From 6e8014e0b510dabb3dd2064a204c9b3a64a511e4 Mon Sep 17 00:00:00 2001 From: gwg313 Date: Fri, 20 Sep 2024 15:26:06 -0400 Subject: [PATCH] some updates --- common/networking/default.nix | 2 + common/networking/wireless.nix | 44 +++++++++++++++ common/nixos/laptop.nix | 6 +- common/nixos/ssh/ssh.nix | 56 +++++++++++++++++-- common/nixos/ssh/ssh_client.nix | 1 + home-manager/modules/neovim/plugins/cmp.nix | 4 +- .../modules/neovim/plugins/default.nix | 1 + home-manager/modules/neovim/plugins/lsp.nix | 2 + .../modules/neovim/plugins/vimtex.nix | 15 +++++ home-manager/modules/tmux/tmux.nix | 18 ++++++ home-manager/modules/zsh.nix | 8 ++- hosts/candlekeep/configuration.nix | 3 +- secrets/secrets.yaml | 7 ++- 13 files changed, 153 insertions(+), 14 deletions(-) create mode 100644 common/networking/wireless.nix create mode 100644 home-manager/modules/neovim/plugins/vimtex.nix diff --git a/common/networking/default.nix b/common/networking/default.nix index 5552711..0590c0c 100644 --- a/common/networking/default.nix +++ b/common/networking/default.nix @@ -2,8 +2,10 @@ imports = [ ./zerotier.nix ./firewall.nix + ./wireless.nix ]; zerotier.enable = lib.mkDefault true; firewall.enable = lib.mkDefault true; + wireless.enable = lib.mkDefault false; } diff --git a/common/networking/wireless.nix b/common/networking/wireless.nix new file mode 100644 index 0000000..3318f2b --- /dev/null +++ b/common/networking/wireless.nix @@ -0,0 +1,44 @@ +{ + config, + lib, + pkgs, + ... +}: { + options = { + wireless.enable = lib.mkEnableOption "Enables Wifi and adds my networks"; + }; + config = lib.mkIf config.wireless.enable { + sops.secrets."wireless.env" = {}; + networking.wireless.enable = true; + environment.systemPackages = with pkgs; [wpa_supplicant_gui]; + networking.wireless.userControlled.enable = true; + networking.wireless.environmentFile = config.sops.secrets."wireless.env".path; + networking.wireless.networks = { + "@home_uuid@" = { + psk = "@home_psk@"; + priority = 99; + }; + "@school_uuid@" = { + auth = '' + key_mgmt=WPA-EAP + eap=PEAP + phase2="auth=MSCHAPV2" + identity="@school_identity@" + password="@school_password@" + ''; + priority = 89; + }; + + "eduroam" = { + auth = '' + key_mgmt=WPA-EAP + eap=PEAP + phase2="auth=MSCHAPV2" + identity="@eduroam_identity@" + password="@school_password@" + ''; + priority = 79; + }; + }; + }; +} diff --git a/common/nixos/laptop.nix b/common/nixos/laptop.nix index 1dbf5d3..fa5cbc4 100644 --- a/common/nixos/laptop.nix +++ b/common/nixos/laptop.nix @@ -3,7 +3,10 @@ lib, ... }: { - imports = [./bluetooth.nix]; + imports = [ + ./bluetooth.nix + ../networking/wireless.nix + ]; options = { laptop.enable = lib.mkEnableOption "Enables Laptop options"; }; @@ -16,5 +19,6 @@ services.tlp.enable = true; bluetooth.enable = true; + wireless.enable = true; }; } diff --git a/common/nixos/ssh/ssh.nix b/common/nixos/ssh/ssh.nix index 45e5b6a..00864b1 100644 --- a/common/nixos/ssh/ssh.nix +++ b/common/nixos/ssh/ssh.nix @@ -58,7 +58,17 @@ PermitRootLogin = "no"; # nix enables pam by default - #UsePam = true; + # UsePAM = false; + + # challenge-response authentication backend it not configured by default + # therefore, it is set to "no" by default to avoid the use of an unconfigured backend + ChallengeResponseAuthentication = false; + + # set maximum authentication retries to prevent brute force attacks + MaxAuthTries = 3; + + # disallow connecting using empty passwords + PermitEmptyPasswords = false; ########## Cryptography ########## @@ -66,9 +76,28 @@ # AES CTR modes have been removed to mitigate the Terrapin attack # https://terrapin-attack.com/ - Ciphers = ["aes256-gcm@openssh.com" "aes128-gcm@openssh.com"]; - Macs = ["hmac-sha2-256-etm@openssh.com" "hmac-sha2-512-etm@openssh.com" "umac-128-etm@openssh.com"]; - KexAlgorithms = ["curve25519-sha256" "curve25519-sha256@libssh.org" "diffie-hellman-group16-sha512" "diffie-hellman-group18-sha512"]; + Ciphers = [ + "aes256-gcm@openssh.com" + "aes128-gcm@openssh.com" + ]; + Macs = [ + "hmac-sha2-256-etm@openssh.com" + "hmac-sha2-512-etm@openssh.com" + "umac-128-etm@openssh.com" + ]; + KexAlgorithms = [ + "sntrup761x25519-sha512@openssh.com" + "curve25519-sha256" + "curve25519-sha256@libssh.org" + "diffie-hellman-group16-sha512" + "diffie-hellman-group18-sha512" + ]; + + # hostKeyAlgorithms = [ + # "rsa-sha2-512" + # "rsa-sha2-256" + # "ssh-ed25519" + # ]; ########## Connection Preferences ########## @@ -97,7 +126,26 @@ # allow a maximum of two multiplexed sessions over a single TCP connection MaxSessions = 2; + + # let ClientAliveInterval handle keepalive + TCPKeepAlive = false; + + # disable reverse DNS lookups + # UseDNS = false; }; + extraConfig = '' + ########## Features ########## + + # accept locale-related environment variables + AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES + AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT + AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE + AcceptEnv XMODIFIERS + + ########## Connection Preferences ########## + # disable reverse DNS lookups + UseDNS no + ''; }; }; } diff --git a/common/nixos/ssh/ssh_client.nix b/common/nixos/ssh/ssh_client.nix index 6939cea..6aab355 100644 --- a/common/nixos/ssh/ssh_client.nix +++ b/common/nixos/ssh/ssh_client.nix @@ -34,6 +34,7 @@ "umac-128-etm@openssh.com" ]; kexAlgorithms = [ + "sntrup761x25519-sha512@openssh.com" "curve25519-sha256" "curve25519-sha256@libssh.org" "diffie-hellman-group16-sha512" diff --git a/home-manager/modules/neovim/plugins/cmp.nix b/home-manager/modules/neovim/plugins/cmp.nix index dd36150..75d6f98 100644 --- a/home-manager/modules/neovim/plugins/cmp.nix +++ b/home-manager/modules/neovim/plugins/cmp.nix @@ -40,7 +40,7 @@ cmp-nvim-lsp.enable = true; cmp-nvim-lua.enable = true; cmp_luasnip.enable = true; - cmp-path.enable = true; + # cmp-path.enable = true; cmp-latex-symbols.enable = true; cmp-buffer.enable = true; cmp = { @@ -62,7 +62,7 @@ {name = "buffer";} - {name = "path";} + # { name = "path"; } ]; mapping = { diff --git a/home-manager/modules/neovim/plugins/default.nix b/home-manager/modules/neovim/plugins/default.nix index b2651cb..fcdf8dd 100644 --- a/home-manager/modules/neovim/plugins/default.nix +++ b/home-manager/modules/neovim/plugins/default.nix @@ -34,5 +34,6 @@ _: { ./which-key.nix ./undotree.nix ./yazi.nix + ./vimtex.nix ]; } diff --git a/home-manager/modules/neovim/plugins/lsp.nix b/home-manager/modules/neovim/plugins/lsp.nix index d406ee7..2d4694a 100644 --- a/home-manager/modules/neovim/plugins/lsp.nix +++ b/home-manager/modules/neovim/plugins/lsp.nix @@ -74,6 +74,8 @@ pyright.enable = true; hls.enable = true; leanls.enable = true; + texlab.enable = true; + html.enable = true; }; }; which-key.settings.spec = [ diff --git a/home-manager/modules/neovim/plugins/vimtex.nix b/home-manager/modules/neovim/plugins/vimtex.nix new file mode 100644 index 0000000..6d20146 --- /dev/null +++ b/home-manager/modules/neovim/plugins/vimtex.nix @@ -0,0 +1,15 @@ +{...}: { + programs.nixvim = { + plugins.vimtex = { + enable = true; + settings = { + compiler_method = "latexrun"; + toc_config = { + split_pos = "vert topleft"; + split_width = 40; + }; + view_method = "zathura"; + }; + }; + }; +} diff --git a/home-manager/modules/tmux/tmux.nix b/home-manager/modules/tmux/tmux.nix index 217c6f2..fd95065 100644 --- a/home-manager/modules/tmux/tmux.nix +++ b/home-manager/modules/tmux/tmux.nix @@ -163,5 +163,23 @@ tksv = "tmux kill-server"; tkss = "tmux kill-session -t"; }; + + initExtra = '' + function sesh-sessions() { + { + exec