Compare commits
4 Commits
doofnet
...
wip-comman
| Author | SHA1 | Date | |
|---|---|---|---|
|
3d478c8d37 | ||
|
|
e052a165ec | ||
|
|
5a9e975723 | ||
|
|
91d9098ae2 |
@@ -1,288 +0,0 @@
|
|||||||
{ config, pkgs, lib, inputs, ... }: let
|
|
||||||
inherit (lib) mkOption types flip concatMapStringsSep optionalString concatStringsSep readFile mapAttrsToList literalExpression;
|
|
||||||
inherit (builtins) attrValues;
|
|
||||||
cfg = config.vacu;
|
|
||||||
knownHosts = attrValues cfg.ssh.knownHosts;
|
|
||||||
knownHostsText = (flip (concatMapStringsSep "\n") knownHosts
|
|
||||||
(h: assert h.hostNames != [];
|
|
||||||
optionalString h.certAuthority "@cert-authority " + concatStringsSep "," h.hostNames + " "
|
|
||||||
+ (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
|
|
||||||
)) + "\n";
|
|
||||||
packageNames = lib.splitString "\n" ''
|
|
||||||
nixos-rebuild
|
|
||||||
nano
|
|
||||||
vim
|
|
||||||
wget
|
|
||||||
screen
|
|
||||||
tmux
|
|
||||||
lsof
|
|
||||||
htop
|
|
||||||
mosh
|
|
||||||
dnsutils
|
|
||||||
iperf3
|
|
||||||
nmap
|
|
||||||
rsync
|
|
||||||
ethtool
|
|
||||||
sshfs
|
|
||||||
ddrescue
|
|
||||||
pciutils
|
|
||||||
ncdu
|
|
||||||
nix-index
|
|
||||||
git
|
|
||||||
pv
|
|
||||||
unzip
|
|
||||||
file
|
|
||||||
ripgrep
|
|
||||||
jq
|
|
||||||
units
|
|
||||||
tree
|
|
||||||
rclone
|
|
||||||
iputils
|
|
||||||
ssh-to-age
|
|
||||||
sops
|
|
||||||
inetutils
|
|
||||||
neovim
|
|
||||||
diffutils
|
|
||||||
findutils
|
|
||||||
utillinux
|
|
||||||
tzdata
|
|
||||||
hostname
|
|
||||||
man
|
|
||||||
gnugrep
|
|
||||||
gnused
|
|
||||||
gnutar
|
|
||||||
bzip2
|
|
||||||
gzip
|
|
||||||
xz
|
|
||||||
zip
|
|
||||||
unzip
|
|
||||||
openssh
|
|
||||||
dig
|
|
||||||
bash
|
|
||||||
git'';
|
|
||||||
plainPackageOpts = map (name: { name = name; value = { enable = lib.mkDefault true; }; }) packageNames;
|
|
||||||
packageOpts = lib.recursiveUpdate (builtins.listToAttrs plainPackageOpts) {
|
|
||||||
nix-search-cli.package = inputs.nix-search-cli.packages.${pkgs.system}.default;
|
|
||||||
nix-search-cli.enable = lib.mkDefault true;
|
|
||||||
nix-inspect.package = inputs.nix-inspect.packages.${pkgs.system}.default;
|
|
||||||
nix-inspect.enable = lib.mkDefault true;
|
|
||||||
};
|
|
||||||
in {
|
|
||||||
imports = [ ./package-set.nix ];
|
|
||||||
options = {
|
|
||||||
vacu.ssh.authorizedKeys = mkOption {
|
|
||||||
type = types.listOf types.str;
|
|
||||||
};
|
|
||||||
vacu.ssh.config = mkOption {
|
|
||||||
type = types.lines;
|
|
||||||
};
|
|
||||||
# Straight copied from nixpkgs
|
|
||||||
# https://github.com/NixOS/nixpkgs/blob/46397778ef1f73414b03ed553a3368f0e7e33c2f/nixos/modules/programs/ssh.nix
|
|
||||||
vacu.ssh.knownHosts = mkOption {
|
|
||||||
default = {};
|
|
||||||
type = types.attrsOf (types.submodule ({ name, config, options, ... }: {
|
|
||||||
options = {
|
|
||||||
certAuthority = mkOption {
|
|
||||||
type = types.bool;
|
|
||||||
default = false;
|
|
||||||
description = ''
|
|
||||||
This public key is an SSH certificate authority, rather than an
|
|
||||||
individual host's key.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
hostNames = mkOption {
|
|
||||||
type = types.listOf types.str;
