shell.nix

   1 let
   2   nixpkgs_channel = builtins.getEnv "nixpkgs_channel";
   3   originNixpkgs = import (.config/nixpkgs-channel + ("/" + nixpkgs_channel + ".nix"));
   4   originPkgs = import originNixpkgs {
   5     config   = {}; # Make the config pure, ignoring user's config.
   6     overlays = [];
   7   };
   8   remoteNixpkgsPatches = [
   9     { meta.description = "Dovecot plugin for Full Text Search (FTS) with Xapian";
  10       url = "https://github.com/NixOS/nixpkgs/pull/78780.diff";
  11       sha256 = "1h45qhbragp5ky6xix198qhadj1j7gd3qswa135mnmw1ijfczyry";
  12     }
  13     { meta.description = "dstat: fix pluginpath";
  14       url = "https://github.com/NixOS/nixpkgs/pull/80151.diff";
  15       sha256 = "0jjw2gvp7b7v2n2m2d6yj0gw711j6p9lyjf5ywp2y9ql6905qf4b";
  16     }
  17     { meta.description = "syncoid: fix PATH to let it use sudo";
  18       url = "https://github.com/NixOS/nixpkgs/pull/83901.diff";
  19       sha256 = "0q2dicmvl3h3hb9xdd870n5hf6lac489p000c7f1r6k70sh2id4l";
  20     }
  21     { meta.description = "sanoid: fix sanoid.conf generation";
  22       url = "https://github.com/NixOS/nixpkgs/pull/83904.diff";
  23       sha256 = "0lj4krmmbz82zpmbacw0qj2ywsx895bq4d1psjn753ymh7jjqj8k";
  24     }
  25   ];
  26   localNixpkgsPatches = [
  27     patches/direnv.diff
  28     #patches/fts_xapian.diff
  29   ];
  30   nixpkgs = originPkgs.applyPatches {
  31     name = "nixpkgs-patched";
  32     src = originNixpkgs;
  33     patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  34     postPatch = ''
  35       patch=$(printf '%s\n' ${builtins.concatStringsSep " "
  36          (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
  37         sort | sha256sum | cut -c -7)
  38       echo "+patch-$patch" >.version-suffix
  39     '';
  40   };
  41   pkgs = import nixpkgs {
  42     config = {}; # Make the config pure, ignoring user's config.
  43     overlays = import ./overlays.nix;
  44   };
  45
  46   lib = pkgs.lib;
  47   nixos = pkgs.nixos {};
  48   # Configuration of shell/modules/
  49   configuration = {config, ...}: {
  50     imports = [
  51     ];
  52     nix = {
  53       nixConf = ''
  54         auto-optimise-store = true
  55       '';
  56     };
  57     nix-plugins = {
  58       enable = true;
  59     };
  60     gnupg = {
  61       enable = true;
  62       gnupgHome = toString ../sec/gnupg;
  63       keys = import shell/openpgp.nix;
  64       gpgExtraConf = ''
  65         # julm@sourcephile.fr
  66         trusted-key 0xB2450D97085B7B8C
  67       '';
  68     };
  69     openssl = {
  70       enable = true;
  71       opensslHome = toString ../sec/openssl;
  72       certificates = import shell/x509.nix;
  73     };
  74     openssh = {
  75       # WARNING: nixops uses its own ssh, not this one.
  76       enable = true;
  77       sshConf = ''
  78         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
  79         Compression no
  80         #CompressionLevel 4
  81         ControlMaster auto
  82         ControlPath ${builtins.toString ../sec/ssh}/ssh-%h-%p-%r.socket
  83         HashKnownHosts no
  84         #SSAPIAuthentication no
  85         SendEnv LANG LC_*
  86         StrictHostKeyChecking yes
  87         UserKnownHostsFile ${builtins.toString ../sec/ssh/known_hosts}
  88       '';
  89     };
  90     virtualbox = {
  91       enable = true;
  92     };
  93   };
  94
  95   # Using modules enables to separate specific configurations
  96   # from reusable code in shell/modules.nix and shell/modules/
  97   # which may find its way in another git repository one day.
  98   modules =
  99     (import shell/modules.nix {
 100       inherit pkgs lib;
 101       modules = [ configuration ];
 102     }).config;
 103
 104   # Utility to query the Nix files like nixops show-option
 105   # but without requiring a nixops database, and not limited to config entries.
