shell.nix

   1 let
   2   nixpkgs_channel = builtins.getEnv "nixpkgs_channel";
   3   # Bootstraping Nixpkgs to get tools to patch it.
   4   originNixpkgs = import (.config/nixpkgs-channel + ("/${nixpkgs_channel}.nix"));
   5   originPkgs = import originNixpkgs {
   6     config = {}; # Make the config pure, ignoring user's config.
   7     overlays = [];
   8   };
   9   remoteNixpkgsPatches = [
  10     { meta.description = "dstat: fix pluginpath";
  11       url = "https://github.com/NixOS/nixpkgs/pull/80151.diff";
  12       sha256 = "0jjw2gvp7b7v2n2m2d6yj0gw711j6p9lyjf5ywp2y9ql6905qf4b";
  13     }
  14     { meta.description = "syncoid: fix PATH to let it use sudo";
  15       url = "https://github.com/NixOS/nixpkgs/pull/83901.diff";
  16       sha256 = "0q2dicmvl3h3hb9xdd870n5hf6lac489p000c7f1r6k70sh2id4l";
  17     }
  18     { meta.description = "sanoid: fix sanoid.conf generation";
  19       url = "https://github.com/NixOS/nixpkgs/pull/83904.diff";
  20       sha256 = "0lj4krmmbz82zpmbacw0qj2ywsx895bq4d1psjn753ymh7jjqj8k";
  21     }
  22     { meta.description = "nixos/public-inbox: init";
  23       url = "https://github.com/NixOS/nixpkgs/pull/77450.diff";
  24       sha256 = "13ikg7chpbf6rrg5sngbdb95q3awhdgl4g8vci42xmqyf208hzzd";
  25     }
  26     /*
  27     { meta.description = "transmission: apply RFC0042 and harden the service";
  28       url = "https://github.com/NixOS/nixpkgs/pull/92106.diff";
  29       sha256 = "0h1105qy0wrirvi9fk5d00qsjvm745196vb7wgr648d56rm17vv1";
  30     }
  31     */
  32     { meta.description = "apparmor: fix and improve the service";
  33       url = "https://github.com/NixOS/nixpkgs/pull/93457.diff";
  34       sha256 = "0y1kvsnm8xiplbm4w4cadmfkr452vipswkz3kwyyikknh06vj3mn";
  35     }
  36   ];
  37   localNixpkgsPatches = [
  38     #nixpkgs/patches/apparmor.diff
  39   ];
  40   # Build nixpkgs with some patches.
  41   nixpkgs = originPkgs.applyPatches {
  42     name = "nixpkgs-patched";
  43     src = originNixpkgs;
  44     patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  45     postPatch = ''
  46       patch=$(printf '%s\n' ${builtins.concatStringsSep " "
  47          (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
  48         sort | sha256sum | cut -c -7)
  49       echo "+patch-$patch" >.version-suffix
  50     '';
  51   };
  52   # Final pkgs with custom overlays.
  53   pkgs = import nixpkgs {
  54     config = {}; # Make the config pure, ignoring user's config.
  55     overlays = import nixpkgs/overlays.nix;
  56   };
  57
  58   lib = pkgs.lib;
  59   nixos = pkgs.nixos {};
  60   # Configuration of shell/modules/
  61   # to expand shellHook and buildInputs of this shell.nix
  62   configuration = {config, ...}: {
  63     imports = [
  64       shell/gnupg.nix
  65     ];
  66     nix = {
  67       nixConf = ''
  68         auto-optimise-store = true
  69       '';
  70     };
  71     nix-plugins = {
  72       enable = true;
  73     };
  74     gnupg = {
  75       enable = true;
  76       gnupgHome = toString ../sec/gnupg;
  77       gpgExtraConf = ''
  78         # julm@sourcephile.fr
  79         trusted-key 0xB2450D97085B7B8C
  80       '';
  81     };
  82     openssl = {
  83       enable = true;
  84       opensslHome = toString ../sec/openssl;
  85       certificates = import shell/x509.nix;
  86     };
  87     openssh = {
  88       enable = true;
  89       sshConf = ''
  90         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
  91         Compression no
  92         #CompressionLevel 4
  93         ControlMaster auto
  94         ControlPath ${toString ../sec/ssh}/ssh-%h-%p-%r.socket
  95         HashKnownHosts no
  96         #SSAPIAuthentication no
  97         SendEnv LANG LC_*
  98         StrictHostKeyChecking yes
  99         UserKnownHostsFile ${toString ../sec/ssh/known_hosts}
 100       '';
 101     };
 102     virtualbox = {
 103       enable = false;
 104     };
 105   };
 106
 107   # Using modules enables to separate specific configurations
 108   # from reusable code in shell/modules.nix and shell/modules/
 109   # which may find its way in another git repository one day.