|
|
||||||
default = [ name ] ++ config.extraHostNames;
|
|
||||||
defaultText = literalExpression "[ ${name} ] ++ config.${options.extraHostNames}";
|
|
||||||
description = ''
|
|
||||||
A list of host names and/or IP numbers used for accessing
|
|
||||||
the host's ssh service. This list includes the name of the
|
|
||||||
containing `knownHosts` attribute by default
|
|
||||||
for convenience. If you wish to configure multiple host keys
|
|
||||||
for the same host use multiple `knownHosts`
|
|
||||||
entries with different attribute names and the same
|
|
||||||
`hostNames` list.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
extraHostNames = mkOption {
|
|
||||||
type = types.listOf types.str;
|
|
||||||
default = [];
|
|
||||||
description = ''
|
|
||||||
A list of additional host names and/or IP numbers used for
|
|
||||||
accessing the host's ssh service. This list is ignored if
|
|
||||||
`hostNames` is set explicitly.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
publicKey = mkOption {
|
|
||||||
default = null;
|
|
||||||
type = types.nullOr types.str;
|
|
||||||
example = "ecdsa-sha2-nistp521 AAAAE2VjZHN...UEPg==";
|
|
||||||
description = ''
|
|
||||||
The public key data for the host. You can fetch a public key
|
|
||||||
from a running SSH server with the {command}`ssh-keyscan`
|
|
||||||
command. The public key should not include any host names, only
|
|
||||||
the key type and the key itself.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
publicKeyFile = mkOption {
|
|
||||||
default = null;
|
|
||||||
type = types.nullOr types.path;
|
|
||||||
description = ''
|
|
||||||
The path to the public key file for the host. The public
|
|
||||||
key file is read at build time and saved in the Nix store.
|
|
||||||
You can fetch a public key file from a running SSH server
|
|
||||||
with the {command}`ssh-keyscan` command. The content
|
|
||||||
of the file should follow the same format as described for
|
|
||||||
the `publicKey` option. Only a single key
|
|
||||||
is supported. If a host has multiple keys, use
|
|
||||||
{option}`programs.ssh.knownHostsFiles` instead.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}));
|
|
||||||
description = ''
|
|
||||||
The set of system-wide known SSH hosts. To make simple setups more
|
|
||||||
convenient the name of an attribute in this set is used as a host name
|
|
||||||
for the entry. This behaviour can be disabled by setting
|
|
||||||
`hostNames` explicitly. You can use
|
|
||||||
`extraHostNames` to add additional host names without
|
|
||||||
disabling this default.
|
|
||||||
'';
|
|
||||||
example = literalExpression ''
|
|
||||||
{
|
|
||||||
myhost = {
|
|
||||||
extraHostNames = [ "myhost.mydomain.com" "10.10.1.4" ];
|
|
||||||
publicKeyFile = ./pubkeys/myhost_ssh_host_dsa_key.pub;
|
|
||||||
};
|
|
||||||
"myhost2.net".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILIRuJ8p1Fi+m6WkHV0KWnRfpM1WxoW8XAS+XvsSKsTK";
|
|
||||||
"myhost2.net/dsa" = {
|
|
||||||
hostNames = [ "myhost2.net" ];
|
|
||||||
publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
vacu.nix.extraSubstituters = mkOption { type = types.listOf types.str; };
|
|
||||||
