PID" + else + eval (command ssh-agent -c | sed 's/^setenv/set -Ux/') + end + set -l identity $HOME/.ssh/id_rsa + set -l fingerprint (ssh-keygen -lf $identity | awk '{print $2}') + ssh-add -l | grep -q $fingerprint + or ssh-add $identity + end + ''; + promptInit = '' + function fish_prompt --description 'Write out the prompt' + set -l color_cwd + set -l suffix + set -l nix_shell_info ( + if test "$IN_NIX_SHELL" != "" + echo -n " " + end + ) + switch "$USER" + case root toor + if set -q fish_color_cwd_root + set color_cwd $fish_color_cwd_root + else + set color_cwd $fish_color_cwd + end + set suffix '#' + case '*' + set color_cwd $fish_color_cwd + set suffix '>' + end + + echo -n -s "$USER" @ (set_color green) (prompt_hostname) (set_color normal) "$nix_shell_info" ' ' (set_color $color_cwd) (prompt_pwd) (set_color normal) "$suffix " + end + ''; + }; + + system.autoUpgrade.enable = false; + system.autoUpgrade.channel = "https://nixos.org/channels/nixos-19.03"; + system.stateVersion = "19.03"; + +} diff --git a/mb/2configs/google-compute-config.nix b/mb/2configs/google-compute-config.nix new file mode 100644 index 00000000..b201bd4b --- /dev/null +++ b/mb/2configs/google-compute-config.nix @@ -0,0 +1,231 @@ +{ config, lib, pkgs, ... }: +with lib; +let + gce = pkgs.google-compute-engine; +in +{ + imports = [ + ./headless.nix + ./qemu-guest.nix + ]; + + fileSystems."/" = { + device = "/dev/disk/by-label/nixos"; + autoResize = true; + }; + + boot.growPartition = true; + boot.kernelParams = [ "console=ttyS0" "panic=1" "boot.panic_on_fail" ]; + boot.initrd.kernelModules = [ "virtio_scsi" ]; + boot.kernelModules = [ "virtio_pci" "virtio_net" ]; + + # Generate a GRUB menu. Amazon's pv-grub uses this to boot our kernel/initrd. + boot.loader.grub.device = "/dev/sda"; + boot.loader.timeout = 0; + + # Don't put old configurations in the GRUB menu. The user has no + # way to select them anyway. + boot.loader.grub.configurationLimit = 0; + + # Allow root logins only using the SSH key that the user specified + # at instance creation time. + #services.openssh.enable = true; + #services.openssh.permitRootLogin = "prohibit-password"; + #services.openssh.passwordAuthentication = mkDefault false; + + # Use GCE udev rules for dynamic disk volumes + services.udev.packages = [ gce ]; + + # Force getting the hostname from Google Compute. + networking.hostName = mkDefault ""; + + # Always include cryptsetup so that NixOps can use it. + environment.systemPackages = [ pkgs.cryptsetup ]; + + # Make sure GCE image does not replace host key that NixOps sets + environment.etc."default/instance_configs.cfg".text = lib.mkDefault '' + [InstanceSetup] + set_host_keys = false + ''; + + # Rely on GCP's firewall instead + networking.firewall.enable = mkDefault false; + + # Configure default metadata hostnames + networking.extraHosts = '' + 169.254.169.254 metadata.google.internal metadata + ''; + + networking.timeServers = [ "metadata.google.internal" ]; + + networking.usePredictableInterfaceNames = false; + + # GC has 1460 MTU + networking.interfaces.eth0.mtu = 1460; + + security.googleOsLogin.enable = true; + + systemd.services.google-clock-skew-daemon = { + description = "Google Compute Engine Clock Skew Daemon"; + after = [ + "network.target" + "google-instance-setup.service" + "google-network-setup.service" + ]; + requires = ["network.target"]; + wantedBy = ["multi-user.target"]; + serviceConfig = { + Type = "simple"; + ExecStart = "${gce}/bin/google_clock_skew_daemon --debug"; + }; + }; + + systemd.services.google-instance-setup = { + description = "Google Compute Engine Instance Setup"; + after = ["local-fs.target" "network-online.target" "network.target" "rsyslog.service"]; + before = ["sshd.service"]; + wants = ["local-fs.target" "network-online.target" "network.target"]; + wantedBy = [ "sshd.service" "multi-user.target" ]; + path = with pkgs; [ ethtool openssh ]; + serviceConfig = { + ExecStart = "${gce}/bin/google_instance_setup --debug"; + Type = "oneshot"; + }; + }; + + systemd.services.google-network-daemon = { + description = "Google Compute Engine Network Daemon"; + after = ["local-fs.target" "network-online.target" "network.target" "rsyslog.service" "google-instance-setup.service"]; + wants = ["local-fs.target" "network-online.target" "network.target"]; + requires = ["network.target"]; + partOf = ["network.target"]; + wantedBy = [ "multi-user.target" ]; + path = with pkgs; [ iproute ]; + serviceConfig = { + ExecStart = "${gce}/bin/google_network_daemon --debug"; + }; + }; + + systemd.services.google-shutdown-scripts = { + description = "Google Compute Engine Shutdown Scripts"; + after = [ + "local-fs.target" + "network-online.target" + "network.target" + "rsyslog.service" + "systemd-resolved.service" + "google-instance-setup.service" + "google-network-daemon.service" + ]; + wants = [ "local-fs.target" "network-online.target" "network.target"]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + ExecStart = "${pkgs.coreutils}/bin/true"; + ExecStop = "${gce}/bin/google_metadata_script_runner --debug --script-type shutdown"; + Type = "oneshot"; + RemainAfterExit = true; + TimeoutStopSec = "infinity"; + }; + }; + + systemd.services.google-startup-scripts = { + description = "Google Compute Engine Startup Scripts"; + after = [ + "local-fs.target" + "network-online.target" + "network.target" + "rsyslog.service" + "google-instance-setup.service" + "google-network-daemon.service" + ]; + wants = ["local-fs.target" "network-online.target" "network.target"]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + ExecStart = "${gce}/bin/google_metadata_script_runner --debug --script-type startup"; + KillMode = "process"; + Type = "oneshot"; + }; + }; + + + # Settings taken from https://github.com/GoogleCloudPlatform/compute-image-packages/blob/master/google_config/sysctl/11-gce-network-security.conf + boot.kernel.sysctl = { + # Turn on SYN-flood protections. Starting with 2.6.26, there is no loss + # of TCP functionality/features under normal conditions. When flood + # protections kick in under high unanswered-SYN load, the system + # should remain more stable, with a trade off of some loss of TCP + # functionality/features (e.g. TCP Window scaling). + "net.ipv4.tcp_syncookies" = mkDefault "1"; + + # ignores source-routed packets + "net.ipv4.conf.all.accept_source_route" = mkDefault "0"; + + # ignores source-routed packets + "net.ipv4.conf.default.accept_source_route" = mkDefault "0"; + + # ignores ICMP redirects + "net.ipv4.conf.all.accept_redirects" = mkDefault "0"; + + # ignores ICMP redirects + "net.ipv4.conf.default.accept_redirects" = mkDefault "0"; + + # ignores ICMP redirects from non-GW hosts + "net.ipv4.conf.all.secure_redirects" = mkDefault "1"; + + # ignores ICMP redirects from non-GW hosts + "net.ipv4.conf.default.secure_redirects" = mkDefault "1"; + + # don't allow traffic between networks or act as a router + "net.ipv4.ip_forward" = mkDefault "0"; + + # don't allow traffic between networks or act as a router + "net.ipv4.conf.all.send_redirects" = mkDefault "0"; + + # don't allow traffic between networks or act as a router + "net.ipv4.conf.default.send_redirects" = mkDefault "0"; + + # reverse path filtering - IP spoofing protection + "net.ipv4.conf.all.rp_filter" = mkDefault "1"; + + # reverse path filtering - IP