From 4ba8fd95d5d4fd63acc61e9adddf771eda0fef02 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 20 Apr 2019 18:54:58 +0200 Subject: tv pki: immigrate certificate environment --- tv/2configs/default.nix | 10 +--------- tv/2configs/pki/default.nix | 14 ++++++++++++++ 2 files changed, 15 insertions(+), 9 deletions(-) create mode 100644 tv/2configs/pki/default.nix diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index ac0a6af..4fc755c 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -17,6 +17,7 @@ with import ; ./bash ./htop.nix ./nginx + ./pki ./ssh.nix ./sshd.nix ./vim.nix @@ -90,15 +91,6 @@ with import ; }; } - { - environment.variables = - flip genAttrs (_: "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt") [ - "CURL_CA_BUNDLE" - "GIT_SSL_CAINFO" - "SSL_CERT_FILE" - ]; - } - { services.cron.enable = false; services.nscd.enable = false; diff --git a/tv/2configs/pki/default.nix b/tv/2configs/pki/default.nix new file mode 100644 index 0000000..f22b9a6 --- /dev/null +++ b/tv/2configs/pki/default.nix @@ -0,0 +1,14 @@ +with import ; +{ config, ... }: let + + certFile = config.environment.etc."ssl/certs/ca-certificates.crt".source; + +in { + + environment.variables = flip genAttrs (_: toString certFile) [ + "CURL_CA_BUNDLE" + "GIT_SSL_CAINFO" + "SSL_CERT_FILE" + ]; + +} -- cgit v1.2.3 From 6000f4f348069910f3e9bf2b31d9301f1e02c23b Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 21 Apr 2019 09:19:37 +0200 Subject: tv pki: import custom certificates --- tv/2configs/pki/default.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tv/2configs/pki/default.nix b/tv/2configs/pki/default.nix index f22b9a6..9e7f476 100644 --- a/tv/2configs/pki/default.nix +++ b/tv/2configs/pki/default.nix @@ -11,4 +11,10 @@ in { "SSL_CERT_FILE" ]; + security.pki.certificateFiles = + mapAttrsToList + (name: const (./certs + "/${name}")) + (filterAttrs (const (eq "regular")) + (readDir ./certs)); + } -- cgit v1.2.3 From 0e4485da4d1858523483bb6750daeacbe3378e61 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 21 Apr 2019 09:20:36 +0200 Subject: tv pki: add tv Root CA --- tv/2configs/pki/certs/tv.crt | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 tv/2configs/pki/certs/tv.crt diff --git a/tv/2configs/pki/certs/tv.crt b/tv/2configs/pki/certs/tv.crt new file mode 100644 index 0000000..ccb2623 --- /dev/null +++ b/tv/2configs/pki/certs/tv.crt @@ -0,0 +1,31 @@ +tv Root CA +-----BEGIN CERTIFICATE----- +MIIFGzCCAwOgAwIBAgIUbLFkDA1OgKbej/FQiJZ4gpGPg/4wDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKdHYgUm9vdCBDQTAeFw0xOTA0MjEwNzI1MTdaFw0yOTA0 +MTgwNzI1MTdaMBUxEzARBgNVBAMMCnR2IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEB +AQUAA4ICDwAwggIKAoICAQDEVpZo1PLayK2AULwNtRY/2RIs/h+Uz1k/I7AY5o7H +HTD6pxNH3DZS82Y89nAHDVEnotK26TW6N1O2fBHUxH2GXVD+MaA/D9ngbNTJa7DW +2EThezOyesAbXk7dkoHh4Bouj5L7Ronka5+IREFmb3mHmcXLuR/sot9Pwr9A7Lwm +55Avv+VwMFnqVMXiCYQsDL7Mxf7Vm79+kXShpfDhNmHhyZc/xPjVk7lttSEp0LCq +hhJjte3xDGbk7OThTSxoqP+K4Ek7NGatCcm4AUZlDl1kLN2QKudYqj0VRQpfE+4Q +jMAAtttc/10MV0e08pRK0FvJsDsi70YZrHnDP6hIBrRNjC8iB/8rz2pjnYzgriUt +HHEDr26234VB5Zqhsi8pmXA16FVkoKlucADXXKEcR/3VreTvZLdSsP3OrDdSCwhi +H2W/7tshDPp+I9Q9fGNixry7PODbud1h/wLsq3Geg/U6VkDdl7uDNMB/O7LvlFaC +7jkHv/xFLqV1Xx9+yFMdJTKLf9jnIIjeINfV4VcJZDrtgGpnC6cYD5DNLA4j7Mny +EnBV9IRhmKiZLvUZP62dPhqIfSSPNxXV2+rT5ZfaXCuVe79R5npgJzF7/qslvnZ6 +0mjZfQdJiXY+/oT9zPUxTroFx7Qtda15aIVwXR+1cMRY/Hg/uBQyp7yWsvwhPYwH +awIDAQABo2MwYTAdBgNVHQ4EFgQUWYjGpR7J/UqggxQV87hBQ8ZT0qkwHwYDVR0j +BBgwFoAUWYjGpR7J/UqggxQV87hBQ8ZT0qkwDwYDVR0TAQH/BAUwAwEB/zAOBgNV +HQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADggIBAA++eAA7KLEd4n05n8w95sJ7 +cxqQSkVxV3ASnEUQRwVGo3CqEKcNufbCTG7KKGQFUi2Xd3/SWgnEiSZZWo06azbV +vlquG+9ilwnrnqfjlbUEjLMHDzukrEeIiRuFY7gZv6S2o4WkW/M9IPkP34+PRjip +AJ8kFcy7wLPaeH7OagslAVUcf68lMm+8W4U1g0HZaY2zXFgdRrIO1dXKlJ22Wh4X +fcblHjkASAGi+BK+xRJ9G7s3sie2wPyk+WKKv0Z+WheKf+L+TPBg2sJ+d25gW+gG +XNJSQOzCqSfHrCtcW1xkGgifog28/ymN03ggn8oMBUebOp+ayLkbPQDaj6te3y1v +YE0cfkzQ0T6sSzPzoOrwBEuSX8cLWTpzO2Zgqbf36UtHjgxi58vY46p7MjAInxAf +j+k67rF7qWH38drg4nfGjNgiEdeJw9dtDFdmso+ZiWipUyGF4VYh+Q6JnXDMF0+A +wXcYWa7ckXvVOLVpHJfrLDYTXznGnk2u4ToVNEk1j/klMRn96lxfFg04iv8fz8m6 +/Y8g0G1uIT5Mq9l68oZUoEkUHZabPNhYOiYtg4t5v/T3AIV8nm2A5jZYj0am26xT +iqF/tqL3alWXs9OHP7FNdrVWtwO8vcspYcd4mOHdAC/dmhq+77BowR5Lldx9T+mR +QT8jW9PXL0IH0wKMBXxf +-----END CERTIFICATE----- -- cgit v1.2.3 From 7eb10dc182e46a5f9d97bc010a6567e7f23c7df0 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 23 Apr 2019 19:57:23 +0200 Subject: tv pki: generate global nssdb --- tv/2configs/pki/default.nix | 50 ++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 49 insertions(+), 1 deletion(-) diff --git a/tv/2configs/pki/default.nix b/tv/2configs/pki/default.nix index 9e7f476..51a5c71 100644 --- a/tv/2configs/pki/default.nix +++ b/tv/2configs/pki/default.nix @@ -1,10 +1,58 @@ with import ; -{ config, ... }: let +{ config, pkgs, ... }: let certFile = config.environment.etc."ssl/certs/ca-certificates.crt".source; in { + environment.etc."pki/nssdb".source = + pkgs.runCommand "system-wide-nssdb" { + inherit certFile; + buildInputs = [ + pkgs.jq + pkgs.nssTools + ]; + parseInfoScript = /* jq */ '' + ${toJSON certFile} as $certFile | + + split("\t-----END CERTIFICATE-----\n")[] | + select(test("\t-----BEGIN CERTIFICATE-----\n")) | + . + "\t-----END CERTIFICATE-----\n" | + + sub("^([0-9]+\t\n)*";"") | + + (match("^([0-9]+)\t").captures[0].string | tonumber) as $lineNumber | + + gsub("(?m)^[0-9]+\t";"") | + + match("^([^\n]+)\n(.