vacu.nix.extraTrustedKeys = mkOption { type = types.listOf types.str; };
|
|
||||||
};
|
|
||||||
config = {
|
|
||||||
vacu.packages = packageOpts;
|
|
||||||
vacu.nix.extraSubstituters = [
|
|
||||||
"https://nixcache.shelvacu.com/"
|
|
||||||
"https://nix-community.cachix.org/"
|
|
||||||
];
|
|
||||||
vacu.nix.extraTrustedKeys = [
|
|
||||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
|
||||||
"nixcache.shelvacu.com:73u5ZGBpPRoVZfgNJQKYYBt9K9Io/jPwgUfuOLsJbsM="
|
|
||||||
];
|
|
||||||
assertions = flip mapAttrsToList cfg.ssh.knownHosts (name: data: {
|
|
||||||
assertion = (data.publicKey == null && data.publicKeyFile != null) ||
|
|
||||||
(data.publicKey != null && data.publicKeyFile == null);
|
|
||||||
message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
|
|
||||||
});
|
|
||||||
vacu.ssh.authorizedKeys = [
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC4LYvUe9dsQb9OaTDFI4QKPtMmOHOGLwWsXsEmcJW86" # Termux on pixel6pro
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHcYwYy9/0Gu/GsqS72Nkz6OkId+zevqXA/aTIcvqflp" # t460s windows
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFsErA6M9LSHj2hPlLuHD8Lpei7WjMup1JxI1vxA6B8W" # pixel6pro nix-on-droid
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKoy1TrmfhBGWtVedgOM1FB1oD2UdodN3LkBnnLx6Tug" # compute-deck
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICVeSzDkGTueZijB0xUa08e06ovAEwwZK/D+Cc7bo91g" # triple-dezert
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtwtao/TXbiuQOYJbousRPVesVcb/2nP0PCFUec0Nv8" # triple-dezert (root)
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAxAFFxQMXAgi+0cmGaNE/eAkVfEl91wafUqFIuAkI5I" # compute-deck (root)
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDcRDekd8ZOYfQS5X95/yNof3wFYIbHqWeq4jY0+ywQX" # pro1x nix-on-droid
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExSObd1lZprdqAFLqFhtxDEckV0q/vZZIYqrYFKfkoC" # devver
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGHLPOxRd68+DJ/bYmqn0wsgwwIcMSMyuU1Ya16hCb/m" # fw (root)
|
|
||||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINQ2c0GzlVMjV06CS7bWbCaAbzG2+7g5FCg/vClJPe0C" # fw
|
|
||||||
];
|
|
||||||
vacu.ssh.config = ''
|
|
||||||
Host deckvacu
|
|
||||||
User deck
|
|
||||||
|
|
||||||
Host rsb
|
|
||||||
User user
|
|
||||||
HostName finaltask.xyz
|
|
||||||
Port 2222
|
|
||||||
|
|
||||||
Host awoo
|
|
||||||
HostName 45.142.157.71
|
|
||||||
|
|
||||||
Host trip
|
|
||||||
HostName trip.shelvacu.com
|
|
||||||
Port 6922
|
|
||||||
|
|
||||||
Host liam
|
|
||||||
HostName 178.128.79.152
|
|
||||||
|
|
||||||
Host pluto
|
|
||||||
HostName pluto.somevideogam.es
|
|
||||||
|
|
||||||
Host *
|
|
||||||
User shelvacu
|
|
||||||
GlobalKnownHostsFile ${pkgs.writeText "known_hosts" knownHostsText}
|
|
||||||
'';
|
|
||||||
|
|
||||||
vacu.ssh.knownHosts = {
|
|
||||||
#public hosts
|
|
||||||
"github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
|
|
||||||
"gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
|
|
||||||
|
|
||||||
#colin's stuff
|
|
||||||
"uninsane.org" = {
|
|
||||||
extraHostNames = [ "git.uninsane.org" ];
|
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfdSmFkrVT6DhpgvFeQKm3Fh9VKZ9DbLYOPOJWYQ0E8";
|
|
||||||
};
|
|
||||||