spoofing protection + "net.ipv4.conf.default.rp_filter" = mkDefault "1"; + + # ignores ICMP broadcasts to avoid participating in Smurf attacks + "net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault "1"; + + # ignores bad ICMP errors + "net.ipv4.icmp_ignore_bogus_error_responses" = mkDefault "1"; + + # logs spoofed, source-routed, and redirect packets + "net.ipv4.conf.all.log_martians" = mkDefault "1"; + + # log spoofed, source-routed, and redirect packets + "net.ipv4.conf.default.log_martians" = mkDefault "1"; + + # implements RFC 1337 fix + "net.ipv4.tcp_rfc1337" = mkDefault "1"; + + # randomizes addresses of mmap base, heap, stack and VDSO page + "kernel.randomize_va_space" = mkDefault "2"; + + # Reboot the machine soon after a kernel panic. + "kernel.panic" = mkDefault "10"; + + ## Not part of the original config + + # provides protection from ToCToU races + "fs.protected_hardlinks" = mkDefault "1"; + + # provides protection from ToCToU races + "fs.protected_symlinks" = mkDefault "1"; + + # makes locating kernel addresses more difficult + "kernel.kptr_restrict" = mkDefault "1"; + + # set ptrace protections + "kernel.yama.ptrace_scope" = mkOverride 500 "1"; + + # set perf only available to root + "kernel.perf_event_paranoid" = mkDefault "2"; + }; +} diff --git a/mb/2configs/headless.nix b/mb/2configs/headless.nix new file mode 100644 index 00000000..46a9b6a7 --- /dev/null +++ b/mb/2configs/headless.nix @@ -0,0 +1,25 @@ +# Common configuration for headless machines (e.g., Amazon EC2 +# instances). + +{ lib, ... }: + +with lib; + +{ + boot.vesa = false; + + # Don't start a tty on the serial consoles. + systemd.services."serial-getty@ttyS0".enable = false; + systemd.services."serial-getty@hvc0".enable = false; + systemd.services."getty@tty1".enable = false; + systemd.services."autovt@".enable = false; + + # Since we can't manually respond to a panic, just reboot. + boot.kernelParams = [ "panic=1" "boot.panic_on_fail" ]; + + # Don't allow emergency mode, because we don't have a console. + systemd.enableEmergencyMode = false; + + # Being headless, we don't need a GRUB splash image. + boot.loader.grub.splashImage = null; +} diff --git a/mb/2configs/qemu-guest.nix b/mb/2configs/qemu-guest.nix new file mode 100644 index 00000000..315d0409 --- /dev/null +++ b/mb/2configs/qemu-guest.nix @@ -0,0 +1,19 @@ +# Common configuration for virtual machines running under QEMU (using +# virtio). + +{ ... }: + +{ + boot.initrd.availableKernelModules = [ "virtio_net" "virtio_pci" "virtio_mmio" "virtio_blk" "virtio_scsi" "9p" "9pnet_virtio" ]; + boot.initrd.kernelModules = [ "virtio_balloon" "virtio_console" "virtio_rng" ]; + + boot.initrd.postDeviceCommands = + '' + # Set the system time from the hardware clock to work around a + # bug in qemu-kvm > 1.5.2 (where the VM clock is initialised + # to the *boot time* of the host). + hwclock -s + ''; + + security.rngd.enable = false; +} -- cgit v1.2.3 From 976e6d77031b9e9648789d72cf893a6d1192fedb Mon Sep 17 00:00:00 2001 From: magenbluten Date: Sun, 14 Jul 2019 13:26:37 +0200 Subject: mb p1nk.r: add pekwm --- mb/1systems/p1nk/configuration.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mb/1systems/p1nk/configuration.nix b/mb/1systems/p1nk/configuration.nix index ba11c85f..19efc75b 100644 --- a/mb/1systems/p1nk/configuration.nix +++ b/mb/1systems/p1nk/configuration.nix @@ -5,7 +5,7 @@ in { [ # Include the results of the hardware scan. ./hardware-configuration.nix - + ]; krebs.build.host = config.krebs.hosts.p1nk; @@ -160,6 +160,7 @@ in { }; }; windowManager.ratpoison.enable = true; + windowManager.pekwm.enable = true; }; services.openssh.enable = true; -- cgit v1.2.3