shell.nix

   1 let
   2   nixpkgs_channel = builtins.getEnv "nixpkgs_channel";
   3   # Bootstraping Nixpkgs to get tools to patch it.
   4   originNixpkgs = import (.config/nixpkgs-channel + ("/${nixpkgs_channel}.nix"));
   5   originPkgs = import originNixpkgs {
   6     config = {}; # Make the config pure, ignoring user's config.
   7     overlays = [];
   8   };
   9   remoteNixpkgsPatches = [
  10     { meta.description = "dstat: fix pluginpath";
  11       url = "https://github.com/NixOS/nixpkgs/pull/80151.diff";
  12       sha256 = "0jjw2gvp7b7v2n2m2d6yj0gw711j6p9lyjf5ywp2y9ql6905qf4b";
  13     }
  14     { meta.description = "syncoid: fix PATH to let it use sudo";
  15       url = "https://github.com/NixOS/nixpkgs/pull/83901.diff";
  16       sha256 = "0q2dicmvl3h3hb9xdd870n5hf6lac489p000c7f1r6k70sh2id4l";
  17     }
  18     { meta.description = "sanoid: fix sanoid.conf generation";
  19       url = "https://github.com/NixOS/nixpkgs/pull/83904.diff";
  20       sha256 = "0lj4krmmbz82zpmbacw0qj2ywsx895bq4d1psjn753ymh7jjqj8k";
  21     }
  22     { meta.description = "nixos/public-inbox: init";
  23       url = "https://github.com/NixOS/nixpkgs/pull/77450.diff";
  24       sha256 = "13ikg7chpbf6rrg5sngbdb95q3awhdgl4g8vci42xmqyf208hzzd";
  25     }
  26   ];
  27   localNixpkgsPatches = [
  28   ];
  29   # Build nixpkgs with some patches.
  30   nixpkgs = originPkgs.applyPatches {
  31     name = "nixpkgs-patched";
  32     src = originNixpkgs;
  33     patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  34     postPatch = ''
  35       patch=$(printf '%s\n' ${builtins.concatStringsSep " "
  36          (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
  37         sort | sha256sum | cut -c -7)
  38       echo "+patch-$patch" >.version-suffix
  39     '';
  40   };
  41   # Final pkgs with custom overlays.
  42   pkgs = import nixpkgs {
  43     config = {}; # Make the config pure, ignoring user's config.
  44     overlays = import nixpkgs/overlays.nix;
  45   };
  46
  47   lib = pkgs.lib;
  48   nixos = pkgs.nixos {};
  49   # Configuration of shell/modules/
  50   # to expand shellHook and buildInputs of this shell.nix
  51   configuration = {config, ...}: {
  52     imports = [
  53       shell/gnupg.nix
  54     ];
  55     nix = {
  56       nixConf = ''
  57         auto-optimise-store = true
  58       '';
  59     };
  60     nix-plugins = {
  61       enable = true;
  62     };
  63     gnupg = {
  64       enable = true;
  65       gnupgHome = toString ../sec/gnupg;
  66       gpgExtraConf = ''
  67         # julm@sourcephile.fr
  68         trusted-key 0xB2450D97085B7B8C
  69       '';
  70     };
  71     openssl = {
  72       enable = true;
  73       opensslHome = toString ../sec/openssl;
  74       certificates = import shell/x509.nix;
  75     };
  76     openssh = {
  77       enable = true;
  78       sshConf = ''
  79         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
  80         Compression no
  81         #CompressionLevel 4
  82         ControlMaster auto
  83         ControlPath ${toString ../sec/ssh}/ssh-%h-%p-%r.socket
  84         HashKnownHosts no
  85         #SSAPIAuthentication no
  86         SendEnv LANG LC_*
  87         StrictHostKeyChecking yes
  88         UserKnownHostsFile ${toString ../sec/ssh/known_hosts}
  89       '';
  90     };
  91     virtualbox = {
  92       enable = false;
  93     };
  94   };
  95
  96   # Using modules enables to separate specific configurations
  97   # from reusable code in shell/modules.nix and shell/modules/
  98   # which may find its way in another git repository one day.