*)";"m").captures | map(.string) | + + # Line numbers are added to the names to ensure uniqueness. + "\(.[0]) (\($certFile):\($lineNumber))" as $name | + .[1] as $cert | + + { $name, $cert } + ''; + passAsFile = [ + "parseInfoScript" + ]; + } /* sh */ '' + mkdir nssdb + + nl -ba -w1 "$certFile" | + jq -ceRs -f "$parseInfoScriptPath" > certinfo.ndjson + + exec < certinfo.ndjson + while read -r certinfo; do + name=$(printf %s "$certinfo" | jq -er .name) + cert=$(printf %s "$certinfo" | jq -er .cert) + + printf %s "$cert" | certutil -A -d nssdb -n "$name" -t C,C,C + done + + mv nssdb "$out" + ''; + environment.variables = flip genAttrs (_: toString certFile) [ "CURL_CA_BUNDLE" "GIT_SSL_CAINFO" -- cgit v1.2.3 From d67a807683da3e399a13078a338a8247719ec1dd Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 24 Apr 2019 23:44:37 +0200 Subject: tv: add Xresources module --- tv/2configs/xserver/Xresources.nix | 116 +++++++++++++++++++------------------ tv/2configs/xserver/default.nix | 5 +- tv/3modules/Xresources.nix | 39 +++++++++++++ tv/3modules/default.nix | 1 + 4 files changed, 103 insertions(+), 58 deletions(-) create mode 100644 tv/3modules/Xresources.nix diff --git a/tv/2configs/xserver/Xresources.nix b/tv/2configs/xserver/Xresources.nix index d032efc..679b77d 100644 --- a/tv/2configs/xserver/Xresources.nix +++ b/tv/2configs/xserver/Xresources.nix @@ -1,58 +1,60 @@ -{ config, lib, pkgs, ... }: - with import ; - -pkgs.writeText "Xresources" /* xdefaults */ '' - URxvt*cutchars: "\\`\"'&()*,;<=>?@[]^{|}‘’" - URxvt*eightBitInput: false - URxvt*font: -*-clean-*-*-*-*-*-*-*-*-*-*-iso10646-1 - URxvt*boldFont: -*-clean-*-*-*-*-*-*-*-*-*-*-iso10646-1 - URxvt*scrollBar: false - URxvt*background: #050505 - URxvt*foreground: #d0d7d0 - URxvt*cursorColor: #f042b0 - URxvt*cursorColor2: #f0b000 - URxvt*cursorBlink: off - URxvt*jumpScroll: true - URxvt*allowSendEvents: false - URxvt*charClass: 33:48,37:48,45-47:48,64:48,38:48,61:48,63:48 - URxvt*cutNewline: False - URxvt*cutToBeginningOfLine: False - - URxvt*color0: #232342 - URxvt*color3: #c07000 - URxvt*color4: #4040c0 - URxvt*color7: #c0c0c0 - URxvt*color8: #707070 - URxvt*color9: #ff6060 - URxvt*color10: #70ff70 - URxvt*color11: #ffff70 - URxvt*color12: #7070ff - URxvt*color13: #ff50ff - URxvt*color14: #70ffff - URxvt*color15: #ffffff - - URxvt*iso14755: False - - URxvt*urgentOnBell: True - URxvt*visualBell: True - - ! ref https://github.com/muennich/urxvt-perls - URxvt*perl-ext: default,url-select - URxvt*keysym.M-u: perl:url-select:select_next - URxvt*url-select.launcher: /etc/per-user/${config.krebs.build.user.name}/bin/ff -new-tab - URxvt*url-select.underline: true - URxvt*colorUL: #4682B4 - URxvt.perl-lib: ${pkgs.urxvt_perls}/lib/urxvt/perl - URxvt*saveLines: 10000 - - root-urxvt*background: #230000 - root-urxvt*foreground: #e0c0c0 - root-urxvt*BorderColor: #400000 - root-urxvt*color0: #800000 - - fzmenu-urxvt*background: rgb:42/23/42 - fzmenu-urxvt*externalBorder: 1 - fzmenu-urxvt*geometry: 70x9 - fzmenu-urxvt*internalBorder: 1 -'' +{ config, pkgs, ... }: { + + tv.Xresources = { + "URxvt*cutchars" = ''"\\`\"'&()*,;<=>?@[]^{|}‘’"''; + "URxvt*eightBitInput" = "false"; + "URxvt*font" = "-*-clean-*-*-*-*-*-*-*-*-*-*-iso10646-1"; + "URxvt*boldFont" = "-*-clean-*-*-*-*-*-*-*-*-*-*-iso10646-1"; + "URxvt*scrollBar" = "false"; + "URxvt*background" = "#050505"; + "URxvt*foreground" = "#d0d7d0"; + "URxvt*cursorColor" = "#f042b0"; + "URxvt*cursorColor2" = "#f0b000"; + "URxvt*cursorBlink" = "off"; + "URxvt*jumpScroll" = "true"; + "URxvt*allowSendEvents" = "false"; + "URxvt*charClass" = "33:48,37:48,45-47:48,64:48,38:48,61:48,63:48"; + "URxvt*cutNewline" = "False"; + "URxvt*cutToBeginningOfLine" = "False"; + + "URxvt*color0" = "#232342"; + "URxvt*color3" = "#c07000"; + "URxvt*color4" = "#4040c0"; + "URxvt*color7" = "#c0c0c0"; + "URxvt*color8" = "#707070"; + "URxvt*color9" = "#ff6060"; + "URxvt*color10" = "#70ff70"; + "URxvt*color11" = "#ffff70"; + "URxvt*color12" = "#7070ff"; + "URxvt*color13" = "#ff50ff"; + "URxvt*color14" = "#70ffff"; + "URxvt*color15" = "#ffffff"; + + "URxvt*iso14755" = "False"; + + "URxvt*urgentOnBell" = "True"; + "URxvt*visualBell" = "True"; + + # ref https://github.com/muennich/urxvt-perls + "URxvt*perl-ext" = "default,url-select"; + "URxvt*keysym.M-u" = "perl:url-select:select_next"; + "URxvt*url-select.launcher" = + "/etc/per-user/${config.krebs.build.user.name}/bin/ff -new-tab"; + "URxvt*url-select.underline" = "true"; + "URxvt*colorUL" = "#4682B4"; + "URxvt.perl-lib" = "${pkgs.urxvt_perls}/lib/urxvt/perl"; + "URxvt*saveLines" = "10000"; + + "root-urxvt*background" = "#230000"; + "root-urxvt*foreground" = "#e0c0c0"; + "root-urxvt*BorderColor" = "#400000"; + "root-urxvt*color0" = "#800000"; + + "fzmenu-urxvt*background" = "rgb:42/23/42"; + "fzmenu-urxvt*externalBorder" = "1"; + "fzmenu-urxvt*geometry" = "70x9"; + "fzmenu-urxvt*internalBorder" = "1"; + }; + +} diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix index 051e12e..e216025 100644 --- a/tv/2configs/xserver/default.nix +++ b/tv/2configs/xserver/default.nix @@ -9,6 +9,10 @@ let }; in { + imports = [ + ./Xresources.nix + ]; + environment.systemPackages = [ pkgs.ff pkgs.font-size @@ -73,7 +77,6 @@ in { ${pkgs.xorg.xhost}/bin/xhost -LOCAL: } & ${pkgs.xorg.xmodmap}/bin/xmodmap ${import ./Xmodmap.nix