Compare commits
4 Commits
master
...
wip-comman
| Author | SHA1 | Date | |
|---|---|---|---|
|
3d478c8d37 | ||
|
|
e052a165ec | ||
|
|
5a9e975723 | ||
|
|
91d9098ae2 |
@@ -1,288 +0,0 @@
|
||||
{ config, pkgs, lib, inputs, ... }: let
|
||||
inherit (lib) mkOption types flip concatMapStringsSep optionalString concatStringsSep readFile mapAttrsToList literalExpression;
|
||||
inherit (builtins) attrValues;
|
||||
cfg = config.vacu;
|
||||
knownHosts = attrValues cfg.ssh.knownHosts;
|
||||
knownHostsText = (flip (concatMapStringsSep "\n") knownHosts
|
||||
(h: assert h.hostNames != [];
|
||||
optionalString h.certAuthority "@cert-authority " + concatStringsSep "," h.hostNames + " "
|
||||
+ (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
|
||||
)) + "\n";
|
||||
packageNames = lib.splitString "\n" ''
|
||||
nixos-rebuild
|
||||
nano
|
||||
vim
|
||||
wget
|
||||
screen
|
||||
tmux
|
||||
lsof
|
||||
htop
|
||||
mosh
|
||||
dnsutils
|
||||
iperf3
|
||||
nmap
|
||||
rsync
|
||||
ethtool
|
||||
sshfs
|
||||
ddrescue
|
||||
pciutils
|
||||
ncdu
|
||||
nix-index
|
||||
git
|
||||
pv
|
||||
unzip
|
||||
file
|
||||
ripgrep
|
||||
jq
|
||||
units
|
||||
tree
|
||||
rclone
|
||||
iputils
|
||||
ssh-to-age
|
||||
sops
|
||||
inetutils
|
||||
neovim
|
||||
diffutils
|
||||
findutils
|
||||
utillinux
|
||||
tzdata
|
||||
hostname
|
||||
man
|
||||
gnugrep
|
||||
gnused
|
||||
gnutar
|
||||
bzip2
|
||||
gzip
|
||||
xz
|
||||
zip
|
||||
unzip
|
||||
openssh
|
||||
dig
|
||||
bash
|
||||
git'';
|
||||
plainPackageOpts = map (name: { name = name; value = { enable = lib.mkDefault true; }; }) packageNames;
|
||||
packageOpts = lib.recursiveUpdate (builtins.listToAttrs plainPackageOpts) {
|
||||
nix-search-cli.package = inputs.nix-search-cli.packages.${pkgs.system}.default;
|
||||
nix-search-cli.enable = lib.mkDefault true;
|
||||
nix-inspect.package = inputs.nix-inspect.packages.${pkgs.system}.default;
|
||||
nix-inspect.enable = lib.mkDefault true;
|
||||
};
|
||||
in {
|
||||
imports = [ ./package-set.nix ];
|
||||
options = {
|
||||
vacu.ssh.authorizedKeys = mkOption {
|
||||
type = types.listOf types.str;
|
||||
};
|
||||
vacu.ssh.config = mkOption {
|
||||
type = types.lines;
|
||||
};
|
||||
# Straight copied from nixpkgs
|
||||
# https://github.com/NixOS/nixpkgs/blob/46397778ef1f73414b03ed553a3368f0e7e33c2f/nixos/modules/programs/ssh.nix
|
||||
vacu.ssh.knownHosts = mkOption {
|
||||
default = {};
|
||||
type = types.attrsOf (types.submodule ({ name, config, options, ... }: {
|
||||
options = {
|
||||
certAuthority = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
This public key is an SSH certificate authority, rather than an
|
||||
individual host's key.
|
||||
'';
|
||||
};
|
||||
hostNames = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ name ] ++ config.extraHostNames;
|
||||
defaultText = literalExpression "[ ${name} ] ++ config.${options.extraHostNames}";
|
||||
description = ''
|
||||
A list of host names and/or IP numbers used for accessing
|
||||
the host's ssh service. This list includes the name of the
|
||||
containing `knownHosts` attribute by default
|
||||
for convenience. If you wish to configure multiple host keys
|
||||
for the same host use multiple `knownHosts`
|
||||
entries with different attribute names and the same
|
||||
`hostNames` list.
|
||||
'';
|
||||
};
|
||||
extraHostNames = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [];
|
||||
description = ''
|
||||
A list of additional host names and/or IP numbers used for
|
||||
accessing the host's ssh service. This list is ignored if
|
||||
`hostNames` is set explicitly.
