major refactor

mod/common/default.nix

@@ -0,0 +1,71 @@
+{
+  var,
+  inputs,
+  lib,
+  config,
+  ...
+}:
+with lib;
+{
+  options.hd.common.enable = mkOption {
+    type = types.bool;
+    default = true;
+    description = "Common options that are used on every host by default.";
+  };
+
+  options.hd.common = {
+    locale = {
+      enable = mkOption {
+        type = types.bool;
+        default = config.hd.common.enable;
+        description = "Enable locale settings";
+      };
+    };
+
+    nix = {
+      enable = mkOption {
+        type = types.bool;
+        default = config.hd.common.enable;
+        description = "Enable Nix-related configuration";
+      };
+    };
+
+    security = {
+      enable = mkOption {
+        type = types.bool;
+        default = config.hd.common.enable;
+        description = "Enable security-related configuration";
+      };
+    };
+
+    shell = {
+      enable = mkOption {
+        type = types.bool;
+        default = config.hd.common.enable;
+        description = "Enable basic shell utilities";
+      };
+    };
+
+    users = {
+      enable = mkOption {
+        type = types.bool;
+        default = config.hd.common.enable;
+        description = "Enable default user accounts";
+      };
+    };
+  };
+
+  imports = [
+    inputs.agenix.nixosModules.default
+    ./locale.nix
+    ./nix.nix
+    ./security.nix
+    ./shell.nix
+    ./users.nix
+  ];
+
+  config = mkIf config.hd.common.enable {
+    environment.defaultPackages = [ ];
+    networking.extraHosts = var.lan-dns.hostsFile;
+  };
+}

mod/common/locale.nix

@@ -0,0 +1,28 @@
+{ config, lib, ... }:
+with lib;
+{
+  config = mkIf config.hd.common.locale.enable {
+    time.timeZone = "Europe/Berlin";
+
+    i18n.defaultLocale = "en_US.UTF-8";
+    i18n.extraLocaleSettings = {
+      LC_ADDRESS = "de_DE.UTF-8";
+      LC_IDENTIFICATION = "de_DE.UTF-8";
+      LC_MEASUREMENT = "de_DE.UTF-8";
+      LC_MONETARY = "de_DE.UTF-8";
+      LC_NAME = "de_DE.UTF-8";
+      LC_NUMERIC = "de_DE.UTF-8";
+      LC_PAPER = "de_DE.UTF-8";
+      LC_TELEPHONE = "de_DE.UTF-8";
+      LC_TIME = "de_DE.UTF-8";
+    };
+
+    console.keyMap = "de";
+
+    # Configure keymap in X11
+    services.xserver.xkb = {
+      layout = "de";
+      variant = "";
+    };
+  };
+}

mod/common/nix.nix

@@ -0,0 +1,24 @@
+{
+  lib,
+  inputs,
+  config,
+  ...
+}:
+with lib;
+{
+  config = mkIf config.hd.common.nix.enable {
+    nix.settings = {
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      trusted-users = [ "root" ];
+      auto-optimise-store = true;
+    };
+    nix.registry = {
+      hd.flake = inputs.self;
+      nixpkgs.flake = inputs.nixpkgs;
+    };
+    nixpkgs.config.allowUnfree = false;
+  };
+}