"desko" = {
|
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFw9NoRaYrM6LbDd3aFBc4yyBlxGQn8HjeHd/dZ3CfHk";
|
|
||||||
};
|
|
||||||
|
|
||||||
#daymocker's stuff
|
|
||||||
"pluto" = {
|
|
||||||
extraHostNames = [ "74.208.184.137" ];
|
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICpHY4fLZ1hNuB2oRQM7R3b4eQyIHbFB45ZYp3XCELLg";
|
|
||||||
};
|
|
||||||
|
|
||||||
#personal hosts
|
|
||||||
"zigbee-hub" = {
|
|
||||||
extraHostNames = [ "10.78.79.114" ];
|
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJxwUYddOxgViJDOiokfaQ6CsCx/Sw+b3IisdJv8zFN root@zigbee-hub";
|
|
||||||
};
|
|
||||||
trip = {
|
|
||||||
extraHostNames = [ "triple-dezert" "trip.shelvacu.com" "[trip.shelvacu.com]:6922" ];
|
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGUQux9V0mSF5IauoO1z311NXR7ymEbwRMzT+OaaNQr+";
|
|
||||||
};
|
|
||||||
servacu = {
|
|
||||||
extraHostNames = [ "mail.dis8.net" "servacu.shelvacu.com" ];
|
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE+E6na7np0HnBV2X7owno+Fg+bNNRSHLxO6n1JzdUTV";
|
|
||||||
};
|
|
||||||
finaltask = {
|
|
||||||
extraHostNames = [ "rsb" "finaltask.xyz" "[finaltask.xyz]:2222" ];
|
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTx8WBNNKBVRV98HgDChpd59SHbreJ87SXU+zOKan6y";
|
|
||||||
};
|
|
||||||
compute-deck = {
|
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGt43GmXCxkl5QjgPQ/QimW11lKfXmV4GFWvlxQSf4TQ";
|
|
||||||
};
|
|
||||||
"2esrever" = {
|
|
||||||
extraHostNames = [ "10.4.5.218" "10.244.46.71" ];
|
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH0LnPrJxAdffZ//uRe3NBiIfFCBNMLqKVylkyU0llvT";
|
|
||||||
};
|
|
||||||
awoo = {
|
|
||||||
extraHostNames = [ "45.142.157.71" ];
|
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQaDjjfSK8jnk9aFIiYH9LZO4nLY/oeAc7BKIPUXMh1";
|
|
||||||
};
|
|
||||||
deckvacu = {
|
|
||||||
publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEa8qpFkIlLLJkH8rmEAn6/MZ9ilCGmEQWC3CeFae7r1kOqfwRk0nq0oyOGJ50uIh+PpwEh3rbgq6mLfpRfsFmM=";
|
|
||||||
};
|
|
||||||
liam = {
|
|
||||||
extraHostNames = [ "liam.dis8.net" "178.128.79.152" ];
|
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHOqJYVHOIFmEA5uRbbirIupWvyBLAFwic/8EZQRdN/c";
|
|
||||||
};
|
|
||||||
devver = {
|
|
||||||
extraHostNames = [ "devver.t2d.lan" "10.78.79.10" ];
|
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeFaH2tzWIiCPdKNmxl3NqCnPTdmVIOBinauUAEl+UU";
|
|
||||||
};
|
|
||||||
fw = {
|
|
||||||
extraHostNames = [ "fw.t2d.lan" ];
|
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA6lX25mCy35tf1NpcHMAdeRgvT7l0Dw0FWBH3eX4TE2";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,81 +0,0 @@
|
|||||||
{ lib, pkgs, config, inputs, utils, ... }:
|
|
||||||
{
|
|
||||||
imports = [ ./common-config.nix ];
|
|
||||||
options.vacu.acmeCertDependencies = lib.mkOption {
|
|
||||||
default = {};
|
|
||||||
example = ''
|
|
||||||
vacu.acmeCertDependencies."mail.example.com" = [ "postfix.service" ];
|
|
||||||
'';
|
|
||||||
type = lib.types.attrsOf (lib.types.listOf utils.systemdUtils.lib.unitNameType);
|
|
||||||
};
|
|
||||||
config = let
|
|
||||||
for-systemd-services = lib.concatMapAttrs
|
|
||||||
(cert: units:
|
|
||||||
{
|
|
||||||
"acme-selfsigned-${cert}" = {
|
|
||||||