 106   pwd = toString (./. + "");
 107   sourcephile-nix-get = pkgs.writeShellScriptBin "sourcephile-nix-get" ''
 108     nix-instantiate --read-write-mode \
 109      --arg networkExprs "[${pwd}/servers.nix ${pwd}/servers/production.nix]" \
 110      --arg args '{}' --argstr "uuid" whatever \
 111      --argstr deploymentName production "<nixops/eval-machine-info.nix>" \
 112      --eval-only --strict --arg checkConfigurationOptions false -A "$@"
 113   '';
 114   sourcephile-shred-tmp = pkgs.writeShellScriptBin "sourcephile-shred-tmp" ''
 115     # Cleanup "../sec/tmp/"
 116     # This is done when entering the nix-shell
 117     # because direnv already hooks trap EXIT.
 118     cd "${pwd}"
 119     test ! -e sec/tmp || {
 120     find sec/tmp -type f -exec shred -fu {} +
 121     rm -rf sec/tmp
 122     }
 123   '';
 124 in
 125 pkgs.mkShell {
 126   name = "sourcephile-nix";
 127   src = null;
 128   #preferLocalBuild = true;
 129   #allowSubstitutes = false;
 130   buildInputs = modules.nix-shell.buildInputs ++ [
 131     sourcephile-nix-get
 132     sourcephile-shred-tmp
 133     nixos.nixos-generate-config
 134     nixos.nixos-install
 135     nixos.nixos-enter
 136     #pkgs.binutils
 137     pkgs.coreutils
 138     pkgs.cryptsetup
 139     pkgs.curl
 140     #pkgs.direnv
 141     pkgs.dnsutils
 142     #pkgs.dropbear
 143     pkgs.e2fsprogs
 144     pkgs.git
 145     pkgs.glibcLocales
 146     pkgs.gnumake
 147     pkgs.gnupg
 148     pkgs.htop
 149     #pkgs.inetutils
 150     pkgs.ipcalc
 151     #pkgs.iputils
 152     pkgs.less
 153     pkgs.libfaketime
 154     pkgs.ldns
 155     #pkgs.ldns.examples
 156     #pkgs.mailutils
 157     pkgs.man
 158     pkgs.mdadm
 159     pkgs.gptfdisk
 160     pkgs.ncdu
 161     pkgs.ncurses
 162     pkgs.nixops
 163     #pkgs.openssl
 164     pkgs.pass
 165     pkgs.procps
 166     pkgs.rsync
 167     #pkgs.rxvt_unicode.terminfo
 168     #pkgs.sqlite
 169     pkgs.sqlite
 170     #pkgs.sudo
 171     pkgs.tig
 172     pkgs.time
 173     #pkgs.tmux
 174     pkgs.tree
 175     pkgs.utillinux
 176     #pkgs.vim
 177     #pkgs.virtualbox
 178     pkgs.which
 179     pkgs.xdg_utils
 180     pkgs.zfs
 181     pkgs.fio
 182     pkgs.strace
 183     pkgs.utillinux
 184     #pkgs.zfstools
 185   ];
 186   #enableParallelBuilding = true;
 187   shellHook = ''
 188     echo >&2 "nix: running shellHook"
 189
 190     # Nix
 191     PATH=$NIX_SHELL_PATH:$PATH
 192     export NIX_PATH="nixpkgs=${toString pkgs.path}:nixpkgs-overlays="$PWD"/overlays:nixops=${toString pkgs.nixops}/share/nix/nixops"
 193
 194     # Since the .envrc calls this shellHook
 195     # the EXIT trap cannot be freely used
 196     # because it's already used by direnv,
 197     # hence shred at startup, which is not ideal.
 198     sourcephile-shred-tmp
 199
 200     ${modules.nix-shell.shellHook}
 201
 202     # password-store
 203     export PASSWORD_STORE_DIR="$PWD"/../sec/pass
 204
 205     # gpg
 206     export GPG_TTY=$(tty)
 207     gpg-connect-agent updatestartuptty /bye >/dev/null
 208
 209     # nixops
 210     #export NIXOPS_DEPLOYMENT="staging"
 211     export MERMET_DEPLOYMENT=production
 212     export LOSURDO_DEPLOYMENT=production
 213     export NIXOPS_STATE="$PWD"/../sec/nixops/state.nixops
 214     NIXOPS_OPTS+=" --show-trace"
 215     export NIXOPS_OPTS
 216
 217     # disnix
 218     #export DISNIXOS_USE_NIXOPS=1
 219     #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
 220     #export DISNIX_PROFILE=default
 221     #export DISNIX_TARGET_PROPERTY=hostname
 222     #export DYSNOMIA_STATEDIR="$PWD"/../sec/dysnomia
 223   '';
 224 }