mod/common/security.nix

@@ -0,0 +1,104 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib;
+{
+  config = mkIf config.hd.common.security.enable {
+    boot = {
+      kernel.sysctl = {
+        "net.ipv4.icmp_ignore_bogus_error_responses" = 1;
+
+        "net.ipv4.conf.default.rp_filter" = 1;
+        "net.ipv4.conf.all.rp_filter" = 1;
+
+        "net.ipv4.conf.all.accept_source_route" = 0;
+        "net.ipv6.conf.all.accept_source_route" = 0;
+        "net.ipv4.conf.all.send_redirects" = 0;
+        "net.ipv4.conf.default.send_redirects" = 0;
+        "net.ipv4.conf.all.accept_redirects" = 0;
+        "net.ipv4.conf.default.accept_redirects" = 0;
+        "net.ipv4.conf.all.secure_redirects" = 0;
+        "net.ipv4.conf.default.secure_redirects" = 0;
+        "net.ipv6.conf.all.accept_redirects" = 0;
+        "net.ipv6.conf.default.accept_redirects" = 0;
+
+        "net.ipv4.tcp_syncookies" = 1;
+        "net.ipv4.tcp_rfc1337" = 1;
+
+        "net.ipv4.tcp_fastopen" = 3;
+
+        "kernel.kptr_restrict" = 2;
+        "randomize_kstack_offset" = "on";
+        "spec_store_bypass_disable" = "on";
+      };
+      # otherwise /tmp is on disk. This *may* be problematic as nix
+      # builds in /tmp but I think my swap is large enough...
+      tmp.useTmpfs = lib.mkDefault true;
+      tmp.cleanOnBoot = lib.mkDefault (!config.boot.tmp.useTmpfs);
+
+      kernelParams = [
+        "init_on_free=1" # zero freed pages
+        "page_alloc.shuffle=1"
+        "page_poison=1"
+        "slab_nomerge"
+        # "slub_debug=FZ" # disabled due to https://lore.kernel.org/all/20210601182202.3011020-5-swboyd@chromium.org/T/#u
+        "vsyscall=none" # diable virtual syscalls
+      ];
+
+      blacklistedKernelModules = [
+        "ax25"
+        "netrom"
+        "rose"
+        "adfs"
+        "affs"
+        "bfs"
+        "befs"
+        "cramfs"
+        "efs"
+        "erofs"
+        "exofs"
+        "freevxfs"
+        "f2fs"
+        "hfs"
+        "hpfs"
+        "jfs"
+        "minix"
+        "nilfs2"
+        "ntfs"
+        "omfs"
+        "qnx4"
+        "qnx6"
+        "sysv"
+        "ufs"
+      ];
+    };
+
+    networking.firewall.enable = true;
+
+    security = {
+      protectKernelImage = true;
+      forcePageTableIsolation = true;
+
+      apparmor.enable = true;
+      apparmor.killUnconfinedConfinables = true;
+
+      sudo.enable = false;
+
+      doas = {
+        enable = true;
+        extraRules = [
+          {
+            groups = [ "wheel" ];
+            persist = true;
+            keepEnv = true;
+          }
+        ];
+      };
+
+      pki.certificateFiles = [ ../../pki/ca.cert ];
+    };
+  };
+}

mod/common/shell.nix

@@ -0,0 +1,56 @@
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
+with lib;
+{
+  config = mkIf config.hd.common.shell.enable {
+    environment.shells = with pkgs; [
+      bashInteractive
+      fish
+    ];
+
+    environment.systemPackages = with pkgs; [
+      colmena
+      dnsutils
+      fd
+      htop
+      killall
+      nettools
+      podman-compose
+      podman-tui
+      ripgrep
+      unison
+      unzip
+      wget
+    ];
+
+    programs = {
+      fish.enable = true;
+      tmux = {
+        enable = true;
+        clock24 = true;
+      };
+      neovim = {
+        enable = true;
+        defaultEditor = true;
+        viAlias = true;
+        vimAlias = true;
+      };
+    };
+
+    # --- Excludes ---
+    programs.nano.enable = false;
+
+    # Enabled by fish but takes soooo long.
+    # This is apparently used by some of fish's
+    # autocomplete features.
+    documentation.man.generateCaches = false;
+
+    # To stop the annoying error on entering wrong commands
+    programs.command-not-found.enable = false;
+  };
+}

mod/common/users.nix

@@ -0,0 +1,36 @@
+{
+  config,
+  lib,
+  options,
+  pkgs,
+  secrets,
+  var,
+  ...
+}:
+with lib;
+{
+  config = mkIf config.hd.common.users.enable {
+    age.secrets.hd-password = {
+      file = secrets."hd-password.age";
+    };
+
+    users = {
+      mutableUsers = false;
+      users."hd" = {
+        description = "Henri";
+        isNormalUser = true;
+        createHome = true;
+        home = "/home/hd";
+        extraGroups = [ "wheel" ];
+        shell = pkgs.fish;
+        packages = [ ];
+        openssh.authorizedKeys.keys = var.ssh-keys.trusted;
+        hashedPasswordFile = config.age.secrets.hd-password.path;
+      };
+      users.root = {
+        hashedPassword = "!";
+        openssh.authorizedKeys.keys = var.ssh-keys.root;
+      };
+    };
+  };
+}