args} & - ${pkgs.xorg.xrdb}/bin/xrdb ${import ./Xresources.nix args} & ${pkgs.xorg.xsetroot}/bin/xsetroot -solid '#1c1c1c' & wait ''; diff --git a/tv/3modules/Xresources.nix b/tv/3modules/Xresources.nix new file mode 100644 index 0000000..983b8bc --- /dev/null +++ b/tv/3modules/Xresources.nix @@ -0,0 +1,39 @@ +with import ; +{ config, pkgs, ... }: let + cfg = { + enable = config.tv.Xresources != {}; + user = config.krebs.build.user; + }; +in { + options.tv.Xresources = mkOption { + default = {}; + type = types.attrsOf types.str; + }; + config = { + nixpkgs.overlays = singleton (self: super: { + tv = super.tv or {} // { + Xresources = + self.writeText "Xresources" + (concatStrings (mapAttrsToList (name: value: /* xdefaults */ '' + ${name}: ${value} + '') config.tv.Xresources)); + }; + }); + systemd.services.${if cfg.enable then "Xresources" else null} = { + wantedBy = [ "graphical.target" ]; + after = [ "xserver.service" ]; + requires = [ "xserver.service" ]; + environment = { + DISPLAY = ":${toString config.services.xserver.display}"; + }; + serviceConfig = { + ExecStart = "${pkgs.xorg.xrdb}/bin/xrdb ${pkgs.tv.Xresources}"; + RemainAfterExit = true; + SyslogIdentifier = "Xresources"; + Type = "oneshot"; + User = cfg.user.name; + WorkingDirectory = cfg.user.home; + }; + }; + }; +} diff --git a/tv/3modules/default.nix b/tv/3modules/default.nix index 67fb3f6..edaf50f 100644 --- a/tv/3modules/default.nix +++ b/tv/3modules/default.nix @@ -7,5 +7,6 @@ ./iptables.nix ./slock.nix ./x0vncserver.nix + ./Xresources.nix ]; } -- cgit v1.2.3 From 1af50676e5ce8262109f7c8efed1e1876f2b4eb0 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 24 Apr 2019 23:47:00 +0200 Subject: tv man: add xorg-docs --- tv/2configs/man.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/tv/2configs/man.nix b/tv/2configs/man.nix index 6534e2c..0a72dce 100644 --- a/tv/2configs/man.nix +++ b/tv/2configs/man.nix @@ -8,5 +8,6 @@ environment.systemPackages = with pkgs; [ manpages posix_man_pages + xorg.xorgdocs ]; } -- cgit v1.2.3 From deade6f2353860ab5e5f6d1d3744451b2a1c9975 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 25 Apr 2019 00:07:31 +0200 Subject: tv Xresources: fix URxvt*url-select.launcher path --- tv/2configs/xserver/Xresources.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tv/2configs/xserver/Xresources.nix b/tv/2configs/xserver/Xresources.nix index 679b77d..84b37f6 100644 --- a/tv/2configs/xserver/Xresources.nix +++ b/tv/2configs/xserver/Xresources.nix @@ -40,7 +40,7 @@ with import ; "URxvt*perl-ext" = "default,url-select"; "URxvt*keysym.M-u" = "perl:url-select:select_next"; "URxvt*url-select.launcher" = - "/etc/per-user/${config.krebs.build.user.name}/bin/ff -new-tab"; + "/etc/profiles/per-user/${config.krebs.build.user.name}/bin/ff -new-tab"; "URxvt*url-select.underline" = "true"; "URxvt*colorUL" = "#4682B4"; "URxvt.perl-lib" = "${pkgs.urxvt_perls}/lib/urxvt/perl"; -- cgit v1.2.3 From ba8d8cf1fe49d6ecc213d6a5a673edad476352fd Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 25 Apr 2019 00:13:47 +0200 Subject: tv Xresources: simplify URxvt*charClass --- tv/2configs/xserver/Xresources.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tv/2configs/xserver/Xresources.nix b/tv/2configs/xserver/Xresources.nix index 84b37f6..4d2520c 100644 --- a/tv/2configs/xserver/Xresources.nix +++ b/tv/2configs/xserver/Xresources.nix @@ -14,7 +14,7 @@ with import ; "URxvt*cursorBlink" = "off"; "URxvt*jumpScroll" = "true"; "URxvt*allowSendEvents" = "false"; - "URxvt*charClass" = "33:48,37:48,45-47:48,64:48,38:48,61:48,63:48"; + "URxvt*charClass" = "33:48,37-38:48,45-47:48,61:48,63-64:48"; "URxvt*cutNewline" = "False"; "URxvt*cutToBeginningOfLine" = "False"; -- cgit v1.2.3 From b94aa28af6ddc3ac1be820d0bf0a1c7ae886f4d9 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 25 Apr 2019 00:15:06 +0200 Subject: tv Xresources: URxvt*modifier = mod1 --- tv/2configs/xserver/Xresources.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/tv/2configs/xserver/Xresources.nix b/tv/2configs/xserver/Xresources.nix index 4d2520c..b6c43b7 100644 --- a/tv/2configs/xserver/Xresources.nix +++ b/tv/2configs/xserver/Xresources.nix @@ -45,6 +45,7 @@ with import ; "URxvt*colorUL" = "#4682B4"; "URxvt.perl-lib" = "${pkgs.urxvt_perls}/lib/urxvt/perl"; "URxvt*saveLines" = "10000"; + "URxvt*modifier" = "mod1"; "root-urxvt*background" = "#230000"; "root-urxvt*foreground" = "#e0c0c0"; -- cgit v1.2.3 From 6213adeb7187be3ddeb76b3d49aee4b2363d9468 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 25 Apr 2019 00:17:25 +0200 Subject: tv: add urxvt config module --- tv/2configs/xserver/Xresources.nix | 61 ------------------------------- tv/2configs/xserver/default.nix | 15 +------- tv/2configs/xserver/urxvt.nix | 73 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 74 insertions(+), 75 deletions(-) delete mode 100644 tv/2configs/xserver/Xresources.nix create mode 100644 tv/2configs/xserver/urxvt.nix diff --git a/tv/2configs/xserver/Xresources.nix b/tv/2configs/xserver/Xresources.nix deleted file mode 100644 index b6c43b7..0000000 --- a/tv/2configs/xserver/Xresources.nix +++ /dev/null @@ -1,61 +0,0 @@ -with import ; -{ config, pkgs, ... }: { - - tv.Xresources = { - "URxvt*cutchars" = ''"\\`\"'&()*,;<=>?