5 files changed, 499 insertions, 0 deletions

diff --git a/hosts/skadhi/default.nix b/hosts/skadhi/default.nix
new file mode 100644
index 00000000..cf25777b
--- /dev/null
+++ b/hosts/skadhi/default.nix
@@ -0,0 +1,118 @@
+{ flake, flakeInputs, pkgs, config, lib, ... }:
+{
+  imports = with flake.nixosModules.systemProfiles; [
+    ./hw.nix ./fs.nix ./networking
+    tmpfs-root default-locale openssh lanzaboote zswap initrd-all-crypto-modules
+  ];
+
+  config = {
+    system.stateVersion = "26.05";
+
+    boot = {
+      initrd = {
+        systemd = {
+          emergencyAccess = config.users.users.root.hashedPassword;
+          extraBin = {
+            "vim" = lib.getExe pkgs.vim;
+            "grep" = lib.getExe pkgs.gnugrep;
+          };
+        };
+
+        kernelModules = [ "dm-integrity" ];
+      };
+
+      lanzaboote.configurationLimit = 15;
+      loader = {
+        efi.canTouchEfiVariables = true;
+        timeout = null;
+      };
+
+      plymouth.enable = true;
+
+      kernelPackages = pkgs.linuxPackages_7_2;
+      consoleLogLevel = 3;
+      kernelParams = [
+        "quiet"
+        "boot.shell_on_fail"
+        "udev.log_priority=3"
+        "rd.systemd.show_status=auto"
+        "plymouth.use-simpledrm"
+      ];
+
+      tmp.useTmpfs = true;
+    };
+
+    services.timesyncd.enable = false;
+    services.chrony = {
+      enable = true;
+      enableNTS = true;
+      servers = [];
+      extraConfig = ''
+        pool time.cloudflare.com iburst nts
+        pool nts.netnod.se prefer iburst nts
+        server ptbtime1.ptb.de prefer iburst nts
+        server ptbtime2.ptb.de prefer iburst nts
+        server ptbtime3.ptb.de prefer iburst nts
+        server ptbtime4.ptb.de prefer iburst nts
+        pool ntppool1.time.nl prefer iburst nts
+        pool ntppool2.time.nl prefer iburst nts
+
+        authselectmode require
+        minsources 3
+
+        nocerttimecheck 1
+
+        leapsectz right/UTC
+
+        makestep 0.1 3
+
+        cmdport 0
+      '';
+    };
+
+    services.userborn.importLegacyState = false;
+
+    services.kmscon = {
+      enable = true;
+      config.hwaccel = true;
+    };
+
+    environment.persistence."/persistent".timezone = true;
+    time.timeZone = null;
+    systemd.tmpfiles.settings = {
+      "10-localtime"."/etc/localtime".L.argument = "/persistent/etc/localtime";
+    };
+
+    services.openssh.enable = true;
+
+    services.logind.settings.Login = {
+      HandleLidSwitch = "sleep";
+      HandleLidSwitchExternalPower = "ignore";
+    };
+
+    systemd.timers.nix-gc = lib.mkForce {
+      timerConfig = {
+        RandomizedDelaySec = "12h";
+        Persistent = true;
+        OnCalendar = "*-*-* 18:00:00 Europe/Berlin";
+      };
+      wantedBy = [ "timers.target" ];
+    };
+    systemd.services.nix-gc = lib.mkForce {
+      description = "Nix Garbage Collector";
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = pkgs.resholve.writeScript "nix-gc" {
+          interpreter = lib.getExe pkgs.zsh;
+          inputs = [ pkgs.coreutils config.nix.package ];
+          execer = [ "cannot:${lib.getExe' config.nix.package "nix-collect-garbage"}" ];
+        } ''
+          max_size=$(($(du -bs /nix/store | cut -f 1) - 1024**4))
+          [[ $max_size -gt 0 ]] || exit 0
+          exec nix-collect-garbage -vv --max-freed $max_size --delete-older-than 30d
+        '';
+      };
+      restartIfChanged = false;
+    };
+  };
+}
diff --git a/hosts/skadhi/fs.nix b/hosts/skadhi/fs.nix
new file mode 100644
index 00000000..41ef24f6
--- /dev/null
+++ b/hosts/skadhi/fs.nix
@@ -0,0 +1,86 @@