wantedBy = units;
|
|
||||||
before = units;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
)
|
|
||||||
config.vacu.acmeCertDependencies;
|
|
||||||
for-security-acme-certs = lib.concatMapAttrs
|
|
||||||
(cert: units:
|
|
||||||
{
|
|
||||||
${cert}.reloadServices = units;
|
|
||||||
}
|
|
||||||
)
|
|
||||||
config.vacu.acmeCertDependencies;
|
|
||||||
in {
|
|
||||||
console = {
|
|
||||||
keyMap = lib.mkDefault "us";
|
|
||||||
};
|
|
||||||
vacu.packages."xorg-xev" = {
|
|
||||||
enable = config.services.xserver.enable;
|
|
||||||
package = pkgs.xorg.xev;
|
|
||||||
};
|
|
||||||
environment.systemPackages = config.vacu.packageList;
|
|
||||||
|
|
||||||
i18n.defaultLocale = lib.mkDefault "en_US.UTF-8";
|
|
||||||
time.timeZone = "America/Los_Angeles";
|
|
||||||
|
|
||||||
users.users.shelvacu = {
|
|
||||||
openssh.authorizedKeys.keys = config.vacu.ssh.authorizedKeys;
|
|
||||||
isNormalUser = true;
|
|
||||||
extraGroups = [ "wheel" ];
|
|
||||||
};
|
|
||||||
systemd.services = for-systemd-services;
|
|
||||||
security.acme.certs = for-security-acme-certs;
|
|
||||||
services.openssh = {
|
|
||||||
# require public key authentication for better security
|
|
||||||
settings.PasswordAuthentication = false;
|
|
||||||
settings.KbdInteractiveAuthentication = false;
|
|
||||||
settings.PermitRootLogin = "prohibit-password";
|
|
||||||
};
|
|
||||||
|
|
||||||
nix.settings.trusted-users = [ "shelvacu" ];
|
|
||||||
security.sudo.wheelNeedsPassword = lib.mkDefault false;
|
|
||||||
|
|
||||||
programs.screen = {
|
|
||||||
screenrc = ''
|
|
||||||
defscrollback 10000
|
|
||||||
termcapinfo xterm* ti@:te@
|
|
||||||
'';
|
|
||||||
} // (if config.system.nixos.release == "23.11" then {} else { enable = true; });
|
|
||||||
|
|
||||||
programs.tmux.enable = true;
|
|
||||||
programs.tmux.extraConfig = "setw mouse";
|
|
||||||
programs.tmux.clock24 = true;
|
|
||||||
|
|
||||||
nix.settings = {
|
|
||||||
experimental-features = [ "nix-command" "flakes" ];
|
|
||||||
substituters = config.vacu.nix.extraSubstituters;
|
|
||||||
trusted-public-keys = config.vacu.nix.extraTrustedKeys;
|
|
||||||
};
|
|
||||||
nixpkgs.config.allowUnfree = lib.mkDefault true;
|
|
||||||
|
|
||||||
programs.mosh.enable = lib.mkDefault true;
|
|
||||||
|
|
||||||
programs.ssh.extraConfig = config.vacu.ssh.config;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
@@ -1,37 +0,0 @@
|
|||||||
{ pkgs, inputs }: (with pkgs; [
|
|
||||||
inputs.nix-search-cli.packages.${pkgs.system}.default
|
|
||||||
inputs.nix-inspect.packages.${pkgs.system}.default
|
|
||||||
nixos-rebuild
|
|
||||||
nano
|
|
||||||
vim
|
|
||||||
wget
|
|
||||||
screen
|
|
||||||
tmux
|
|
||||||
lsof
|
|
||||||
htop
|
|
||||||
mosh
|
|
||||||
dnsutils
|
|
||||||
iperf3
|
|
||||||
nmap
|
|
||||||
rsync
|
|
||||||
ethtool
|
|
||||||
sshfs
|
|
||||||
ddrescue
|
|
||||||
pciutils
|
|
||||||
ncdu
|
|
||||||
nix-index
|
|
||||||
git
|
|
||||||
pv
|
|
||||||
unzip
|
|
||||||
file
|
|
||||||
ripgrep
|
|
||||||
jq
|
|
||||||
units
|
|
||||||
tree
|
|
||||||
rclone
|
|
||||||
iputils
|
|
||||||
ssh-to-age
|
|
||||||
sops
|
|
||||||
inetutils
|
|
||||||
neovim
|
|
||||||
])
|
|
||||||
Reference in New Issue
Block a user