shell.nix

   1 let
   2   nixpkgs = import .lib/nix/nixpkgs.nix;
   3   pkgs = import nixpkgs {
   4     config   = {}; # Make the config pure, ignoring user's config.
   5     overlays = import ./overlays.nix;
   6   };
   7   lib = pkgs.lib;
   8   nixos = pkgs.nixos {};
   9
  10   # Configuration of shell/modules/
  11   configuration = {config, ...}: {
  12     imports = [
  13     ];
  14     nix = {
  15       nixConf = ''
  16         auto-optimise-store = true
  17       '';
  18     };
  19     nix-plugins = {
  20       enable = true;
  21     };
  22     gnupg = {
  23       enable = true;
  24       gnupgHome = toString ../sec/gnupg;
  25       keys = import shell/gnupg/keys.nix;
  26     };
  27     openssh = {
  28       enable = true;
  29       sshConf = ''
  30         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com
  31         Compression yes
  32         CompressionLevel 4
  33         ControlMaster auto
  34         ControlPath ${builtins.toString .sec/ssh}/ssh-%h-%p-%r.socket
  35         HashKnownHosts no
  36         SSAPIAuthentication no
  37         SendEnv LANG LC_*
  38         StrictHostKeyChecking yes
  39         UserKnownHostsFile ${builtins.toString .sec/ssh/known_hosts}
  40       '';
  41     };
  42   };
  43
  44   # Using modules enables to separate specific configurations
  45   # from reusable code in shell/modules.nix and shell/modules/
  46   # which may find its way in another git repository one day.
  47   modules =
  48     (import shell/modules.nix {
  49       inherit pkgs lib;
  50       modules = [ configuration ];
  51     }).config;
  52 in
  53 pkgs.stdenv.mkDerivation {
  54   name = "sourcephile-nix";
  55   src = null;
  56   #preferLocalBuild = true;
  57   #allowSubstitutes = false;
  58   buildInputs = modules.nix-shell.buildInputs ++ [
  59     nixpkgs
  60     nixos.nixos-generate-config
  61     nixos.nixos-install
  62     nixos.nixos-enter
  63     #pkgs.binutils
  64     pkgs.coreutils
  65     pkgs.cryptsetup
  66     pkgs.curl
  67     #pkgs.direnv
  68     #pkgs.dnsutils
  69     #pkgs.dropbear
  70     pkgs.e2fsprogs
  71     pkgs.git
  72     pkgs.glibcLocales
  73     pkgs.gnumake
  74     pkgs.gnupg
  75     pkgs.htop
  76     #pkgs.inetutils
  77     pkgs.ipcalc
  78     pkgs.less
  79     pkgs.libfaketime
  80     #pkgs.mailutils
  81     pkgs.man
  82     pkgs.mdadm
  83     pkgs.gptfdisk
  84     pkgs.ncdu
  85     pkgs.ncurses
  86     pkgs.nixops
  87     #pkgs.openssl
  88     pkgs.pass
  89     pkgs.procps
  90     #pkgs.rxvt_unicode.terminfo
  91     #pkgs.sqlite
  92     pkgs.sqlite
  93     pkgs.sudo
  94     pkgs.tig
  95     pkgs.time
  96     #pkgs.tmux
  97     pkgs.tree
  98     pkgs.utillinux
  99     pkgs.vim
 100     #pkgs.virtualbox
 101     pkgs.which
 102     pkgs.xdg_utils
 103     pkgs.zfs
 104     pkgs.fio
 105     pkgs.strace
 106     pkgs.utillinux
 107     #pkgs.zfstools
 108   ];
 109   #enableParallelBuilding = true;
 110   shellHook = ''
 111     echo >&2 "nix: running shellHook"
 112
 113     # Cleanup extraBuiltins.pass-to-file residues
 114     trap "cd '$PWD' && find .sec/tmp -type f -exec shred -fu {} +" EXIT
 115
 116     ${modules.nix-shell.shellHook}
 117
 118     # nix
 119     export NIX_PATH="nixpkgs=${nixpkgs}"
 120     NIX_PATH+=":nixpkgs-overlays="$PWD"/overlays"
 121     #NIX_PATH+=""
 122
 123     # executables
 124     PATH_NIX=$(dirname $(readlink -e ~/.nix-profile/bin/nix))
 125     PATH_NIXOS=/run/wrappers/bin
 126     PATH_FHS="$PWD"/.lib/nix/fhs-bin
 127     PATH_FHS_VBOX="$PWD"/.lib/fhs-vbox-bin
 128     export PATH="$PATH_NIXOS:$PATH_FHS_VBOX:$PATH_FHS:$PATH:$PATH_NIX"
 129
 130     # NOTE: sudo needs to be own by root with the setuid bit,
 131     # but this won't be the case for the sudo provided by Nix outside NixOS,
 132     # hence the addition of $PATH_FHS in shellHook
 133     # to provide the host system's sudo.
 134     # WARNING: beware that sudo may reset the environment,
 135     # and especially PATH, to some system's default.
 136
 137     # locales
 138     export LANG=fr_FR.UTF-8
 139     export LC_CTYPE=fr_FR.UTF-8
 140
 141     # password-store
 142     export PASSWORD_STORE_DIR="$PWD"/../sec/pass
 143
 144     # git
 145     gitdir="$PWD"/.git
 146     test ! -f "$gitdir" || while IFS=" :" read -r hdr gitdir; do [ "$hdr" != gitdir ] || break; done <"$gitdir"
 147     ln -fnsr \
 148      "$PWD"/.lib/git/hooks/prepare-commit-msg--longuest-common-prefix \
 149      "$gitdir"/hooks/prepare-commit-msg
 150
 151     # nixops
 152     #export NIXOPS_DEPLOYMENT="staging"
 153     export NIXOPS_STATE="$PWD"/.sec/nixops/state.nixops
 154     NIXOPS_OPTS+=" --show-trace"
 155     export NIXOPS_OPTS
 156
 157     # disnix
 158     #export DISNIXOS_USE_NIXOPS=1
 159     #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
 160     #export DISNIX_PROFILE=default
 161     #export DISNIX_TARGET_PROPERTY=hostname
 162     #export DYSNOMIA_STATEDIR="$PWD"/.sec/dysnomia
 163   '';
 164 }