+{ flake, flakeInputs, pkgs, config, lib, ... }:
+{
+  imports = with flake.nixosModules.systemProfiles; [
+    disko
+  ];
+
+  config = {
+    fileSystems."/persistent".neededForBoot = true;
+    environment.persistence."/persistent" = {
+      hideMounts = true;
+      directories = [
+        "/nix"
+        "/root"
+        "/var/log"
+        "/var/lib/nixos"
+        "/var/lib/sops-nix"
+        "/var/lib/systemd"
+        "/var/lib/fprint"
+        "/var/lib/chrony"
+        "/var/lib/postfix"
+        config.boot.lanzaboote.pkiBundle
+      ];
+    };
+
+    disko.devices = {
+      disk.nvm = {
+        type = "disk";
+        device = "/dev/nvme0n1";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [
+                  "fmask=0033" "dmask=0022"
+                ];
+              };
+            };
+            luks = {
+              size = "100%";
+              content = {
+                type = "luks";
+                name = "nvm";
+                extraFormatArgs = [
+                  "--cipher" "aegis128-random"
+                  "--key-size" "128"
+                  "--integrity" "aead"
+                ];
+                content = {
+                  type = "btrfs";
+                  extraArgs = let
+                    dirs = map (p: "/persistent/${p}") ["/etc"];
+                    subvols = ["/persistent"] ++ map (p: "/persistent/${p}") ["/nix" "/var/log"];
+                    restricted = map (p: "/persistent/${p}") ["/root"];
+                  in [
+                    "--csum" "blake2"
+                    "--compress" "zstd:15"
+                    "--rootdir" (toString (pkgs.runCommand "rootdir" {
+                    } ''
+                      mkdir $out
+                      install -d ${lib.concatMapStringsSep " " (p: "$out/${p}") (dirs ++ subvols)}
+                      install -m 0700 -d ${lib.concatMapStringsSep " " (p: "$out/${p}") restricted}
+                      ln -s /etc/zoneinfo/UTC /persistent/etc/localtime
+                    ''))
+                  ] ++ lib.concatMap (p: ["--subvol" p]) (subvols ++ restricted);
+                  subvolumes = {
+                    "/persistent".mountpoint = "/persistent";
+                    "/swap" = {
+                      mountpoint = "/.swap";
+                      swap.swapfile.size = "96G";
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/hosts/skadhi/hw.nix b/hosts/skadhi/hw.nix
new file mode 100644
index 00000000..687f04d8
--- /dev/null
+++ b/hosts/skadhi/hw.nix
@@ -0,0 +1,20 @@
+{ flake, flakeInputs, pkgs, config, lib, ... }:
+{
+  imports = [
+    flakeInputs.nixos-hardware.nixosModules.framework-13-7040-amd
+  ];
+
+  config = {
+    hardware.framework.laptop13.audioEnhancement.enable = false;
+    hardware.enableRedistributableFirmware = true;
+    services.fstrim.enable = false;
+
+    services.udev.extraRules = ''
+      ACTION=="add", SUBSYSTEM=="platform", DRIVER=="acpi-button", KERNEL=="PNP0C0D:00", ATTR{power/wakeup}="disabled"
+      ACTION=="add", SUBSYSTEM=="serio", DRIVERS=="atkbd", ATTR{power/wakeup}="disabled"
+      ACTION=="add", SUBSYSTEM=="i2c", DRIVERS=="i2c_hid_acpi", ATTRS{name}=="PIXA3854:00", ATTR{power/wakeup}="disabled"
+   '';
+
+    nixpkgs.system = "x86_64-linux";
+  };
+}
diff --git a/hosts/skadhi/networking/default.nix b/hosts/skadhi/networking/default.nix
new file mode 100644
index 00000000..4d6edd97
--- /dev/null
+++ b/hosts/skadhi/networking/default.nix
@@ -0,0 +1,38 @@
+{ flake, config, ... }:
+{
+  imports = with flake.nixosModules.systemProfiles; [
+    networkmanager
+  ];
+
+  config = {
+    environment.persistence."/persistent".directories = [
