diff options
30 files changed, 1249 insertions, 96 deletions
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 4d40f3856..734d6c781 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -49,6 +49,7 @@ let ./rtorrent.nix ./secret.nix ./setuid.nix + ./shadow.nix ./syncthing.nix ./tinc.nix ./tinc_graphs.nix @@ -102,6 +103,7 @@ let { krebs = import ./krebs { inherit config; }; } { krebs = import ./lass { inherit config; }; } { krebs = import ./makefu { inherit config; }; } + { krebs = import ./mb { inherit config; }; } { krebs = import ./external/palo.nix { inherit config; }; } { krebs = import ./tv { inherit config; }; } { diff --git a/krebs/3modules/mb/default.nix b/krebs/3modules/mb/default.nix new file mode 100644 index 000000000..c98db4b27 --- /dev/null +++ b/krebs/3modules/mb/default.nix @@ -0,0 +1,73 @@ +with import <stockholm/lib>; +{ config, ... }: let + + hostDefaults = hostName: host: flip recursiveUpdate host { + ci = true; + monitoring = true; + owner = config.krebs.users.mb; + }; + +in { + hosts = mapAttrs hostDefaults { + orange = { + nets = { + retiolum = { + ip4.addr = "10.243.42.23"; + aliases = [ + "orange.r" + "or4ng3.r" + "0r4n93.r" + ]; + tinc.pubkey = '' + -----BEGIN PUBLIC KEY----- + MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAr7P0CkmC5HWnTdgGFzmA + zQuJzHSkSjcGgSkIt0pvqU6xi8P/d4eJlmeXeGTpH62JfM1xhEMpxMVd/4NOON2u + IlWnfu5bB763145IJwE0HmZziWjQXWRPAZMqYdQ5f2Pvmxv1yr3uBNzr8UlV6BjD + FXn8sCvikXttYzts9szlz5+pkY09qfiz48+DMzRBNO6JzXYQ9kPyS+TIXlGpN4Jp + C1TRF38eF2DTEZ58Yx8Z99dGrXVuqlSe77fehTQGxCckTpaZ0HS3XfZNa/cas8JY + /0RzH2n2AndnPirISDZ7r4ZIFuKAaivqaEkM8v7llI77URVB9ZJb/IqCrBzueAbt + V/5ts2HpfBAUhw0RoiH8ql+IQZsuSOpRUC2gUN8460V4SQkVtDcsVTENiD+NM5Mg + ImBv041CsW/rSJOilT2r/rWDN8RFnz/RrAQn+L31KXr81kg1TOLxO0ybs/eMJM3r + RnHFZPiiKdqPlA60g0AnzKXPR2JTszHIgHHoRUW16I1WJeuAJNjg0JDQ0JM7pZ27 + JEaCc7uR12TPiuExKaNEaxKZVY1J0hzxOzF2MFIbAMVz/3K2ycvvuLxKojqIAXxA + D+UtcOfJ62k2WnLXOEIZqFU0J2bvhxYUZOFS55wIn1UJF7hemD/LUFHBiWnuhwHk + TAEl8M851t+Zp3hZeJzgx2kCAwEAAQ== + -----END PUBLIC KEY----- + ''; + }; + }; + }; + p1nk = { + nets = { + retiolum = { + ip4.addr = "10.243.42.42"; + aliases = [ + "p1nk.r" + ]; + tinc.pubkey = '' + -----BEGIN PUBLIC KEY----- + MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5YVML71oW3iJrzZKuX48 + AKrGitO5zNvsAHOI8BVsGfZTyxAAZgG4OaDX45kr27K39NcBU43LdDD0I1yjNvGe + zAoL5MIiCPD/QR1kAvLmgpMUSqOVvrk+uoGLVt6dOGvxlOiG1AAaN0gA8Q0B/jZV + 4tZlBpZ7MX9xeK10wqVT56msN69P3EzKQn1uoVRrBxEnNvI1iqmmkgMLcrFVJFBQ + 888Uuw9Hx5MO7ES/ATe8mt0zReUGvn91jYVVsPpmAopWnjCol271gflY0RomFXKy + XaIuvbeF+3otF0+MNqJfm4IsAKJjvl92pjVX0f0eBCSPCYR7D1EtgQrqflLkZKZ8 + jBGDlgpsFWt/Omz1BYcuGZU/djM4+SNxr4YRYMi3lMix3s2PmHvm304I7eEEBlC9 + qy1jq/sLaf8mHJrF6Htl7W5WS/Famkwv/VreI92iHrhsmIDiX7OIbXzYDCxT/PQa + 6uCm/3jIbcHG/ZHZ12H6thkafK0Aoe009+p1n+5Y7V2oNvYe3KzZTnCN5t6z1QHZ + V5iypsd6lNDzlodjleTgGK8FmHGRPRdq1wb3eOLE8mWZj7ygDT50FwaC8FzAcHgC + bLN/zlHvCbYmk9IJhktO3B6wtMrZl60+XCpb5rTulM94RirifFYsnTIDJApI11yb + 3AYi5dQXHjab/lvj6917xa0CAwEAAQ== + -----END PUBLIC KEY----- + ''; + }; + }; + }; + }; + users = { + mb = { + mail = "mb0@codemonkey.cc"; + pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDCHAdKGHP/De/GLEsPo5RBfbaiiitMw4Y/akOekJbImswT6Np2lzqno/WBJcfVs3D39wgPKNld4P/QZc5IwxC26q/PnBFu93KES0GqnlAqUNE63IOJ8UzNdyEqWggnRiLrBU+ZgyFZvmqp6NoSO4YEGEK4RZRMJM/GcAuQMj/nGjx2AHwPGZCkIRgz8/ctBOzX1/knZd3cOnNowH1wlqUKX6UcEzJdAVDQijHF1wl0Ri8tJKq9u8s/fw+1PSOpOHaeF1BALsXSKgeJDqUCTnZW5mAVUWJ86LvvyfCP4In9lhhLisbDm2cD96QaVvJyV6HfmegdSxZ1Phh+9Qz+3WhDJRedBTSKWfK/9j7VWSb+z/KV37q72W25ZfFMSay58LmCqn3v5fGt9qj4nlPw0By4baGLiGlA7xyvkJfdt8ZVPps5d2g6UprTbSA79lYN4qtWKq2Z9t317xch7Lix6EunQcoTkJ6QXEbDrAIk3zvkWr/CtpwEhNcSdWvQsua42dkD2oOI2F2IgFyYgOx9Iba2yj8A0TD2iqfYVhsJIYuk12QfeaR7ovQ6DhHlUxyQzeF6h0Y+I4AN6Sq/Mmj/cxfQoIaAEybUQMX+7KjFceIszT3JbGlz7DCxi7DMmNYuc7LELMRG3jNAOk+fW8u42Bhgc44tzvAondojerUGqCbUDw== mb0@codemonkey.cc"; + }; + }; +} diff --git a/krebs/3modules/permown.nix b/krebs/3modules/permown.nix index 63adb2236..fe293810c 100644 --- a/krebs/3modules/permown.nix +++ b/krebs/3modules/permown.nix @@ -88,7 +88,7 @@ with import <stockholm/lib>; fi done < "$paths" ''; - PrivateTemp = true; + PrivateTmp = true; Restart = "always"; RestartSec = 10; UMask = plan.umask; diff --git a/krebs/3modules/shadow.nix b/krebs/3modules/shadow.nix new file mode 100644 index 000000000..cff66492d --- /dev/null +++ b/krebs/3modules/shadow.nix @@ -0,0 +1,79 @@ +with import <stockholm/lib>; +{ config, pkgs, ... }: let + + cfg = config.krebs.shadow; + + mergeShadowsJq = pkgs.writeJq "merge-shadows.jq" '' + def fields_3_to_9: ["1", "", "", "", "", "", ""]; + + def read_value: + split(":") | + if length == 9 then + if .[2:] == fields_3_to_9 then + . + else + error("unrecognized field contents") + end + elif length == 2 then + if .[1] | test("^\\$6\\$") then + . + fields_3_to_9 + else + error("unrecognized hashed password") + end + else + error("unexpected field count: expected 9 or 2, got \(length)") + end; + + def write_value: + join(":"); + + split("\n") | + map(select(length > 0) | read_value) | + + reverse | + unique_by(.[0]) | + map(write_value) | + sort | + + join("\n") + ''; + +in { + + options.krebs.shadow = { + enable = mkEnableOption "krebs.shadow" // { + default = cfg.overridesFile != null; + }; + overridesFile = mkOption { + apply = x: if typeOf x == "path" then toString x else x; + default = null; + description = '' + Path to a file containing additional shadow entries, used for adding + encrypted passwords which should not be placed into the Nix store. + + The overrides file may contain either regular shadow(5) entries like: + + <code><login-name>:<hashed-password>:1::::::</code> + + Or shortened entries only containing login name and password like: + + <code><login-name>:<hashed-password></code> + ''; + type = types.nullOr (types.either types.path types.absolute-pathname); + }; + }; + + config = let + in mkIf cfg.enable { + system.activationScripts.users-tv = stringAfter [ "users" ] /* sh */ '' + ( + set -efu + umask 77 + ${pkgs.jq}/bin/jq -Rrs -f ${mergeShadowsJq} \ + /etc/shadow ${cfg.overridesFile} > /etc/shadow~ + ${pkgs.coreutils}/bin/mv /etc/shadow /etc/shadow- + ${pkgs.coreutils}/bin/mv /etc/shadow~ /etc/shadow + ) + ''; + }; +} diff --git a/krebs/5pkgs/haskell/flameshot-once.nix b/krebs/5pkgs/haskell/flameshot-once.nix index 89b95ca07..5b369362e 100644 --- a/krebs/5pkgs/haskell/flameshot-once.nix +++ b/krebs/5pkgs/haskell/flameshot-once.nix @@ -4,11 +4,11 @@ }: mkDerivation { pname = "flameshot-once"; - version = "1.1.0"; + version = "1.2.0"; src = fetchgit { url = "https://cgit.krebsco.de/flameshot-once"; - sha256 = "158ha1yyj3p3mdjjga62j91ml83nhrsg34xbg3dir5cb399j8pxx"; - rev = "9d688b6ffad14912bd1afe42555747cb3d213d95"; + sha256 = "01c11dk8ss37awfn9xqsgx668dcrf4kvzfxlq7ycnqsnpbjjvm0a"; + rev = "cebaefa37095e74ad2253c4e2f9d9ab390f88737"; fetchSubmodules = true; }; isLibrary = false; diff --git a/krebs/5pkgs/simple/flameshot-once/profile.nix b/krebs/5pkgs/simple/flameshot-once/profile.nix index 7373da00a..8ea8a850c 100644 --- a/krebs/5pkgs/simple/flameshot-once/profile.nix +++ b/krebs/5pkgs/simple/flameshot-once/profile.nix @@ -29,7 +29,7 @@ let eval = evalModules { modules = singleton { - _file = toString ./config.nix; + _file = toString ./profile.nix; imports = singleton config; options = { buttons = mkOption { @@ -77,6 +77,14 @@ let default = false; type = types.bool; }; + timeout = mkOption { + default = 100; + description = '' + Maximum time in milliseconds allowed for the flameshot daemon to + react. + ''; + type = types.positive; + }; }; }; }; @@ -125,5 +133,6 @@ in pkgs.writeDash "flameshot.profile" '' export FLAMESHOT_CAPTURE_PATH=${cfg.savePath} + export FLAMESHOT_ONCE_TIMEOUT=${toString cfg.timeout} export XDG_CONFIG_HOME=${XDG_CONFIG_HOME} '' diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json index d5ca0e21f..0bc3abf9c 100644 --- a/krebs/nixpkgs.json +++ b/krebs/nixpkgs.json @@ -1,7 +1,7 @@ { "url": "https://github.com/NixOS/nixpkgs-channels", - "rev": "8ea36d732567c80b2d11eb029e10400fe85ca786", - "date": "2019-04-18T22:37:03+01:00", - "sha256": "1d59i55qwqd76n2d0hr1si26q333ydizkd91h8lfczb00xnr5pqn", + "rev": "cf3e277dd0bd710af0df667e9364f4bd80c72713", + "date": "2019-04-24T23:55:21+02:00", + "sha256": "1abyadl3sxf67yi65758hq6hf2j07afgp1fmkk7kd94dadx6r6f4", "fetchSubmodules": false } diff --git a/lass/3modules/usershadow.nix b/lass/3modules/usershadow.nix index 51da2ec93..c3d4de84d 100644 --- a/lass/3modules/usershadow.nix +++ b/lass/3modules/usershadow.nix @@ -22,18 +22,15 @@ environment.systemPackages = [ usershadow ]; lass.usershadow.path = "${usershadow}"; security.pam.services.sshd.text = '' + auth required pam_exec.so expose_authtok /run/wrappers/bin/shadow_verify_pam ${cfg.pattern} + auth required pam_permit.so account required pam_permit.so - auth required pam_env.so envfile=${config.system.build.pamEnvironment} - auth sufficient pam_exec.so quiet expose_authtok ${usershadow}/bin/verify_pam ${cfg.pattern} - auth sufficient pam_unix.so likeauth try_first_pass - session required pam_env.so envfile=${config.system.build.pamEnvironment} session required pam_permit.so - session required pam_loginuid.so ''; security.pam.services.dovecot2 = { text = '' - auth required pam_exec.so debug expose_authtok log=/tmp/lol /run/wrappers/bin/shadow_verify_pam ${cfg.pattern} + auth required pam_exec.so expose_authtok /run/wrappers/bin/shadow_verify_pam ${cfg.pattern} auth required pam_permit.so account required pam_permit.so session required pam_permit.so diff --git a/mb/1systems/orange/configuration.nix b/mb/1systems/orange/configuration.nix new file mode 100644 index 000000000..4ac0996a4 --- /dev/null +++ b/mb/1systems/orange/configuration.nix @@ -0,0 +1,232 @@ +{ config, pkgs, callPackage, ... }: let + unstable = import <nixpkgs-unstable> { config = { allowUnfree = true; }; }; +in { + imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + <stockholm/mb> + ]; + + krebs.build.host = config.krebs.hosts.orange; + + boot.kernelPackages = pkgs.linuxPackages_latest; + boot.extraModulePackages = with config.boot.kernelPackages; [ wireguard ]; + + # Use the systemd-boot EFI boot loader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + boot.initrd.luks.devices = [ + { + name = "root"; + device = "/dev/disk/by-uuid/09a36f91-a713-4b82-8b41-4e7a6acc4acf"; + preLVM = true; + allowDiscards = true; + } + ]; + + fileSystems."/".options = [ "noatime" "nodiratime" "discard" ]; + fileSystems."/mnt/public" = { + device = "//192.168.88.252/public"; + fsType = "cifs"; + options = let + automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s"; + in [ "${automount_opts},user,rw,username=mb0,iocharset=utf8,credentials=${config.users.users.mb.home}/.smbcredentials" ]; + }; + + #networking.hostName = "0r4n93"; + networking.wireless.enable = false; + + # Select internationalisation properties. + i18n = { + consoleFont = "Lat2-Terminus16"; + consoleKeyMap = "de"; + defaultLocale = "en_US.UTF-8"; + }; + + time.timeZone = "Europe/Berlin"; + + nixpkgs.config.packageOverrides = super: { + openvpn = super.openvpn.override { pkcs11Support = true; useSystemd = false; }; + }; + + nixpkgs.config.allowUnfree = true; + + fonts = { + enableCoreFonts = true; + enableGhostscriptFonts = true; + fonts = with pkgs; [ + anonymousPro + corefonts + dejavu_fonts + envypn-font + fira + gentium + gohufont + inconsolata + liberation_ttf + powerline-fonts + source-code-pro + terminus_font + ttf_bitstream_vera + ubuntu_font_family + unifont + unstable.cherry + xorg.fontbitstream100dpi + xorg.fontbitstream75dpi + xorg.fontbitstreamtype1 + ]; + }; + + environment.systemPackages = with pkgs; [ + adapta-gtk-theme + aircrackng + ag + arandr + binutils + chromium + cifs-utils + curl + evince + exfat + feh + file + firefox + freetype + gimp + git + gnupg + graphite2 + hicolor_icon_theme + htop + i3lock + jq + keepassx2 + kvm + lxappearance + man-pages + moc + mpv + mpvc + mupdf + ncdu + nmap + openvpn + pass + p7zip + powertop + ranger + rofi + sshfs + tcpdump + tmux + traceroute + tree + unstable.alacritty + unstable.ponyc + unstable.sublime3 + unstable.youtube-dl + vim + virt-viewer + virtmanager + vulnix + wcalc + wget + wireshark-gtk + xz + ]; + + environment.shellAliases = { + ll = "ls -alh"; + ls = "ls --color=tty"; + }; + + virtualisation.libvirtd.enable = true; + #virtualisation.kvmgt.enable = true; + + programs.gnupg.agent = { + enable = true; + enableSSHSupport = true; + }; + + sound.enable = true; + hardware.pulseaudio.enable = true; + + services.xserver = { + enable = true; + layout = "de"; + xkbVariant = "nodeadkeys"; + libinput.enable = true; + desktopManager = { + default = "xfce"; + xterm.enable = false; + xfce = { + enable = true; + noDesktop = true; + enableXfwm = false; + }; + }; + windowManager.ratpoison.enable = true; + }; + + services.openssh.enable = true; + #services.openssh.permitRootLogin = "yes"; + services.openssh.passwordAuthentication = false; + + networking.networkmanager.enable = false; + #networking.nameservers = [ "8.8.8.8" "141.1.1.1" ]; + networking.enableIPv6 = false; + + programs.fish = { + enable = true; + shellInit = '' + function ssh_agent --description 'launch the ssh-agent and add the id_rsa identity' + if begin + set -q SSH_AGENT_PID + and kill -0 $SSH_AGENT_PID + and grep -q '^ssh-agent' /proc/$SSH_AGENT_PID/cmdline + end + echo "ssh-agent running on pid $SSH_AGENT_PID" + else + eval (command ssh-agent -c | sed 's/^setenv/set -Ux/') + end + set -l identity $HOME/.ssh/id_rsa + set -l fingerprint (ssh-keygen -lf $identity | awk '{print $2}') + ssh-add -l | grep -q $fingerprint + or ssh-add $identity + end + ''; + promptInit = '' + function fish_prompt --description 'Write out the prompt' + set -l color_cwd + set -l suffix + set -l nix_shell_info ( + if test "$IN_NIX_SHELL" != "" + echo -n " <nix-shell>" + end + ) + switch "$USER" + case root toor + if set -q fish_color_cwd_root + set color_cwd $fish_color_cwd_root + else + set color_cwd $fish_color_cwd + end + set suffix '#' + case '*' + set color_cwd $fish_color_cwd + set suffix '>' + end + + echo -n -s "$USER" @ (set_color yellow) (prompt_hostname) (set_color normal) "$nix_shell_info" ' ' (set_color $color_cwd) (prompt_pwd) (set_color normal) "$suffix " + end + ''; + }; + + nix.maxJobs = 4; + nix.buildCores = 4; + system.autoUpgrade.enable = false; + system.autoUpgrade.channel = "https://nixos.org/channels/nixos-19.03"; + system.stateVersion = "19.03"; + +} diff --git a/mb/1systems/orange/hardware-configuration.nix b/mb/1systems/orange/hardware-configuration.nix new file mode 100644 index 000000000..8aa191269 --- /dev/null +++ b/mb/1systems/orange/hardware-configuration.nix @@ -0,0 +1,28 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, ... }: + +{ + imports = + [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix> + ]; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ohci_pci" "ehci_pci" "pata_atiixp" "usb_storage" "usbhid" "sd_mod" "sr_mod" ]; + boot.kernelModules = [ "kvm-amd" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/b1d32c54-35f8-4bf1-9fd2-82adc760af01"; + fsType = "btrfs"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/BF9B-03A2"; + fsType = "vfat"; + }; + + swapDevices = [ ]; + + nix.maxJobs = lib.mkDefault 4; +} diff --git a/mb/1systems/p1nk/configuration.nix b/mb/1systems/p1nk/configuration.nix new file mode 100644 index 000000000..28a7c7776 --- /dev/null +++ b/mb/1systems/p1nk/configuration.nix @@ -0,0 +1,223 @@ +{ config, pkgs, callPackage, ... }: let + unstable = import <nixpkgs-unstable> { config = { allowUnfree = true; }; }; +in { + imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + <stockholm/mb> + ]; + + krebs.build.host = config.krebs.hosts.p1nk; + + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + boot.initrd.luks.devices = [ + { + name = "root"; + device = "/dev/disk/by-uuid/0392257b-f6cf-484d-8c46-e20aab4fddb7"; + preLVM = true; + allowDiscards = true; + } + ]; + fileSystems."/".options = [ "noatime" "nodiratime" "discard" ]; + fileSystems."/mnt/public" = { + device = "//192.168.88.252/public"; + fsType = "cifs"; + options = let + automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s"; + in [ "${automount_opts},user,rw,username=mb0,iocharset=utf8,credentials=${config.users.users.mb.home}/.smbcredentials" ]; + }; + + networking.wireless.enable = true; + + i18n = { + consoleFont = "Lat2-Terminus16"; + consoleKeyMap = "de"; + defaultLocale = "en_US.UTF-8"; + }; + + time.timeZone = "Europe/Berlin"; + + fonts = { + enableCoreFonts = true; + enableGhostscriptFonts = true; + fonts = with pkgs; [ + anonymousPro + corefonts + dejavu_fonts + envypn-font + fira + gentium + gohufont + inconsolata + liberation_ttf + powerline-fonts + source-code-pro + terminus_font + ttf_bitstream_vera + ubuntu_font_family + unifont + unstable.cherry + xorg.fontbitstream100dpi + xorg.fontbitstream75dpi + xorg.fontbitstreamtype1 + ]; + }; + + nixpkgs.config.packageOverrides = super: { + openvpn = super.openvpn.override { pkcs11Support = true; useSystemd = false; }; + }; + + nixpkgs.config.allowUnfree = true; + + environment.systemPackages = with pkgs; [ + adapta-gtk-theme + aircrackng + ag + arandr + binutils + chromium + cifs-utils + curl + evince + exfat + feh + file + firefox + freetype + gimp + git + gnupg + graphite2 + hicolor_icon_theme + htop + i3lock + jq + keepassx2 + kvm + lxappearance + man-pages + moc + mpv + mpvc + mupdf + ncdu + nmap + openvpn + pass + p7zip + powertop + ranger + rofi + sshfs + tcpdump + tmux + traceroute + tree + unstable.alacritty + unstable.ponyc + unstable.sublime3 + youtube-dl + vim + virt-viewer + virtmanager + vulnix + wcalc + wget + xz + ]; + + environment.shellAliases = { + ll = "ls -alh"; + ls = "ls --color=tty"; + }; + + virtualisation.libvirtd.enable = true; + virtualisation.kvmgt.enable = true; + + programs.gnupg.agent = { + enable = true; + enableSSHSupport = true; + }; + + sound.enable = true; + hardware.pulseaudio.enable = true; + + services.xserver = { + enable = true; + layout = "de"; + xkbOptions = "neo"; + libinput.enable = true; + desktopManager = { + default = "xfce"; + xterm.enable = false; + xfce = { + enable = true; + noDesktop = true; + enableXfwm = false; + }; + }; + windowManager.ratpoison.enable = true; + }; + + services.openssh.enable = true; + services.openssh.passwordAuthentication = false; + + networking.networkmanager.enable = false; + networking.nameservers = [ "8.8.8.8" "141.1.1.1" ]; + networking.enableIPv6 = false; + + programs.fish = { + enable = true; + shellInit = '' + function ssh_agent --description 'launch the ssh-agent and add the id_rsa identity' + if begin + set -q SSH_AGENT_PID + and kill -0 $SSH_AGENT_PID + and grep -q '^ssh-agent' /proc/$SSH_AGENT_PID/cmdline + end + echo "ssh-agent running on pid $SSH_AGENT_PID" + else + eval (command ssh-agent -c | sed 's/^setenv/set -Ux/') + end + set -l identity $HOME/.ssh/id_rsa + set -l fingerprint (ssh-keygen -lf $identity | awk '{print $2}') + ssh-add -l | grep -q $fingerprint + or ssh-add $identity + end + ''; + promptInit = '' + function fish_prompt --description 'Write out the prompt' + set -l color_cwd + set -l suffix + set -l nix_shell_info ( + if test "$IN_NIX_SHELL" != "" + echo -n " <nix-shell>" + end + ) + switch "$USER" + case root toor + if set -q fish_color_cwd_root + set color_cwd $fish_color_cwd_root + else + set color_cwd $fish_color_cwd + end + set suffix '#' + case '*' + set color_cwd $fish_color_cwd + set suffix '>' + end + + echo -n -s "$USER" @ (set_color magenta) (prompt_hostname) (set_color normal) "$nix_shell_info" ' ' (set_color $color_cwd) (prompt_pwd) (set_color normal) "$suffix " + end + ''; + }; + + nix.maxJobs = 4; + nix.buildCores = 4; + system.autoUpgrade.enable = false; + system.autoUpgrade.channel = "https://nixos.org/channels/nixos-19.03"; + system.stateVersion = "19.03"; + +} diff --git a/mb/1systems/p1nk/hardware-configuration.nix b/mb/1systems/p1nk/hardware-configuration.nix new file mode 100644 index 000000000..ab5b6e204 --- /dev/null +++ b/mb/1systems/p1nk/hardware-configuration.nix @@ -0,0 +1,29 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, ... }: + +{ + imports = + [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix> + ]; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/4cc2add6-ed19-4685-bbd9-b992bd8d51fb"; + fsType = "btrfs"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/9F87-AEAA"; + fsType = "vfat"; + }; + + swapDevices = [ ]; + + nix.maxJobs = lib.mkDefault 4; + powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; +} diff --git a/mb/2configs/default.nix b/mb/2configs/default.nix new file mode 100644 index 000000000..75189e192 --- /dev/null +++ b/mb/2configs/default.nix @@ -0,0 +1,198 @@ +with import <stockholm/lib>; +{ config, pkgs, ... }: +{ + imports = [ + { + users.users = { + root = { + openssh.authorizedKeys.keys = [ + config.krebs.users.mb.pubkey + ]; + }; + mb = { + name = "mb"; + uid = 1337; + home = "/home/mb"; + group = "users"; + createHome = true; + shell = "/run/current-system/sw/bin/fish"; + extraGroups = [ + "audio" + "video" + "fuse" + "wheel" + ]; + openssh.authorizedKeys.keys = [ + config.krebs.users.mb.pubkey + ]; + }; + }; + } + { + environment.variables = { + NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src"; + }; + } + (let ca-bundle = "/etc/ssl/certs/ca-bundle.crt"; in { + environment.variables = { + CURL_CA_BUNDLE = ca-bundle; + GIT_SSL_CAINFO = ca-bundle; + SSL_CERT_FILE = ca-bundle; + }; + }) + ]; + + networking.hostName = config.krebs.build.host.name; + + krebs = { + enable = true; + build.user = config.krebs.users.mb; + }; + + users.mutableUsers = false; |