  99   modules =
 100     (import shell/modules.nix {
 101       inherit pkgs lib;
 102       modules = [ configuration ];
 103     }).config;
 104
 105   pwd = toString (./. + "");
 106   sourcephile-shred-tmp = pkgs.writeShellScriptBin "sourcephile-shred-tmp" ''
 107     # This is done when entering the nix-shell
 108     # because direnv already hooks trap EXIT.
 109     cd "${pwd}"
 110     test ! -e sec/tmp || {
 111     find sec/tmp -type f -exec shred -fu {} +
 112     rm -rf sec/tmp
 113     }
 114   '';
 115 in
 116 pkgs.mkShell {
 117   name = "sourcephile-nix";
 118   src = null;
 119   #preferLocalBuild = true;
 120   #allowSubstitutes = false;
 121   buildInputs = modules.nix-shell.buildInputs ++ [
 122     sourcephile-shred-tmp
 123     nixos.nixos-generate-config
 124     nixos.nixos-install
 125     nixos.nixos-enter
 126     #pkgs.binutils
 127     pkgs.coreutils
 128     pkgs.cryptsetup
 129     pkgs.curl
 130     #pkgs.direnv
 131     pkgs.dnsutils
 132     #pkgs.dropbear
 133     pkgs.e2fsprogs
 134     pkgs.git
 135     pkgs.glibcLocales
 136     pkgs.gnumake
 137     pkgs.gnupg
 138     pkgs.htop
 139     #pkgs.inetutils
 140     pkgs.ipcalc
 141     #pkgs.iputils
 142     pkgs.less
 143     pkgs.libfaketime
 144     pkgs.ldns
 145     #pkgs.ldns.examples
 146     #pkgs.mailutils
 147     pkgs.man
 148     pkgs.mdadm
 149     pkgs.gptfdisk
 150     pkgs.ncdu
 151     pkgs.ncurses
 152     #pkgs.nixops
 153     #pkgs.openssl
 154     pkgs.pass
 155     pkgs.procps
 156     pkgs.rsync
 157     #pkgs.rxvt_unicode.terminfo
 158     #pkgs.sqlite
 159     pkgs.sqlite
 160     #pkgs.sudo
 161     pkgs.tig
 162     pkgs.time
 163     #pkgs.tmux
 164     pkgs.tree
 165     pkgs.utillinux
 166     #pkgs.vim
 167     #pkgs.virtualbox
 168     pkgs.which
 169     pkgs.xdg_utils
 170     pkgs.zfs
 171     pkgs.fio
 172     pkgs.strace
 173     pkgs.utillinux
 174     #pkgs.zfstools
 175   ];
 176   #enableParallelBuilding = true;
 177   shellHook = ''
 178     echo >&2 "nix: running shellHook"
 179
 180     # password-store
 181     export PASSWORD_STORE_DIR="$PWD"/../sec/pass
 182
 183     # Nix
 184     PATH=$NIX_SHELL_PATH:$PATH
 185     export NIX_PATH="${lib.concatStringsSep ":" [
 186       "servers=$PWD/servers.nix"
 187       #"pass=$PASSWORD_STORE_DIR"
 188       "nixpkgs=${toString pkgs.path}"
 189       "nixpkgs-overlays=$PWD/nixpkgs/overlays.nix"
 190     ]}"
 191
 192     # Since the .envrc calls this shellHook
 193     # the EXIT trap cannot be freely used
 194     # because it's already used by direnv,
 195     # hence shred at startup, which is not ideal.
 196     sourcephile-shred-tmp
 197
 198     ${modules.nix-shell.shellHook}
 199
 200     # gpg
 201     export GPG_TTY=$(tty)
 202     gpg-connect-agent updatestartuptty /bye >/dev/null
 203   '';
 204 }