|
||||
'';
|
||||
};
|
||||
publicKey = mkOption {
|
||||
default = null;
|
||||
type = types.nullOr types.str;
|
||||
example = "ecdsa-sha2-nistp521 AAAAE2VjZHN...UEPg==";
|
||||
description = ''
|
||||
The public key data for the host. You can fetch a public key
|
||||
from a running SSH server with the {command}`ssh-keyscan`
|
||||
command. The public key should not include any host names, only
|
||||
the key type and the key itself.
|
||||
'';
|
||||
};
|
||||
publicKeyFile = mkOption {
|
||||
default = null;
|
||||
type = types.nullOr types.path;
|
||||
description = ''
|
||||
The path to the public key file for the host. The public
|
||||
key file is read at build time and saved in the Nix store.
|
||||
You can fetch a public key file from a running SSH server
|
||||
with the {command}`ssh-keyscan` command. The content
|
||||
of the file should follow the same format as described for
|
||||
the `publicKey` option. Only a single key
|
||||
is supported. If a host has multiple keys, use
|
||||
{option}`programs.ssh.knownHostsFiles` instead.
|
||||
'';
|
||||
};
|
||||
};
|
||||
}));
|
||||
description = ''
|
||||
The set of system-wide known SSH hosts. To make simple setups more
|
||||
convenient the name of an attribute in this set is used as a host name
|
||||
for the entry. This behaviour can be disabled by setting
|
||||
`hostNames` explicitly. You can use
|
||||
`extraHostNames` to add additional host names without
|
||||
disabling this default.
|
||||
'';
|
||||
example = literalExpression ''
|
||||
{
|
||||
myhost = {
|
||||
extraHostNames = [ "myhost.mydomain.com" "10.10.1.4" ];
|
||||
publicKeyFile = ./pubkeys/myhost_ssh_host_dsa_key.pub;
|
||||
};
|
||||
"myhost2.net".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILIRuJ8p1Fi+m6WkHV0KWnRfpM1WxoW8XAS+XvsSKsTK";
|
||||
"myhost2.net/dsa" = {
|
||||
hostNames = [ "myhost2.net" ];
|
||||
publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub;
|
||||
};
|
||||
}
|
||||
'';
|
||||
};
|
||||
vacu.nix.extraSubstituters = mkOption { type = types.listOf types.str; };
|
||||
vacu.nix.extraTrustedKeys = mkOption { type = types.listOf types.str; };
|
||||
};
|
||||
config = {
|
||||
vacu.packages = packageOpts;
|
||||
vacu.nix.extraSubstituters = [
|
||||
"https://nixcache.shelvacu.com/"
|
||||
"https://nix-community.cachix.org/"
|
||||
];
|
||||
vacu.nix.extraTrustedKeys = [
|
||||
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
||||
"nixcache.shelvacu.com:73u5ZGBpPRoVZfgNJQKYYBt9K9Io/jPwgUfuOLsJbsM="
|
||||
];
|
||||
assertions = flip mapAttrsToList cfg.ssh.knownHosts (name: data: {
|
||||
assertion = (data.publicKey == null && data.publicKeyFile != null) ||
|
||||
(data.publicKey != null && data.publicKeyFile == null);
|
||||
message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
|
||||
});
|
||||
vacu.ssh.authorizedKeys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC4LYvUe9dsQb9OaTDFI4QKPtMmOHOGLwWsXsEmcJW86" # Termux on pixel6pro
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHcYwYy9/0Gu/GsqS72Nkz6OkId+zevqXA/aTIcvqflp" # t460s windows
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFsErA6M9LSHj2hPlLuHD8Lpei7WjMup1JxI1vxA6B8W" # pixel6pro nix-on-droid
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKoy1TrmfhBGWtVedgOM1FB1oD2UdodN3LkBnnLx6Tug" # compute-deck
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICVeSzDkGTueZijB0xUa08e06ovAEwwZK/D+Cc7bo91g" # triple-dezert
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtwtao/TXbiuQOYJbousRPVesVcb/2nP0PCFUec0Nv8" # triple-dezert (root)
