Separate desktop and server software

3 files changed, 92 insertions, 0 deletions

diff --git a/host/software/desktop/asset/T-TeleSec_GlobalRoot_Class_2.pem b/host/software/desktop/asset/T-TeleSec_GlobalRoot_Class_2.pem
new file mode 100644
index 0000000..374b050
--- /dev/null
+++ b/host/software/desktop/asset/T-TeleSec_GlobalRoot_Class_2.pem
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----

+MIIDwzCCAqugAwIBAgIBATANBgkqhkiG9w0BAQsFADCBgjELMAkGA1UEBhMCREUx

+KzApBgNVBAoMIlQtU3lzdGVtcyBFbnRlcnByaXNlIFNlcnZpY2VzIEdtYkgxHzAd

+BgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50ZXIxJTAjBgNVBAMMHFQtVGVsZVNl

+YyBHbG9iYWxSb290IENsYXNzIDIwHhcNMDgxMDAxMTA0MDE0WhcNMzMxMDAxMjM1

+OTU5WjCBgjELMAkGA1UEBhMCREUxKzApBgNVBAoMIlQtU3lzdGVtcyBFbnRlcnBy

+aXNlIFNlcnZpY2VzIEdtYkgxHzAdBgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50

+ZXIxJTAjBgNVBAMMHFQtVGVsZVNlYyBHbG9iYWxSb290IENsYXNzIDIwggEiMA0G

+CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqX9obX+hzkeXaXPSi5kfl82hVYAUd

+AqSzm1nzHoqvNK38DcLZSBnuaY/JIPwhqgcZ7bBcrGXHX+0CfHt8LRvWurmAwhiC

+FoT6ZrAIxlQjgeTNuUk/9k9uN0goOA/FvudocP05l03Sx5iRUKrERLMjfTlH6VJi

+1hKTXrcxlkIF+3anHqP1wvzpesVsqXFP6st4vGCvx9702cu+fjOlbpSD8DT6Iavq

+jnKgP6TeMFvvhk1qlVtDRKgQFRzlAVfFmPHmBiiRqiDFt1MmUUOyCxGVWOHAD3bZ

+wI18gfNycJ5v/hqO2V81xrJvNHy+SE/iWjnX2J14np+GPgNeGYtEotXHAgMBAAGj

+QjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS/

+WSA2AHmgoCJrjNXyYdK4LMuCSjANBgkqhkiG9w0BAQsFAAOCAQEAMQOiYQsfdOhy

+NsZt+U2e+iKo4YFWz827n+qrkRk4r6p8FU3ztqONpfSO9kSpp+ghla0+AGIWiPAC

+uvxhI+YzmzB6azZie60EI4RYZeLbK4rnJVM3YlNfvNoBYimipidx5joifsFvHZVw

+IEoHNN/q/xWA5brXethbdXwFeilHfkCoMRN3zUA7tFFHei4R40cR3p1m0IvVVGb6

+g1XqfMIpiRvpb7PO4gWEyS8+eIVibslfwXhjdFjASBgMmTnrpMwatXlajRWc2BQN

+9noHV8cigwUtPJslJj0Ys6lDfMjIq2SPDqO/nBudMNva0Bkuqjzx+zOAduTNrRlP

+BSeOE6Fuwg==

+-----END CERTIFICATE-----

diff --git a/host/software/desktop/default.nix b/host/software/desktop/default.nix
new file mode 100644
index 0000000..501a561
--- /dev/null
+++ b/host/software/desktop/default.nix
@@ -0,0 +1,42 @@
+{ pkgs, ... }:
+
+{
+  imports = [
+    ./kit.vpn.nix
+  ];
+
+  fileSystems."/".options = [ "noatime" "nodiratime" "discard" ];
+
+  sound.enable = true;
+  hardware = {
+    opengl.driSupport32Bit = true;
+    pulseaudio = {
+      enable       = true;
+      support32Bit = true;
+    };
+  };
+
+  services = {
+    journald = {
+      extraConfig = ''Storage=volatile'';
+    };
+
+    xserver = {
+      enable = true;
+      layout = "de";
+      xkbOptions = "caps:escape";
+
+      displayManager.slim = {
+        enable = true;
+        autoLogin = true;
+        defaultUser = "common";
+      };
+
+      desktopManager.default = "none";
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    hdparm ntfs3g 
+  ];
+}
diff --git a/host/software/desktop/kit.vpn.nix b/host/software/desktop/kit.vpn.nix
new file mode 100644
index 0000000..726356d
--- /dev/null
+++ b/host/software/desktop/kit.vpn.nix
@@ -0,0 +1,27 @@
+{ pkgs, ... }:
+
+{
+  services.openvpn.servers = {
+    KIT = {
+      # adapted from https://www.scc.kit.edu/scc/net/openvpn/os/debian/kit.ovpn
+      config = ''
+        client
+        remote 141.52.8.20
+        port 1194
+        dev tun
+        proto udp
+        auth-user-pass
+        nobind
+        comp-lzo no
+        tls-version-min 1.2
+        ca ${./asset/T-TeleSec_GlobalRoot_Class_2.pem}
+        verify-x509-name "C=DE, ST=Baden-Wuerttemberg, L=Karlsruhe, O=Karlsruhe Institute of Technology, OU=Steinbuch Centre for Computing, CN=ovpn.scc.kit.edu" subject
+        cipher AES-256-CBC
+        auth SHA384
+        verb 3
+        script-security 2
+      '';
+      autoStart = false;
+    };
+  };
+}