@[]^{|}‘’"''; - "URxvt*eightBitInput" = "false"; - "URxvt*font" = "-*-clean-*-*-*-*-*-*-*-*-*-*-iso10646-1"; - "URxvt*boldFont" = "-*-clean-*-*-*-*-*-*-*-*-*-*-iso10646-1"; - "URxvt*scrollBar" = "false"; - "URxvt*background" = "#050505"; - "URxvt*foreground" = "#d0d7d0"; - "URxvt*cursorColor" = "#f042b0"; - "URxvt*cursorColor2" = "#f0b000"; - "URxvt*cursorBlink" = "off"; - "URxvt*jumpScroll" = "true"; - "URxvt*allowSendEvents" = "false"; - "URxvt*charClass" = "33:48,37-38:48,45-47:48,61:48,63-64:48"; - "URxvt*cutNewline" = "False"; - "URxvt*cutToBeginningOfLine" = "False"; - - "URxvt*color0" = "#232342"; - "URxvt*color3" = "#c07000"; - "URxvt*color4" = "#4040c0"; - "URxvt*color7" = "#c0c0c0"; - "URxvt*color8" = "#707070"; - "URxvt*color9" = "#ff6060"; - "URxvt*color10" = "#70ff70"; - "URxvt*color11" = "#ffff70"; - "URxvt*color12" = "#7070ff"; - "URxvt*color13" = "#ff50ff"; - "URxvt*color14" = "#70ffff"; - "URxvt*color15" = "#ffffff"; - - "URxvt*iso14755" = "False"; - - "URxvt*urgentOnBell" = "True"; - "URxvt*visualBell" = "True"; - - # ref https://github.com/muennich/urxvt-perls - "URxvt*perl-ext" = "default,url-select"; - "URxvt*keysym.M-u" = "perl:url-select:select_next"; - "URxvt*url-select.launcher" = - "/etc/profiles/per-user/${config.krebs.build.user.name}/bin/ff -new-tab"; - "URxvt*url-select.underline" = "true"; - "URxvt*colorUL" = "#4682B4"; - "URxvt.perl-lib" = "${pkgs.urxvt_perls}/lib/urxvt/perl"; - "URxvt*saveLines" = "10000"; - "URxvt*modifier" = "mod1"; - - "root-urxvt*background" = "#230000"; - "root-urxvt*foreground" = "#e0c0c0"; - "root-urxvt*BorderColor" = "#400000"; - "root-urxvt*color0" = "#800000"; - - "fzmenu-urxvt*background" = "rgb:42/23/42"; - "fzmenu-urxvt*externalBorder" = "1"; - "fzmenu-urxvt*geometry" = "70x9"; - "fzmenu-urxvt*internalBorder" = "1"; - }; - -} diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix index e216025..95198ff 100644 --- a/tv/2configs/xserver/default.nix +++ b/tv/2configs/xserver/default.nix @@ -10,7 +10,7 @@ let in { imports = [ - ./Xresources.nix + ./urxvt.nix ]; environment.systemPackages = [ @@ -150,19 +150,6 @@ in { }; }; - systemd.services.urxvtd = { - wantedBy = [ "graphical.target" ]; - restartIfChanged = false; - serviceConfig = { - SyslogIdentifier = "urxvtd"; - ExecStart = "${pkgs.rxvt_unicode}/bin/urxvtd"; - Restart = "always"; - RestartSec = "2s"; - StartLimitBurst = 0; - User = cfg.user.name; - }; - }; - tv.slock = { enable = true; user = cfg.user; diff --git a/tv/2configs/xserver/urxvt.nix b/tv/2configs/xserver/urxvt.nix new file mode 100644 index 0000000..2d504e1 --- /dev/null +++ b/tv/2configs/xserver/urxvt.nix @@ -0,0 +1,73 @@ +with import ; +{ config, pkgs, ... }: let + cfg.user = config.krebs.build.user; +in { + systemd.services.urxvtd = { + wantedBy = [ "graphical.target" ]; + restartIfChanged = false; + serviceConfig = { + SyslogIdentifier = "urxvtd"; + ExecStart = "${pkgs.rxvt_unicode}/bin/urxvtd"; + Restart = "always"; + RestartSec = "2s"; + StartLimitBurst = 0; + User = cfg.user.name; + }; + }; + tv.Xresources = { + "URxvt*cutchars" = ''"\\`\"'&()*,;<=>?@[]^{|}‘’"''; + "URxvt*eightBitInput" = "false"; + "URxvt*font" = "-*-clean-*-*-*-*-*-*-*-*-*-*-iso10646-1"; + "URxvt*boldFont" = "-*-clean-*-*-*-*-*-*-*-*-*-*-iso10646-1"; + "URxvt*scrollBar" = "false"; + "URxvt*background" = "#050505"; + "URxvt*foreground" = "#d0d7d0"; + "URxvt*cursorColor" = "#f042b0"; + "URxvt*cursorColor2" = "#f0b000"; + "URxvt*cursorBlink" = "off"; + "URxvt*jumpScroll" = "true"; + "URxvt*allowSendEvents" = "false"; + "URxvt*charClass" = "33:48,37-38:48,45-47:48,61:48,63-64:48"; + "URxvt*cutNewline" = "False"; + "URxvt*cutToBeginningOfLine" = "False"; + + "URxvt*color0" = "#232342"; + "URxvt*color3" = "#c07000"; + "URxvt*color4" = "#4040c0"; + "URxvt*color7" = "#c0c0c0"; + "URxvt*color8" = "#707070"; + "URxvt*color9" = "#ff6060"; + "URxvt*color10" = "#70ff70"; + "URxvt*color11" = "#ffff70"; + "URxvt*color12" = "#7070ff"; + "URxvt*color13" = "#ff50ff"; + "URxvt*color14" = "#70ffff"; + "URxvt*color15" = "#ffffff"; + + "URxvt*iso14755" = "False"; + + "URxvt*urgentOnBell" = "True"; + "URxvt*visualBell" = "True"; + + # ref https://github.com/muennich/urxvt-perls + "URxvt*perl-ext" = "default,url-select"; + "URxvt*keysym.M-u" = "perl:url-select:select_next"; + "URxvt*url-select.launcher" = + "/etc/profiles/per-user/${cfg.user.name}/bin/ff -new-tab"; + "URxvt*url-select.underline" = "true"; + "URxvt*colorUL" = "#4682B4"; + "URxvt.perl-lib" = "${pkgs.urxvt_perls}/lib/urxvt/perl"; + "URxvt*saveLines" = "10000"; + "URxvt*modifier" = "mod1"; + + "root-urxvt*background" = "#230000"; + "root-urxvt*foreground" = "#e0c0c0"; + "root-urxvt*BorderColor" = "#400000"; + "root-urxvt*color0" = "#800000"; + + "fzmenu-urxvt*background" = "rgb:42/23/42"; + "fzmenu-urxvt*externalBorder" = "1"; + "fzmenu-urxvt*geometry" = "70x9"; + "fzmenu-urxvt*internalBorder" = "1"; + }; +} -- cgit v1.2.3 From cddb45988722fc75330eba57fabb0814d921d842 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 25 Apr 2019 00:23:39 +0200 Subject: tv: add sxiv config module --- tv/2configs/xserver/default.nix | 2 +- tv/2configs/xserver/sxiv.nix | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 tv/2configs/xserver/sxiv.nix diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix index 95198ff..012caff 100644 --- a/tv/2configs/xserver/default.nix +++ b/tv/2configs/xserver/default.nix @@ -10,6 +10,7 @@ let in { imports = [ + ./sxiv.nix ./urxvt.nix ]; @@ -18,7 +19,6 @@ in { pkgs.font-size pkgs.gitAndTools.qgit pkgs.mpv - pkgs.sxiv pkgs.xdotool pkgs.xsel pkgs.zathura diff --git a/tv/2configs/xserver/sxiv.nix b/tv/2configs/xserver/sxiv.nix new file mode 100644 index 0000000..10e450d --- /dev/null +++ b/tv/2configs/xserver/sxiv.nix @@ -0,0 +1,12 @@ +with import ; +{ config, pkgs, ... }: let + cfg.user = config.krebs.build.user; +in { + tv.Xresources = { + "Sxiv.foreground" = "#232323"; + "Sxiv.background" = "#424242"; + }; + users.users.