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAxAFFxQMXAgi+0cmGaNE/eAkVfEl91wafUqFIuAkI5I" # compute-deck (root)
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDcRDekd8ZOYfQS5X95/yNof3wFYIbHqWeq4jY0+ywQX" # pro1x nix-on-droid
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExSObd1lZprdqAFLqFhtxDEckV0q/vZZIYqrYFKfkoC" # devver
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGHLPOxRd68+DJ/bYmqn0wsgwwIcMSMyuU1Ya16hCb/m" # fw (root)
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINQ2c0GzlVMjV06CS7bWbCaAbzG2+7g5FCg/vClJPe0C" # fw
|
||||
];
|
||||
vacu.ssh.config = ''
|
||||
Host deckvacu
|
||||
User deck
|
||||
|
||||
Host rsb
|
||||
User user
|
||||
HostName finaltask.xyz
|
||||
Port 2222
|
||||
|
||||
Host awoo
|
||||
HostName 45.142.157.71
|
||||
|
||||
Host trip
|
||||
HostName trip.shelvacu.com
|
||||
Port 6922
|
||||
|
||||
Host liam
|
||||
HostName 178.128.79.152
|
||||
|
||||
Host pluto
|
||||
HostName pluto.somevideogam.es
|
||||
|
||||
Host *
|
||||
User shelvacu
|
||||
GlobalKnownHostsFile ${pkgs.writeText "known_hosts" knownHostsText}
|
||||
'';
|
||||
|
||||
vacu.ssh.knownHosts = {
|
||||
#public hosts
|
||||
"github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
|
||||
"gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
|
||||
|
||||
#colin's stuff
|
||||
"uninsane.org" = {
|
||||
extraHostNames = [ "git.uninsane.org" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfdSmFkrVT6DhpgvFeQKm3Fh9VKZ9DbLYOPOJWYQ0E8";
|
||||
};
|
||||
"desko" = {
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFw9NoRaYrM6LbDd3aFBc4yyBlxGQn8HjeHd/dZ3CfHk";
|
||||
};
|
||||
|
||||
#daymocker's stuff
|
||||
"pluto" = {
|
||||
extraHostNames = [ "74.208.184.137" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICpHY4fLZ1hNuB2oRQM7R3b4eQyIHbFB45ZYp3XCELLg";
|
||||
};
|
||||
|
||||
#personal hosts
|
||||
"zigbee-hub" = {
|
||||
extraHostNames = [ "10.78.79.114" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJxwUYddOxgViJDOiokfaQ6CsCx/Sw+b3IisdJv8zFN root@zigbee-hub";
|
||||
};
|
||||
trip = {
|
||||
extraHostNames = [ "triple-dezert" "trip.shelvacu.com" "[trip.shelvacu.com]:6922" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGUQux9V0mSF5IauoO1z311NXR7ymEbwRMzT+OaaNQr+";
|
||||
};
|
||||
servacu = {
|
||||
extraHostNames = [ "mail.dis8.net" "servacu.shelvacu.com" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE+E6na7np0HnBV2X7owno+Fg+bNNRSHLxO6n1JzdUTV";
|
||||
};
|
||||
finaltask = {
|
||||
extraHostNames = [ "rsb" "finaltask.xyz" "[finaltask.xyz]:2222" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTx8WBNNKBVRV98HgDChpd59SHbreJ87SXU+zOKan6y";
|
||||
};
|
||||
compute-deck = {
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGt43GmXCxkl5QjgPQ/QimW11lKfXmV4GFWvlxQSf4TQ";
|
||||
};
|
||||
"2esrever" = {
|
||||
extraHostNames = [ "10.4.5.218" "10.244.46.71" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH0LnPrJxAdffZ//uRe3NBiIfFCBNMLqKVylkyU0llvT";
|
||||
};
|
||||
awoo = {
|
||||
extraHostNames = [ "45.142.157.71" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQaDjjfSK8jnk9aFIiYH9LZO4nLY/oeAc7BKIPUXMh1";
|
||||
};
|
||||
deckvacu = {
|
||||
publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEa8qpFkIlLLJkH8rmEAn6/MZ9ilCGmEQWC3CeFae7r1kOqfwRk0nq0oyOGJ50uIh+PpwEh3rbgq6mLfpRfsFmM=";
|
||||
};
|
||||
liam = {
|
||||
extraHostNames = [ "liam.dis8.net" "178.128.79.152" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHOqJYVHOIFmEA5uRbbirIupWvyBLAFwic/8EZQRdN/c";
|
||||
};
|
||||
devver = {
|
||||
extraHostNames = [ "devver.t2d.lan" "10.78.79.10" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeFaH2tzWIiCPdKNmxl3NqCnPTdmVIOBinauUAEl+UU";
