From 3b2cb2a3f73ad58c489ae854f829d5a4bf723e17 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 15 Apr 2016 14:39:03 +0200 Subject: l 2: base.nix -> default.nix --- lass/2configs/default.nix | 200 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 200 insertions(+) create mode 100644 lass/2configs/default.nix (limited to 'lass/2configs/default.nix') diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix new file mode 100644 index 000000000..8c6078ba5 --- /dev/null +++ b/lass/2configs/default.nix @@ -0,0 +1,200 @@ +{ config, lib, pkgs, ... }: + +with config.krebs.lib; +{ + imports = [ + ../2configs/vim.nix + ../2configs/zsh.nix + ../2configs/mc.nix + ../2configs/retiolum.nix + ./backups.nix + { + users.extraUsers = + mapAttrs (_: h: { hashedPassword = h; }) + (import ); + } + { + users.extraUsers = { + root = { + openssh.authorizedKeys.keys = [ + config.krebs.users.lass.pubkey + config.krebs.users.lass-uriel.pubkey + ]; + }; + mainUser = { + name = "lass"; + uid = 1337; + home = "/home/lass"; + group = "users"; + createHome = true; + useDefaultShell = true; + extraGroups = [ + ]; + openssh.authorizedKeys.keys = [ + config.krebs.users.lass.pubkey + config.krebs.users.lass-uriel.pubkey + ]; + }; + }; + } + ]; + + networking.hostName = config.krebs.build.host.name; + nix.maxJobs = config.krebs.build.host.cores; + + krebs = { + enable = true; + search-domain = "retiolum"; + build = { + user = config.krebs.users.lass; + source = mapAttrs (_: mkDefault) ({ + nixos-config = "symlink:stockholm/lass/1systems/${config.krebs.build.host.name}.nix"; + secrets = "/home/lass/secrets/${config.krebs.build.host.name}"; + #secrets-common = "/home/lass/secrets/common"; + stockholm = "/home/lass/stockholm"; + nixpkgs = { + url = https://github.com/NixOS/nixpkgs; + rev = "e781a8257b4312f6b138c7d0511c77d8c06ed819"; + dev = "/home/lass/src/nixpkgs"; + }; + } // optionalAttrs config.krebs.build.host.secure { + #secrets-master = "/home/lass/secrets/master"; + }); + }; + }; + + nix.useChroot = true; + + users.mutableUsers = false; + + services.timesyncd.enable = true; + + #why is this on in the first place? + services.nscd.enable = false; + + boot.tmpOnTmpfs = true; + # see tmpfiles.d(5) + systemd.tmpfiles.rules = [ + "d /tmp 1777 root root - -" + ]; + + # multiple-definition-problem when defining environment.variables.EDITOR + environment.extraInit = '' + EDITOR=vim + MANPAGER=most + ''; + + nixpkgs.config.allowUnfree = true; + + environment.systemPackages = with pkgs; [ + #stockholm + git + gnumake + jq + parallel + proot + + #style + most + rxvt_unicode.terminfo + + #monitoring tools + htop + iotop + + #network + iptables + + #stuff for dl + aria2 + + #neat utils + krebspaste + + #unpack stuff + p7zip + unzip + unrar + ]; + + programs.bash = { + enableCompletion = true; + interactiveShellInit = '' + HISTCONTROL='erasedups:ignorespace' + HISTSIZE=65536 + HISTFILESIZE=$HISTSIZE + + shopt -s checkhash + shopt -s histappend histreedit histverify + shopt -s no_empty_cmd_completion + complete -d cd + + #fancy colors + if [ -e ~/LS_COLORS ]; then + eval $(dircolors ~/LS_COLORS) + fi + + if [ -e /etc/nixos/dotfiles/link ]; then + /etc/nixos/dotfiles/link + fi + ''; + promptInit = '' + if test $UID = 0; then + PS1='\[\033[1;31m\]\w\[\033[0m\] ' + elif test $UID = 1337; then + PS1='\[\033[1;32m\]\w\[\033[0m\] ' + else + PS1='\[\033[1;33m\]\u@\w\[\033[0m\] ' + fi + if test -n "$SSH_CLIENT"; then + PS1='\[\033[35m\]\h'" $PS1" + fi + ''; + }; + + services.openssh = { + enable = true; + hostKeys = [ + # XXX bits here make no science + { bits = 8192; type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; } + ]; + }; + + services.journald.extraConfig = '' + SystemMaxUse=1G + RuntimeMaxUse=128M + ''; + + krebs.iptables = { + enable = true; + tables = { + nat.PREROUTING.rules = [ + { predicate = "! -i retiolum -p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; precedence = 100; } + { predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 99; } + ]; + nat.OUTPUT.rules = [ + { predicate = "-o lo -p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 100; } + ]; + filter.INPUT.policy = "DROP"; + filter.FORWARD.policy = "DROP"; + filter.INPUT.rules = [ + { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; precedence = 10001; } + { predicate = "-p icmp"; target = "ACCEPT"; precedence = 10000; } + { predicate = "-i lo"; target = "ACCEPT"; precedence = 9999; } + { predicate = "-p tcp --dport 22"; target = "ACCEPT"; precedence = 9998; } + { predicate = "-i retiolum"; target = "REJECT"; precedence = -10000; } + ]; + }; + }; + + networking.dhcpcd.extraConfig = '' + noipv4ll + ''; + + #CVE-2016-0777 and CVE-2016-0778 workaround + #https://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-0778/openssh-cve-2016-0777-cve-2016-0778.txt + programs.ssh.extraConfig = '' + UseRoaming no + ''; + +} -- cgit v1.2.3 From b8aee5d8f5c325f7b3b01201aadbe048aa2e5bda Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 20 Apr 2016 13:58:10 +0200 Subject: l 2 default: add iftop to pkgs --- lass/2configs/default.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'lass/2configs/default.nix') diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix index 8c6078ba5..2f6ffa18e 100644 --- a/lass/2configs/default.nix +++ b/lass/2configs/default.nix @@ -104,6 +104,7 @@ with config.krebs.lib; #network iptables + iftop #stuff for dl aria2 -- cgit v1.2.3 From 22627e6ce73a03fcb909da532bc0ce982d350ad2 Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 4 May 2016 17:20:15 +0200 Subject: l 2 default: add psmisc to pkgs --- lass/2configs/default.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'lass/2configs/default.nix') diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix index 2f6ffa18e..c03e966d5 100644 --- a/lass/2configs/default.nix +++ b/lass/2configs/default.nix @@ -111,6 +111,7 @@ with config.krebs.lib; #neat utils krebspaste + psmisc #unpack stuff p7zip -- cgit v1.2.3 From 8e095afefce800a60cdd0cd574dd66058c080a4b Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 20 May 2016 00:03:48 +0200 Subject: l 2 nixpkgs: e781a82 -> d541e0d --- lass/2configs/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lass/2configs/default.nix') diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix index c03e966d5..29938e35c 100644 --- a/lass/2configs/default.nix +++ b/lass/2configs/default.nix @@ -54,7 +54,7 @@ with config.krebs.lib; stockholm = "/home/lass/stockholm"; nixpkgs = { url = https://github.com/NixOS/nixpkgs; - rev = "e781a8257b4312f6b138c7d0511c77d8c06ed819"; + rev = "d541e0dc1c05f5514bf30f8039e687adddb45616"; dev = "/home/lass/src/nixpkgs"; }; } // optionalAttrs config.krebs.build.host.secure { -- cgit v1.2.3 From 3fea8d651f49ac6a57f99bc6b49a5689e3c74fd8 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 20 May 2016 00:12:43 +0200 Subject: l: add untilport --- lass/2configs/default.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'lass/2configs/default.nix') diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix index 29938e35c..e38503f1a 100644 --- a/lass/2configs/default.nix +++ b/lass/2configs/default.nix @@ -112,6 +112,7 @@ with config.krebs.lib; #neat utils krebspaste psmisc + untilport #unpack stuff p7zip -- cgit v1.2.3 From a6d654ef31d7f832e4cd4774ac22b311f9eae2c1 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 21 May 2016 13:51:06 +0200 Subject: l 2: add shodan to authorizedKeys --- lass/2configs/default.nix | 2 ++ 1 file changed, 2 insertions(+) (limited to 'lass/2configs/default.nix') diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix index e38503f1a..ee320b9c9 100644 --- a/lass/2configs/default.nix +++ b/lass/2configs/default.nix @@ -19,6 +19,7 @@ with config.krebs.lib; openssh.authorizedKeys.keys = [ config.krebs.users.lass.pubkey config.krebs.users.lass-uriel.pubkey + config.krebs.users.lass-shodan.pubkey ]; }; mainUser = { @@ -33,6 +34,7 @@ with config.krebs.lib; openssh.authorizedKeys.keys = [ config.krebs.users.lass.pubkey config.krebs.users.lass-uriel.pubkey + config.krebs.users.lass-shodan.pubkey ]; }; }; -- cgit v1.2.3