${cfg.user.name}.packages = [ + pkgs.sxiv + ]; +} -- cgit v1.2.3 From 6de10bbf5aa370d7ffc908126efb40d99007488c Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 19 Apr 2019 16:14:53 +0200 Subject: init mb --- mb/1systems/orange/configuration.nix | 232 ++++++++++++++++++++++++++ mb/1systems/orange/hardware-configuration.nix | 28 ++++ mb/2configs/default.nix | 198 ++++++++++++++++++++++ mb/2configs/retiolum.nix | 33 ++++ mb/2configs/tests/dummy-secrets/retiolum.rsa | 4 + mb/3modules/default.nix | 6 + mb/3modules/hosts.nix | 12 ++ mb/5pkgs/default.nix | 11 ++ mb/default.nix | 14 ++ mb/krops.nix | 54 ++++++ 10 files changed, 592 insertions(+) create mode 100644 mb/1systems/orange/configuration.nix create mode 100644 mb/1systems/orange/hardware-configuration.nix create mode 100644 mb/2configs/default.nix create mode 100644 mb/2configs/retiolum.nix create mode 100644 mb/2configs/tests/dummy-secrets/retiolum.rsa create mode 100644 mb/3modules/default.nix create mode 100644 mb/3modules/hosts.nix create mode 100644 mb/5pkgs/default.nix create mode 100644 mb/default.nix create mode 100644 mb/krops.nix diff --git a/mb/1systems/orange/configuration.nix b/mb/1systems/orange/configuration.nix new file mode 100644 index 0000000..4ac0996 --- /dev/null +++ b/mb/1systems/orange/configuration.nix @@ -0,0 +1,232 @@ +{ config, pkgs, callPackage, ... }: let + unstable = import { config = { allowUnfree = true; }; }; +in { + imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + + ]; + + krebs.build.host = config.krebs.hosts.orange; + + boot.kernelPackages = pkgs.linuxPackages_latest; + boot.extraModulePackages = with config.boot.kernelPackages; [ wireguard ]; + + # Use the systemd-boot EFI boot loader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + boot.initrd.luks.devices = [ + { + name = "root"; + device = "/dev/disk/by-uuid/09a36f91-a713-4b82-8b41-4e7a6acc4acf"; + preLVM = true; + allowDiscards = true; + } + ]; + + fileSystems."/".options = [ "noatime" "nodiratime" "discard" ]; + fileSystems."/mnt/public" = { + device = "//192.168.88.252/public"; + fsType = "cifs"; + options = let + automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s"; + in [ "${automount_opts},user,rw,username=mb0,iocharset=utf8,credentials=${config.users.users.mb.home}/.smbcredentials" ]; + }; + + #networking.hostName = "0r4n93"; + networking.wireless.enable = false; + + # Select internationalisation properties. + i18n = { + consoleFont = "Lat2-Terminus16"; + consoleKeyMap = "de"; + defaultLocale = "en_US.UTF-8"; + }; + + time.timeZone = "Europe/Berlin"; + + nixpkgs.config.packageOverrides = super: { + openvpn = super.openvpn.override { pkcs11Support = true; useSystemd = false; }; + }; + + nixpkgs.config.allowUnfree = true; + + fonts = { + enableCoreFonts = true; + enableGhostscriptFonts = true; + fonts = with pkgs; [ + anonymousPro + corefonts + dejavu_fonts + envypn-font + fira + gentium + gohufont + inconsolata + liberation_ttf + powerline-fonts + source-code-pro + terminus_font + ttf_bitstream_vera + ubuntu_font_family + unifont + unstable.cherry + xorg.fontbitstream100dpi + xorg.fontbitstream75dpi + xorg.fontbitstreamtype1 + ]; + }; + + environment.systemPackages = with pkgs; [ + adapta-gtk-theme + aircrackng + ag + arandr + binutils + chromium + cifs-utils + curl + evince + exfat + feh + file + firefox + freetype + gimp + git + gnupg + graphite2 + hicolor_icon_theme + htop + i3lock + jq + keepassx2 + kvm + lxappearance + man-pages + moc + mpv + mpvc + mupdf + ncdu + nmap + openvpn + pass + p7zip + powertop + ranger + rofi + sshfs + tcpdump + tmux + traceroute + tree + unstable.alacritty + unstable.ponyc + unstable.sublime3 + unstable.youtube-dl + vim + virt-viewer + virtmanager + vulnix + wcalc + wget + wireshark-gtk + xz + ]; + + environment.shellAliases = { + ll = "ls -alh"; + ls = "ls --color=tty"; + }; + + virtualisation.libvirtd.enable = true; + #virtualisation.kvmgt.enable = true; + + programs.gnupg.agent = { + enable = true; + enableSSHSupport = true; + }; + + sound.enable = true; + hardware.pulseaudio.enable = true; + + services.xserver = { + enable = true; + layout = "de"; + xkbVariant = "nodeadkeys"; + libinput.enable = true; + desktopManager = { + default = "xfce"; + xterm.enable = false; + xfce = { + enable = true; + noDesktop = true; + enableXfwm = false; + }; + }; + windowManager.ratpoison.enable = true; + }; + + services.openssh.enable = true; + #services.openssh.permitRootLogin = "yes"; + services.openssh.passwordAuthentication = false; + + networking.networkmanager.enable = false; + #networking.nameservers = [ "8.8.8.8" "141.1.1.1" ]; + networking.enableIPv6 = false; + + programs.fish = { + enable = true; + shellInit = '' + function ssh_agent --description 'launch the ssh-agent and add the id_rsa identity' + if begin + set -q SSH_AGENT_PID + and kill -0 $SSH_AGENT_PID + and grep -q '^ssh-agent' /proc/$SSH_AGENT_PID/cmdline + end + echo "ssh-agent running on pid $SSH_AGENT_PID" + else + eval (command ssh-agent -c | sed 's/^setenv/set -Ux/') + end + set -l identity $HOME/.ssh/id_rsa + set -l fingerprint (ssh-keygen -lf $identity | awk '{print $2}') + ssh-add -l | grep -q $fingerprint + or ssh-add $identity + end + ''; + promptInit = '' + function fish_prompt --description 'Write out the prompt' + set -l color_cwd + set -l suffix + set -l nix_shell_info ( + if test "$IN_NIX_SHELL" != "" + echo -n " " + end + ) + switch "$USER" + case root toor + if set -q fish_color_cwd_root + set color_cwd $fish_color_cwd_root + else + set color_cwd $fish_color_cwd + end + set suffix '#' + case '*' + set color_cwd $fish_color_cwd + set suffix '>' + end + + echo -n -s "$USER" @ (set_color yellow) (prompt_hostname) (set_color normal) "$nix_shell_info" ' ' (set_color $color_cwd) (prompt_pwd) (set_color normal) "$suffix " + end + ''; + }; + + nix.maxJobs = 4; + nix.buildCores = 4; + system.autoUpgrade.enable = false; + system.autoUpgrade.channel = "https://nixos.org/channels/nixos-19.03"; + system.stateVersion = "19.03"; + +} diff --git a/mb/1systems/orange/hardware-configuration.nix b/mb/1systems/orange/hardware-configuration.nix new file mode 100644 index 0000000..8aa1912 --- /dev/null +++ b/mb/1systems/orange/hardware-configuration.nix @@ -0,0 +1,28 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, ... }: + +{ + imports = + [ + ]; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ohci_pci" "ehci_pci" "pata_atiixp" "usb_storage" "usbhid" "sd_mod" "sr_mod" ]; + boot.kernelModules = [ "kvm-amd" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/b1d32c54-35f8-4bf1-9fd2-82adc760af01"; + fsType = "btrfs"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/BF9B-03A2"; + fsType = "vfat"; + }; + + swapDevices = [ ]; + + nix.maxJobs = lib.mkDefault 4; +} diff --git a/mb/2configs/default.nix b/mb/2configs/default.nix new file mode 100644 index 0000000..75189e1 --- /dev/null +++ b/mb/2configs/default.nix @@ -0,0 +1,198 @@ +with import ; +{ config, pkgs, ... }: +{ + imports = [ + { + users.users = { + root = { + openssh.authorizedKeys.keys = [ + config.krebs.users.mb.pubkey + ]; + }; + mb = { + name = "mb"; + uid = 1337; + home = "/home/mb"; + group = "users"; + createHome = true; + shell = "/run/current-system/sw/bin/fish"; + extraGroups = [ + "audio" + "video" + "fuse" + "wheel" + ]; + openssh.authorizedKeys.keys = [ + config.krebs.users.mb.pubkey + ]; + }; + }; + } + { + environment.variables = { + NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src"; + }; + } + (let ca-bundle = "/etc/ssl/certs/ca-bundle.crt"; in { + environment.variables = { + CURL_CA_BUNDLE = ca-bundle; + GIT_SSL_CAINFO = ca-bundle; + SSL_CERT_FILE = ca-bundle; + }; + }) + ]; + + networking.hostName = config.krebs.build.host.name; + + krebs = { + enable = true; + build.user = config.krebs.users.mb; + }; + + users.mutableUsers = false; + + services.timesyncd.enable = mkForce true; + + systemd.tmpfiles.rules = [ + "d /tmp 1777 root root - -" + ]; + + # multiple-definition-problem when defining environment.variables.EDITOR + environment.extraInit = '' + EDITOR=vim + ''; + + nixpkgs.config.allowUnfree = true; + + environment.systemPackages = with pkgs; [ + #stockholm + git + gnumake + jq + parallel + proot + populate + + #style + most + rxvt_unicode.terminfo + + #monitoring tools + htop + iotop + + #network + iptables + iftop + tcpdump + + #stuff for dl + aria2 + + #neat utils + fish + file + kpaste + krebspaste + mosh + pciutils + psmisc + tmux + untilport + usbutils + + #unpack stuff + p7zip + + (pkgs.writeDashBin "sshn" '' + ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@" + '') + ]; + + services.openssh = { + enable = true; + permitRootLogin = "yes"; + passwordAuthentication = false; + hostKeys = [ + # XXX bits here make no science + { bits = 8192; type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; } + ]; + }; + + programs.fish = { + enable = true; + shellInit = '' + function ssh_agent --description 'launch the ssh-agent and add the id_rsa identity' + if begin + set -q SSH_AGENT_PID + and kill -0 $SSH_AGENT_PID + and grep -q '^ssh-agent' /proc/$SSH_AGENT_PID/cmdline + end + echo "ssh-agent running on pid $SSH_AGENT_PID" + else + eval (command ssh-agent -c | sed 's/^setenv/set -Ux/') + end + set -l identity $HOME/.ssh/id_rsa + set -l fingerprint (ssh-keygen -lf $identity | awk '{print $2}') + ssh-add -l | grep -q $fingerprint + or ssh-add $identity + end + ''; + promptInit = '' + function fish_prompt --description 'Write out the prompt' + set -l color_cwd + set -l suffix + set -l nix_shell_info ( + if test "$IN_NIX_SHELL" != "" + echo -n " " + end + ) + switch "$USER" + case root toor + if set -q fish_color_cwd_root + set color_cwd $fish_color_cwd_root + else + set color_cwd $fish_color_cwd + end + set suffix '#' + case '*' + set color_cwd $fish_color_cwd + set suffix '>' + end + + echo -n -s "$USER" @ (set_color yellow) (prompt_hostname) (set_color normal) "$nix_shell_info" ' ' (set_color $color_cwd) (prompt_pwd) (set_color normal) "$suffix " + end + ''; + }; + + services.journald.extraConfig = '' + SystemMaxUse=1G + RuntimeMaxUse=128M + ''; + + krebs.iptables = { + enable = true; + tables = { + nat.PREROUTING.rules = [ + { predicate = "! -i retiolum -p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; precedence = 100; } + { predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 99; } + ]; + nat.OUTPUT.rules = [ + { predicate = "-o lo -p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 100; } + ]; + filter.INPUT.policy = "DROP"; + filter.FORWARD.policy = "DROP"; + filter.INPUT.rules = [ + { predicate = "-i retiolum -p udp --dport 60000:61000"; target = "ACCEPT";} + { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; precedence = 10001; } + { predicate = "-p icmp"; target = "ACCEPT"; precedence = 10000; } + { predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; precedence = 10000; } + { predicate = "-i lo"; target = "ACCEPT"; precedence = 9999; } + { predicate = "-p tcp --dport 22"; target = "ACCEPT"; precedence = 9998; } + { predicate = "-p tcp -i retiolum"; target = "REJECT --reject-with tcp-reset"; precedence = -10000; } + { predicate = "-p udp -i retiolum"; target = "REJECT --reject-with icmp-port-unreachable"; v6 = false; precedence = -10000; } + { predicate = "-i retiolum"; target = "REJECT --reject-with icmp-proto-unreachable"; v6 = false; precedence = -10000; } + ]; + }; + }; +} diff --git a/mb/2configs/retiolum.nix b/mb/2configs/retiolum.nix new file mode 100644 index 0000000..5a87d52 --- /dev/null +++ b/mb/2configs/retiolum.nix @@ -0,0 +1,33 @@ +{ config, pkgs, ... }: + +{ + + krebs.iptables = { + tables = { + filter.INPUT.rules = let + tincport = toString config.krebs.build.host.nets.retiolum.tinc.port; + in [ + { predicate = "-p tcp --dport ${tincport}"; target = "ACCEPT"; } + { predicate = "-p udp --dport ${tincport}"; target = "ACCEPT"; } + ]; + }; + }; + + krebs.tinc.retiolum = { + enableLegacy = true; + enable = true; + connectTo = [ + "prism" + "gum" + "ni" + ]; + }; + + nixpkgs.config.packageOverrides = pkgs: { + tinc = pkgs.tinc_pre; + }; + + environment.systemPackages = [ + pkgs.tinc + ]; +} diff --git a/mb/2configs/tests/dummy-secrets/retiolum.rsa b/mb/2configs/tests/dummy-secrets/retiolum.rsa new file mode 100644 index 0000000..99a4033 --- /dev/null +++ b/mb/2configs/tests/dummy-secrets/retiolum.rsa @@ -0,0 +1,4 @@ + +-----BEGIN RSA PRIVATE KEY----- +this is a private key +-----END RSA PRIVATE KEY----- diff --git a/mb/3modules/default.nix b/mb/3modules/default.nix new file mode 100644 index 0000000..99d09d4 --- /dev/null +++ b/mb/3modules/default.nix @@ -0,0 +1,6 @@ +_: +{ + imports = [ + ./hosts.nix + ]; +} diff --git a/mb/3modules/hosts.nix b/mb/3modules/hosts.nix new file mode 100644 index 0000000..5dc9b5c --- /dev/null +++ b/mb/3modules/hosts.nix @@ -0,0 +1,12 @@ +{ config, ... }: + +with import ; + +{ + options.mb.hosts = mkOption { + type = types.attrsOf types.host; + default = + filterAttrs (_: host: host.owner.name == "mb" && host.ci) + config.krebs.hosts; + }; +} diff --git a/mb/5pkgs/default.nix b/mb/5pkgs/default.nix new file mode 100644 index 0000000..3fa5b5e --- /dev/null +++ b/mb/5pkgs/default.nix @@ -0,0 +1,11 @@ +with import ; + +self: super: + +# Import files and subdirectories like they are overlays. +foldl' mergeAttrs {} + (map + (name: import (./. + "/${name}") self super) + (filter + (name: name != "default.nix" && !hasPrefix "." name) + (attrNames (readDir ./.)))) diff --git a/mb/default.nix b/mb/default.nix new file mode 100644 index 0000000..0bec0c2 --- /dev/null +++ b/mb/default.nix @@ -0,0 +1,14 @@ +{ config, pkgs, ... }: +{ + imports = [ + ../krebs + ./2configs + ./3modules + ]; + nixpkgs.config.packageOverrides = import ./5pkgs pkgs; + krebs.tinc.retiolum.privkey = { + source-path = toString + "/${config.krebs.tinc.retiolum.netname}.rsa"; + path = "${config.krebs.tinc.retiolum.user.home}/tinc.rsa_key.priv"; + owner = config.krebs.tinc.retiolum.user; + }; +} diff --git a/mb/krops.nix b/mb/krops.nix new file mode 100644 index 0000000..cb9ab3f --- /dev/null +++ b/mb/krops.nix @@ -0,0 +1,54 @@ +{ name }: let + inherit (import ../krebs/krops.nix { inherit name; }) + krebs-source + lib + pkgs + ; + + host-source = if lib.pathExists (./. + "/1systems/${name}/source.nix") then + import (./. + "/1systems/${name}/source.nix") { inherit lib pkgs; } + else + {} + ; + + source = { test }: lib.evalSource ([ + (krebs-source { test = test; }) + { + nixos-config.symlink = "stockholm/mb/1systems/${name}/configuration.nix"; + nixpkgs-unstable.git = { + url = "https://github.com/nixos/nixpkgs-channels"; + ref = "nixos-unstable"; + }; + secrets = if test then { + file = toString ./2configs/tests/dummy-secrets; + } else { + pass = { + dir = "${lib.getEnv "HOME"}/.password-store"; + name = "hosts/${name}"; + }; + }; + } + ] ++ (lib.optional (! test) host-source)); + +in { + + # usage: $(nix-build --no-out-link --argstr name HOSTNAME -A deploy) + deploy = { target ? "root@${name}/var/src" }: pkgs.krops.writeDeploy "${name}-deploy" { + source = source { test = false; }; + inherit target; + }; + + # usage: $(nix-build --no-out-link --argstr name HOSTNAME --argstr target PATH -A populate) + populate = { target, force ? false }: pkgs.populate { + inherit force; + source = source { test = false; }; + target = lib.mkTarget target; + }; + + # usage: $(nix-build --no-out-link --argstr name HOSTNAME --argstr target PATH -A test) + test = { target }: pkgs.krops.writeTest "${name}-test" { + force = true; + inherit target; + source = source { test = true; }; + }; +} -- cgit v1.2.3 From 89cb2dfaf7c448a1227ec7bb1f2883032de9222f Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 26 Apr 2019 20:11:30 +0200 Subject: mb: add p1nk.r --- mb/1systems/p1nk/configuration.nix | 223 ++++++++++++++++++++++++++++ mb/1systems/p1nk/hardware-configuration.nix | 29 ++++ 2 files changed, 252 insertions(+) create mode 100644 mb/1systems/p1nk/configuration.nix create mode 100644 mb/1systems/p1nk/hardware-configuration.nix diff --git a/mb/1systems/p1nk/configuration.nix b/mb/1systems/p1nk/configuration.nix new file mode 100644 index 0000000..28a7c77 --- /dev/null +++ b/mb/1systems/p1nk/configuration.nix @@ -0,0 +1,223 @@ +{ config, pkgs, callPackage, ... }: let + unstable = import { config = { allowUnfree = true; }; }; +in { + imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + + ]; + + krebs.build.host = config.krebs.hosts.p1nk; + + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + boot.initrd.luks.devices = [ + { + name = "root"; + device = "/dev/disk/by-uuid/0392257b-f6cf-484d-8c46-e20aab4fddb7"; + preLVM = true; + allowDiscards = true; + } + ]; + fileSystems."/".options = [ "noatime" "nodiratime" "discard" ]; + fileSystems."/mnt/public" = { + device = "//192.168.88.252/public"; + fsType = "cifs"; + options = let + automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s"; + in [ "${automount_opts},user,rw,username=mb0,iocharset=utf8,credentials=${config.users.users.mb.home}/.smbcredentials" ]; + }; + + networking.wireless.enable = true; + + i18n = { + consoleFont = "Lat2-Terminus16"; + consoleKeyMap = "de"; + defaultLocale = "en_US.UTF-8"; + }; + + time.timeZone = "Europe/Berlin"; + + fonts = { + enableCoreFonts = true; + enableGhostscriptFonts = true; + fonts = with pkgs; [ + anonymousPro + corefonts + dejavu_fonts + envypn-font + fira + gentium + gohufont + inconsolata + liberation_ttf + powerline-fonts + source-code-pro + terminus_font + ttf_bitstream_vera + ubuntu_font_family + unifont + unstable.cherry + xorg.fontbitstream100dpi + xorg.fontbitstream75dpi + xorg.fontbitstreamtype1 + ]; + }; + + nixpkgs.config.packageOverrides = super: { + openvpn = super.openvpn.override { pkcs11Support = true; useSystemd = false; }; + }; + + nixpkgs.config.allowUnfree = true; + + environment.systemPackages = with pkgs; [ + adapta-gtk-theme + aircrackng + ag + arandr + binutils + chromium + cifs-utils + curl + evince + exfat + feh + file + firefox + freetype + gimp + git + gnupg + graphite2 + hicolor_icon_theme + htop + i3lock + jq + keepassx2 + kvm + lxappearance + man-pages + moc + mpv + mpvc + mupdf + ncdu + nmap + openvpn + pass + p7zip + powertop + ranger + rofi + sshfs + tcpdump + tmux + traceroute + tree + unstable.alacritty + unstable.ponyc + unstable.sublime3 + youtube-dl + vim + virt-viewer + virtmanager + vulnix + wcalc + wget + xz + ]; + + environment.shellAliases = { + ll = "ls -alh"; + ls = "ls --color=tty"; + }; + + virtualisation.libvirtd.enable = true; + virtualisation.kvmgt.enable = true; + + programs.gnupg.agent = { + enable = true; + enableSSHSupport = true; + }; + + sound.enable = true; + hardware.pulseaudio.enable = true; + + services.xserver = { + enable = true; + layout = "de"; + xkbOptions = "neo"; + libinput.enable = true; + desktopManager = { + default = "xfce"; + xterm.enable = false; + xfce = { + enable = true; + noDesktop = true; + enableXfwm = false; + }; + }; + windowManager.ratpoison.enable = true; + }; + + services.openssh.enable = true; + services.openssh.passwordAuthentication = false; + + networking.networkmanager.enable = false; + networking.nameservers = [ "8.8.8.8" "141.1.1.1" ]; + networking.enableIPv6 = false; + + programs.fish = { + enable = true; + shellInit = '' + function ssh_agent --description 'launch the ssh-agent and add the id_rsa identity' + if begin + set -q SSH_AGENT_PID + and kill -0 $SSH_AGENT_PID + and grep -q '^ssh-agent' /proc/$SSH_AGENT_PID/cmdline + end + echo "ssh-agent running on pid $SSH_AGENT_PID" + else + eval (command ssh-agent -c | sed 's/^setenv/set -Ux/') + end + set -l identity $HOME/.ssh/id_rsa + set -l fingerprint (ssh-keygen -lf $identity | awk '{print $2}') + ssh-add -l | grep -q $fingerprint + or ssh-add $identity + end + ''; + promptInit = '' + function fish_prompt --description 'Write out the prompt' + set -l color_cwd + set -l suffix + set -l nix_shell_info ( + if test "$IN_NIX_SHELL" != "" + echo -n " " + end + ) + switch "$USER" + case root toor + if set -q fish_color_cwd_root + set color_cwd $fish_color_cwd_root + else + set color_cwd $fish_color_cwd + end + set suffix '#' + case '*' + set color_cwd $fish_color_cwd + set suffix '>' + end + + echo -n -s "$USER" @ (set_color magenta) (prompt_hostname) (set_color normal) "$nix_shell_info" ' ' (set_color $color_cwd) (prompt_pwd) (set_color normal) "$suffix " + end + ''; + }; + + nix.maxJobs = 4; + nix.buildCores = 4; + system.autoUpgrade.enable = false; + system.autoUpgrade.channel = "https://nixos.org/channels/nixos-19.03"; + system.stateVersion = "19.03"; + +} diff --git a/mb/1systems/p1nk/hardware-configuration.nix b/mb/1systems/p1nk/hardware-configuration.nix new file mode 100644 index 0000000..ab5b6e2 --- /dev/null +++ b/mb/1systems/p1nk/hardware-configuration.nix @@ -0,0 +1,29 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, ... }: + +{ + imports = + [ + ]; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/4cc2add6-ed19-4685-bbd9-b992bd8d51fb"; + fsType = "btrfs"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/9F87-AEAA"; + fsType = "vfat"; + }; + + swapDevices = [ ]; + + nix.maxJobs = lib.mkDefault 4; + powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; +} -- cgit v1.2.3