|
||||
};
|
||||
fw = {
|
||||
extraHostNames = [ "fw.t2d.lan" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA6lX25mCy35tf1NpcHMAdeRgvT7l0Dw0FWBH3eX4TE2";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,81 +0,0 @@
|
||||
{ lib, pkgs, config, inputs, utils, ... }:
|
||||
{
|
||||
imports = [ ./common-config.nix ];
|
||||
options.vacu.acmeCertDependencies = lib.mkOption {
|
||||
default = {};
|
||||
example = ''
|
||||
vacu.acmeCertDependencies."mail.example.com" = [ "postfix.service" ];
|
||||
'';
|
||||
type = lib.types.attrsOf (lib.types.listOf utils.systemdUtils.lib.unitNameType);
|
||||
};
|
||||
config = let
|
||||
for-systemd-services = lib.concatMapAttrs
|
||||
(cert: units:
|
||||
{
|
||||
"acme-selfsigned-${cert}" = {
|
||||
wantedBy = units;
|
||||
before = units;
|
||||
};
|
||||
}
|
||||
)
|
||||
config.vacu.acmeCertDependencies;
|
||||
for-security-acme-certs = lib.concatMapAttrs
|
||||
(cert: units:
|
||||
{
|
||||
${cert}.reloadServices = units;
|
||||
}
|
||||
)
|
||||
config.vacu.acmeCertDependencies;
|
||||
in {
|
||||
console = {
|
||||
keyMap = lib.mkDefault "us";
|
||||
};
|
||||
vacu.packages."xorg-xev" = {
|
||||
enable = config.services.xserver.enable;
|
||||
package = pkgs.xorg.xev;
|
||||
};
|
||||
environment.systemPackages = config.vacu.packageList;
|
||||
|
||||
i18n.defaultLocale = lib.mkDefault "en_US.UTF-8";
|
||||
time.timeZone = "America/Los_Angeles";
|
||||
|
||||
users.users.shelvacu = {
|
||||
openssh.authorizedKeys.keys = config.vacu.ssh.authorizedKeys;
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
};
|
||||
systemd.services = for-systemd-services;
|
||||
security.acme.certs = for-security-acme-certs;
|
||||
services.openssh = {
|
||||
# require public key authentication for better security
|
||||
settings.PasswordAuthentication = false;
|
||||
settings.KbdInteractiveAuthentication = false;
|
||||
settings.PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
|
||||
nix.settings.trusted-users = [ "shelvacu" ];
|
||||
security.sudo.wheelNeedsPassword = lib.mkDefault false;
|
||||
|
||||
programs.screen = {
|
||||
screenrc = ''
|
||||
defscrollback 10000
|
||||
termcapinfo xterm* ti@:te@
|
||||
'';
|
||||
} // (if config.system.nixos.release == "23.11" then {} else { enable = true; });
|
||||
|
||||
programs.tmux.enable = true;
|
||||
programs.tmux.extraConfig = "setw mouse";
|
||||
programs.tmux.clock24 = true;
|
||||
|
||||
nix.settings = {
|
||||
experimental-features = [ "nix-command" "flakes" ];
|
||||
substituters = config.vacu.nix.extraSubstituters;
|
||||
trusted-public-keys = config.vacu.nix.extraTrustedKeys;
|
||||
};
|
||||
nixpkgs.config.allowUnfree = lib.mkDefault true;
|
||||
|
||||
programs.mosh.enable = lib.mkDefault true;
|
||||
|
||||
programs.ssh.extraConfig = config.vacu.ssh.config;
|
||||
};
|
||||
}
|
||||
@@ -1,37 +0,0 @@
|
||||
{ pkgs, inputs }: (with pkgs; [
|
||||
inputs.nix-search-cli.packages.${pkgs.system}.default
|
||||
inputs.nix-inspect.packages.${pkgs.system}.default
|
||||
nixos-rebuild
|
||||
nano
|
||||
vim
|
||||
wget
|
||||
screen
|
||||
tmux
|
||||
lsof
|
||||
htop
|
||||
mosh
|
||||
dnsutils
|
||||
iperf3
|
||||
nmap
|
||||
rsync
|
||||
ethtool
|
||||
sshfs
|
||||
ddrescue
|
||||
pciutils
|
||||
ncdu
|
||||
nix-index
|
||||
git
|
||||
pv
|
||||
unzip
|
||||
file
|
||||
ripgrep
|
||||
jq
|
||||
units
|
||||
tree
|
||||
rclone
|
||||
iputils
|
||||
ssh-to-age
|
||||
sops
|
||||
inetutils
|
||||
neovim
|
||||
])
|
||||
Reference in New Issue
Block a user