From 2b3030c7b27f98b8f00d91c63bd60c980e64071b Mon Sep 17 00:00:00 2001 From: makefu Date: Fri, 24 Jul 2015 10:52:43 +0200 Subject: makefu: init pnp this is the first entry for my hosts, it provides only very basic support with a lot of copy-paste from tv/lass --- 0make/makefu/pnp.makefile | 4 +- 1systems/makefu/pnp.nix | 38 ++++++++++++++++++ 2configs/makefu/base.nix | 96 ++++++++++++++++++++++++++++++++++++++++++++ Zpubkeys/makefu.ssh.pub | 1 - Zpubkeys/makefu_arch.ssh.pub | 1 + 5 files changed, 137 insertions(+), 3 deletions(-) create mode 100644 2configs/makefu/base.nix delete mode 100644 Zpubkeys/makefu.ssh.pub create mode 100644 Zpubkeys/makefu_arch.ssh.pub diff --git a/0make/makefu/pnp.makefile b/0make/makefu/pnp.makefile index c2099f748..a18efe0e0 100644 --- a/0make/makefu/pnp.makefile +++ b/0make/makefu/pnp.makefile @@ -1,4 +1,4 @@ -deploy_host := root@uriel +deploy_host := root@pnp nixpkgs_url := https://github.com/nixos/nixpkgs -nixpkgs_rev := 961fcbabd7643171ea74bd550fee1ce5c13c2e90 +nixpkgs_rev := 4c01e6d91993b6de128795f4fbdd25f6227fb870 secrets_dir := /home/makefu/secrets/pnp diff --git a/1systems/makefu/pnp.nix b/1systems/makefu/pnp.nix index e69de29bb..51f5bb00c 100644 --- a/1systems/makefu/pnp.nix +++ b/1systems/makefu/pnp.nix @@ -0,0 +1,38 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running ‘nixos-help’). + +{ config, pkgs, ... }: + +{ + imports = + [ # Include the results of the hardware scan. + + ../../2configs/makefu/base.nix + ]; + boot.loader.grub.enable = true; + boot.loader.grub.version = 2; + boot.loader.grub.device = "/dev/vda"; + + boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "ehci_pci" "virtio_pci" "virtio_blk" ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + hardware.enableAllFirmware = true; + hardware.cpu.amd.updateMicrocode = true; + + fileSystems."/" = + { device = "/dev/disk/by-label/nixos"; + fsType = "ext4"; + }; + + nix.maxJobs = 1; + networking.hostName = "pnp"; # Define your hostname. + +# $ nix-env -qaP | grep wget + environment.systemPackages = with pkgs; [ + wget + git + gnumake + ]; + +} diff --git a/2configs/makefu/base.nix b/2configs/makefu/base.nix new file mode 100644 index 000000000..ab2e6f247 --- /dev/null +++ b/2configs/makefu/base.nix @@ -0,0 +1,96 @@ +{ config, lib, pkgs, ... }: + +with lib; +{ + imports = [ ]; + users.extraUsers = { + root = { + openssh.authorizedKeys.keys = map readFile [ + ../../Zpubkeys/makefu_arch.ssh.pub + ]; + }; + makefu = { + uid = 9001; + group = "users"; + home = "/home/makefu"; + createHome = true; + useDefaultShell = true; + extraGroups = [ + "wheel" + ]; + openssh.authorizedKeys.keys = map readFile [ + ../../Zpubkeys/makefu_arch.ssh.pub + ]; + }; + }; + + services.openssh.enable = true; + nix.useChroot = true; + + users.mutableUsers = true; + + boot.tmpOnTmpfs = true; + systemd.tmpfiles.rules = [ + "d /tmp 1777 root root - -" + ]; + + environment.extraInit = '' + EDITOR=vim + ''; + + environment.systemPackages = with pkgs; [ + git + vim + rxvt_unicode.terminfo + ]; + + programs.bash = { + enableCompletion = true; + interactiveShellInit = '' + HISTCONTROL='erasedups:ignorespace' + HISTSIZE=900001 + HISTFILESIZE=$HISTSIZE + + shopt -s checkhash + shopt -s histappend histreedit histverify + shopt -s no_empty_cmd_completion + complete -d cd + + ''; + promptInit = '' + case $UID in + 0) PS1='\[\e[1;31m\]\w\[\e[0m\] ' ;; + 9001) PS1='\[\e[1;32m\]\w\[\e[0m\] ' ;; + *) PS1='\[\e[1;35m\]\u \[\e[1;32m\]\w\[\e[0m\] ' ;; + esac + if test -n "$SSH_CLIENT"; then + PS1='\[\033[35m\]\h'" $PS1" + fi + ''; + }; + environment.shellAliases = { + lsl = "ls -latr"; + }; + + security.setuidPrograms = [ "sendmail" ]; + + services.journald.extraConfig = '' + SystemMaxUse=1G + RuntimeMaxUse=128M + ''; + nixpkgs.config.packageOverrides = pkgs: { + nano = pkgs.runCommand "empty" {} "mkdir -p $out"; + }; + services.cron.enable = false; + services.nscd.enable = false; + boot.kernel.sysctl = { +# Enable IPv6 Privacy Extensions + "net.ipv6.conf.all.use_tempaddr" = 2; + "net.ipv6.conf.default.use_tempaddr" = 2; + }; + i18n = { + consoleKeyMap = "us"; + defaultLocale = "en_US.UTF-8"; + }; + +} diff --git a/Zpubkeys/makefu.ssh.pub b/Zpubkeys/makefu.ssh.pub deleted file mode 100644 index 6092ec469..000000000 --- a/Zpubkeys/makefu.ssh.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCl3RTOHd5DLiVeUbUr/GSiKoRWknXQnbkIf+uNiFO+XxiqZVojPlumQUVhasY8UzDzj9tSDruUKXpjut50FhIO5UFAgsBeMJyoZbgY/+R+QKU00Q19+IiUtxeFol/9dCO+F4o937MC0OpAC10LbOXN/9SYIXueYk3pJxIycXwUqhYmyEqtDdVh9Rx32LBVqlBoXRHpNGPLiswV2qNe0b5p919IGcslzf1XoUzfE3a3yjk/XbWh/59xnl4V7Oe7+iQheFxOT6rFA30WYwEygs5As//ZYtxvnn0gA02gOnXJsNjOW9irlxOUeP7IOU6Ye3WRKFRR0+7PS+w8IJLag2xb makefu@pornocauster diff --git a/Zpubkeys/makefu_arch.ssh.pub b/Zpubkeys/makefu_arch.ssh.pub new file mode 100644 index 000000000..6092ec469 --- /dev/null +++ b/Zpubkeys/makefu_arch.ssh.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCl3RTOHd5DLiVeUbUr/GSiKoRWknXQnbkIf+uNiFO+XxiqZVojPlumQUVhasY8UzDzj9tSDruUKXpjut50FhIO5UFAgsBeMJyoZbgY/+R+QKU00Q19+IiUtxeFol/9dCO+F4o937MC0OpAC10LbOXN/9SYIXueYk3pJxIycXwUqhYmyEqtDdVh9Rx32LBVqlBoXRHpNGPLiswV2qNe0b5p919IGcslzf1XoUzfE3a3yjk/XbWh/59xnl4V7Oe7+iQheFxOT6rFA30WYwEygs5As//ZYtxvnn0gA02gOnXJsNjOW9irlxOUeP7IOU6Ye3WRKFRR0+7PS+w8IJLag2xb makefu@pornocauster -- cgit v1.2.3 [cgit] Unable to lock slot /tmp/cgit/98200000.lock: No such file or directory (2)