+      "/etc/NetworkManager/system-connections"
+    ];
+
+    networking = {
+      domain = "yggdrasil";
+      search = [ "yggdrasil" ];
+      hosts = {
+        "127.0.0.1" = [ "${config.networking.hostName}.yggdrasil" config.networking.hostName ];
+        "::1" = [ "${config.networking.hostName}.yggdrasil" config.networking.hostName ];
+      };
+
+      firewall.enable = false;
+      nftables = {
+        enable = true;
+        rulesetFile = ./ruleset.nft;
+      };
+
+      useDHCP = false;
+      useNetworkd = true;
+    };
+
+    environment.etc."NetworkManager/dnsmasq.d/yggdrasil.conf" = {
+      text = ''
+        server=/yggdrasil/2a03:4000:52:ada:1:1::@yggdrasil
+        server=/141.10.in-addr.arpa/2a03:4000:52:ada:1:1::@yggdrasil
+        server=/1.0.0.0.a.d.a.0.2.5.0.0.0.0.0.4.3.0.a.2.ip6.arpa/2a03:4000:52:ada:1:1::@yggdrasil
+      '';
+    };
+  };
+}
diff --git a/hosts/skadhi/networking/ruleset.nft b/hosts/skadhi/networking/ruleset.nft
new file mode 100644
index 00000000..94e21b10
--- /dev/null
+++ b/hosts/skadhi/networking/ruleset.nft
@@ -0,0 +1,237 @@
+define icmp_protos = { ipv6-icmp, icmp, igmp }
+
+table arp filter {
+  limit lim_arp {
+    rate over 50 mbytes/second burst 50 mbytes
+  }
+
+  counter arp-rx {}
+  counter arp-tx {}
+
+  counter arp-ratelimit-rx {}
+  counter arp-ratelimit-tx {}
+
+  chain input {
+    type filter hook input priority filter
+    policy accept
+
+    limit name lim_arp counter name arp-ratelimit-rx drop
+
+    counter name arp-rx
+  }
+
+  chain output {
+    type filter hook output priority filter
+    policy accept
+
+    limit name lim_arp counter name arp-ratelimit-tx drop
+
+    counter name arp-tx
+  }
+}
+
+table inet filter {
+  limit lim_reject {
+    rate over 1000/second burst 1000 packets
+  }
+
+  limit lim_icmp {
+    rate over 50 mbytes/second burst 50 mbytes
+  }
+
+  counter invalid-fw {}
+
+  counter fw-lo {}
+
+  counter reject-ratelimit-fw {}
+  counter reject-fw {}
+  counter reject-tcp-fw {}
+  counter reject-icmp-fw {}
+
+
+  counter invalid-rx {}
+  counter rx-lo {}
+  counter invalid-local4-rx {}
+  counter invalid-local6-rx {}
+
+  counter icmp-ratelimit-rx {}
+  counter icmp-rx {}
+
+  counter ssh-rx {}
+  counter mosh-rx {}
+  counter wg-rx {}
+  counter yggdrasil-gre-rx {}
+  counter miniserve-rx {}
+  counter ausweisapp2-rx {}
+
+  counter established-rx {}
+
+  counter reject-ratelimit-rx {}
+  counter reject-rx {}
+  counter reject-tcp-rx {}
+  counter reject-icmp-rx {}
+
+
+  counter tx-lo {}
+
+  counter icmp-ratelimit-tx {}
+  counter icmp-tx {}
+
+  counter ssh-tx {}
+  counter mosh-tx {}
+  counter wg-tx {}
+  counter yggdrasil-gre-tx {}
+  counter miniserve-tx {}
+
+  counter tx {}
+
+  counter fw-libvirt {}
+  counter libvirt-dhcp {}
+  counter libvirt-dns {}
+
+
+  chain forward_tmp {}
+  chain forward {
+    type filter hook forward priority filter
+    policy drop
+
+
+    ct state invalid log level debug prefix "drop invalid forward: " counter name invalid-fw drop
+
+
+    iifname lo counter name fw-lo accept
+
+    jump forward_tmp
+
+    iifname virbr0 oifname != {lo, wgrz, yggdrasil-wg-4, yggdrasil-wg-6, yggdrasil, ip6tnl, ip6gre, yggre-surtr-6, yggre-surtr-4, yggre-vidhar-4} counter name fw-libvirt accept
+    oifname virbr0 ct state {established, related} counter name fw-libvirt accept
+
+
+    limit name lim_reject log level debug prefix "drop forward: " counter name reject-ratelimit-fw drop
+    log level debug prefix "reject forward: " counter name reject-fw
+    meta l4proto tcp ct state new counter name reject-tcp-fw reject with tcp reset
