summaryrefslogtreecommitdiff
path: root/hosts/eostre
diff options
context:
space:
mode:
authorGregor Kleen <gkleen@yggdrasil.li>2022-11-02 00:11:28 +0100
committerGregor Kleen <gkleen@yggdrasil.li>2022-11-02 00:11:28 +0100
commit42984e77041cfc95d333319bef0b2d8f441f56d3 (patch)
tree848bf7ee0ebd5d01dd20184d662230d42d5bf7b0 /hosts/eostre
parent9cc83652e3b922a8bca5c4684bbc34a6589b9aa5 (diff)
downloadnixos-42984e77041cfc95d333319bef0b2d8f441f56d3.tar
nixos-42984e77041cfc95d333319bef0b2d8f441f56d3.tar.gz
nixos-42984e77041cfc95d333319bef0b2d8f441f56d3.tar.bz2
nixos-42984e77041cfc95d333319bef0b2d8f441f56d3.tar.xz
nixos-42984e77041cfc95d333319bef0b2d8f441f56d3.zip
eos → eostre
Diffstat (limited to 'hosts/eostre')
-rw-r--r--hosts/eostre/default.nix104
-rw-r--r--hosts/eostre/ruleset.nft101
2 files changed, 205 insertions, 0 deletions
diff --git a/hosts/eostre/default.nix b/hosts/eostre/default.nix
new file mode 100644
index 00000000..4aa6473e
--- /dev/null
+++ b/hosts/eostre/default.nix
@@ -0,0 +1,104 @@
1{ flake, config, pkgs, lib, ... }:
2
3with lib;
4
5{
6 imports = with flake.nixosModules.systemProfiles; [
7 nfsroot
8 ];
9
10 config = {
11 nixpkgs = {
12 system = "x86_64-linux";
13 config = {
14 allowUnfree = true;
15 };
16 };
17
18 boot = {
19 initrd = {
20 availableKernelModules = [ "nvme" "ahci" "xhci_pci" "usbhid" "sd_mod" "sr_mod" ];
21 kernelModules = [ "igb" ];
22 };
23 kernelModules = [ "kvm-amd" ];
24 extraModulePackages = [ ];
25
26 plymouth.enable = true;
27
28 tmpOnTmpfs = true;
29 };
30
31 hardware = {
32 enableRedistributableFirmware = true;
33 cpu.amd.updateMicrocode = config.hardware.enableRedistributableFirmware;
34
35 nvidia = {
36 modesetting.enable = true;
37 powerManagement.enable = true;
38 };
39
40 opengl.enable = true;
41 };
42
43 environment.etc."machine-id".text = "f457b21333f1491e916521151ff5d468";
44
45 networking = {
46 hostId = "f457b213";
47
48 domain = "lan.yggdrasil";
49 search = [ "lan.yggdrasil" "yggdrasil" ];
50
51 hosts = {
52 "127.0.0.1" = [ "eostre.lan.yggdrasil" "eostre" ];
53 "::1" = [ "eostre.lan.yggdrasil" "eostre" ];
54 };
55
56 firewall.enable = false;
57 nftables = {
58 enable = true;
59 rulesetFile = ./ruleset.nft;
60 };
61 };
62
63 services.resolved = {
64 llmnr = "false";
65 };
66
67 zramSwap.enable = true;
68
69 system.stateVersion = config.system.nixos.release; # No state
70 security.sudo.extraConfig = ''
71 Defaults lecture = never
72 '';
73
74
75 time.timeZone = "Europe/Berlin";
76 time.hardwareClockInLocalTime = true;
77 i18n.defaultLocale = "en_DK.UTF-8";
78
79
80 environment.systemPackages = with pkgs; [ cifs-utils ];
81
82 security.pam.mount = {
83 enable = true;
84 extraVolumes = [
85 "<volume sgrp=\"users\" fstype=\"cifs\" server=\"vidhar.lan.yggdrasil\" path=\"home-eostre\" mountpoint=\"~\" />"
86 "<volume sgrp=\"users\" fstype=\"cifs\" server=\"vidhar.lan.yggdrasil\" path=\"%(USER)\" mountpoint=\"/run/media/%(USER)/vidhar\" />"
87 ];
88 };
89
90
91 services.xserver = {
92 enable = true;
93 displayManager.sddm = {
94 enable = true;
95 settings = {
96 Users.HideUsers = "gkleen";
97 };
98 };
99 desktopManager.plasma5.enable = true;
100
101 videoDrivers = [ "nvidia" ];
102 };
103 };
104}
diff --git a/hosts/eostre/ruleset.nft b/hosts/eostre/ruleset.nft
new file mode 100644
index 00000000..7b38a059
--- /dev/null
+++ b/hosts/eostre/ruleset.nft
@@ -0,0 +1,101 @@
1define icmp_protos = {ipv6-icmp, icmp, igmp}
2
3table arp filter {
4 limit lim_arp {
5 rate over 50 mbytes/second burst 50 mbytes
6 }
7
8 chain input {
9 type filter hook input priority filter
10 policy accept
11
12 limit name lim_arp counter drop
13
14 counter
15 }
16
17 chain output {
18 type filter hook output priority filter
19 policy accept
20
21 limit name lim_arp counter drop
22
23 counter
24 }
25}
26
27table inet filter {
28 limit lim_reject {
29 rate over 1000/second burst 1000 packets
30 }
31
32 limit lim_icmp {
33 rate over 50 mbytes/second burst 50 mbytes
34 }
35
36
37 chain forward {
38 type filter hook forward priority filter
39 policy drop
40
41
42 ct state invalid log level debug prefix "drop invalid forward: " counter drop
43
44
45 iifname lo counter accept
46
47
48 limit name lim_reject log level debug prefix "drop forward: " counter drop
49 log level debug prefix "reject forward: " counter
50 meta l4proto tcp ct state new counter reject with tcp reset
51 ct state new counter reject
52
53
54 counter
55 }
56
57 chain input {
58 type filter hook input priority filter
59 policy drop
60
61
62 ct state invalid log level debug prefix "drop invalid input: " counter drop
63
64
65 iifname lo counter accept
66 iif != lo ip daddr 127.0.0.1/8 counter reject
67 iif != lo ip6 daddr ::1/128 counter reject
68
69 meta l4proto $icmp_protos limit name lim_icmp counter drop
70 meta l4proto $icmp_protos counter accept
71
72 tcp dport 22 counter accept
73 udp dport 60000-61000 counter accept
74
75
76 ct state {established, related} counter accept
77
78
79 limit name lim_reject log level debug prefix "drop input: " counter drop
80 log level debug prefix "reject input: " counter
81 meta l4proto tcp ct state new counter reject with tcp reset
82 ct state new counter reject
83
84
85 counter
86 }
87
88 chain output {
89 type filter hook output priority filter
90 policy accept
91
92
93 oifname lo counter accept
94
95 meta l4proto $icmp_protos limit name lim_icmp counter drop
96 meta l4proto $icmp_protos counter accept
97
98
99 counter
100 }
101} \ No newline at end of file