+    ct state new counter name reject-icmp-fw reject
+  }
+
+  ct helper ftp-standard {
+    type "ftp" protocol tcp
+  }
+  chain input_pr_tmp {
+    # tcp dport 2121 ct helper set "ftp-standard"
+  }
+  chain input_pr {
+    type filter hook prerouting priority 0
+
+    jump input_pr_tmp
+  }
+
+  chain input_tmp {
+    # tcp dport 2121 accept
+  }
+  chain input {
+    type filter hook input priority filter
+    policy drop
+
+
+    ct state invalid log level debug prefix "drop invalid input: " counter name invalid-rx drop
+
+
+    iifname lo counter name rx-lo accept
+    iif != lo ip daddr 127.0.0.1/8 counter name invalid-local4-rx reject
+    iif != lo ip6 daddr ::1/128 counter name invalid-local6-rx reject
+
+    meta l4proto $icmp_protos limit name lim_icmp counter name icmp-ratelimit-rx drop
+    meta l4proto $icmp_protos counter name icmp-rx accept
+
+    jump input_tmp
+
+    tcp dport 22 counter name ssh-rx accept
+    udp dport 60000-61000 counter name mosh-rx accept
+
+    tcp dport 8080 counter name miniserve-rx accept
+    udp dport 24727 counter name ausweisapp2-rx accept
+
+    udp dport 51820-51822 counter name wg-rx accept
+    iifname "yggdrasil-wg-*" meta l4proto gre counter name yggdrasil-gre-rx accept
+
+    iifname virbr0 udp dport 67 counter name libvirt-dhcp accept
+    iifname virbr0 udp dport 547 counter name libvirt-dhcp accept
+    iifname virbr0 udp dport 53 counter name libvirt-dns accept
+    iifname virbr0 tcp dport 53 counter name libvirt-dns accept
+
+    iifname wgrz ip saddr 10.200.116.1 meta l4proto gre counter accept
+
+    ct state {established, related} counter name established-rx accept
+
+
+    limit name lim_reject log level debug prefix "drop input: " counter name reject-ratelimit-rx drop
+    log level debug prefix "reject input: " counter name reject-rx
+    meta l4proto tcp ct state new counter name reject-tcp-rx reject with tcp reset
+    ct state new counter name reject-icmp-rx reject
+  }
+
+  chain output {
+    type filter hook output priority filter
+    policy accept
+
+
+    oifname lo counter name tx-lo accept
+
+    meta l4proto $icmp_protos limit name lim_icmp counter name icmp-ratelimit-tx drop
+    meta l4proto $icmp_protos counter name icmp-tx accept
+
+
+    tcp sport 22 counter name ssh-tx
+    udp sport 60000-61000 counter name mosh-tx
+
+    udp sport 51820-51822 counter name wg-tx
+    iifname "yggdrasil-wg-*" meta l4proto gre counter name yggdrasil-gre-tx
+
+    tcp sport 8080 counter name miniserve-tx accept
+
+    oifname virbr0 udp sport 67 counter name libvirt-dhcp accept
+    oifname virbr0 udp sport 547 counter name libvirt-dhcp accept
+    oifname virbr0 udp sport 53 counter name libvirt-dns accept
+    oifname virbr0 tcp sport 53 counter name libvirt-dns accept
+
+
+    counter name tx
+  }
+}
+
+table ip nat {
+  counter libvirt-nat {}
+
+  chain postrouting_tmp {}
+  chain postrouting {
+    type nat hook postrouting priority srcnat
+    policy accept
+
+    iifname virbr0 oifname != virbr0 counter name libvirt-nat masquerade
+    jump postrouting_tmp
+  }
+}
+
+table ip6 nat {
+  counter libvirt-nat {}
+
+  chain postrouting {
+    type nat hook postrouting priority srcnat
+    policy accept
+
+    iifname virbr0 oifname != virbr0 counter name libvirt-nat masquerade
+  }
+}
+
+table ip mss_clamp {
+  counter libvirt-mss-clamp {}
+
+  chain postrouting_tmp {}
+  chain postrouting {
+    type filter hook postrouting priority mangle
+    policy accept
+
+    iifname virbr0 oifname != virbr0 tcp flags & (syn|rst) == syn counter name libvirt-mss-clamp tcp option maxseg size set rt mtu
+    jump postrouting_tmp
+  }
+}