 110   modules =
 111     (import shell/modules.nix {
 112       inherit pkgs lib;
 113       modules = [ configuration ];
 114     }).config;
 115
 116   pwd = toString (./. + "");
 117   sourcephile-shred-tmp = pkgs.writeShellScriptBin "sourcephile-shred-tmp" ''
 118     # This is done when entering the nix-shell
 119     # because direnv already hooks trap EXIT.
 120     cd "${pwd}"
 121     test ! -e sec/tmp || {
 122     find sec/tmp -type f -exec shred -fu {} +
 123     rm -rf sec/tmp
 124     }
 125   '';
 126 in
 127 pkgs.mkShell {
 128   name = "sourcephile-nix";
 129   src = null;
 130   #preferLocalBuild = true;
 131   #allowSubstitutes = false;
 132   buildInputs = modules.nix-shell.buildInputs ++ [
 133     sourcephile-shred-tmp
 134     nixos.nixos-generate-config
 135     nixos.nixos-install
 136     nixos.nixos-enter
 137     #pkgs.binutils
 138     pkgs.coreutils
 139     pkgs.cryptsetup
 140     pkgs.curl
 141     #pkgs.direnv
 142     pkgs.dnsutils
 143     #pkgs.dropbear
 144     pkgs.e2fsprogs
 145     pkgs.git
 146     pkgs.glibcLocales
 147     pkgs.gnumake
 148     pkgs.gnupg
 149     pkgs.htop
 150     #pkgs.inetutils
 151     pkgs.ipcalc
 152     #pkgs.iputils
 153     pkgs.less
 154     pkgs.libfaketime
 155     pkgs.ldns
 156     #pkgs.ldns.examples
 157     #pkgs.mailutils
 158     pkgs.man
 159     pkgs.mdadm
 160     pkgs.gptfdisk
 161     pkgs.ncdu
 162     pkgs.ncurses
 163     #pkgs.nixops
 164     #pkgs.openssl
 165     pkgs.pass
 166     pkgs.procps
 167     pkgs.rsync
 168     #pkgs.rxvt_unicode.terminfo
 169     #pkgs.sqlite
 170     pkgs.sqlite
 171     #pkgs.sudo
 172     pkgs.tig
 173     pkgs.time
 174     #pkgs.tmux
 175     pkgs.tree
 176     pkgs.utillinux
 177     #pkgs.vim
 178     #pkgs.virtualbox
 179     pkgs.which
 180     pkgs.xdg_utils
 181     pkgs.zfs
 182     pkgs.fio
 183     pkgs.strace
 184     pkgs.utillinux
 185     #pkgs.zfstools
 186   ];
 187   #enableParallelBuilding = true;
 188   shellHook = ''
 189     echo >&2 "nix: running shellHook"
 190
 191     # password-store
 192     export PASSWORD_STORE_DIR="$PWD"/../sec/pass
 193
 194     # Nix
 195     PATH=$NIX_SHELL_PATH:$PATH
 196     export NIX_PATH="${lib.concatStringsSep ":" [
 197       "servers=$PWD/servers.nix"
 198       #"pass=$PASSWORD_STORE_DIR"
 199       "nixpkgs=${toString pkgs.path}"
 200       "nixpkgs-overlays=$PWD/nixpkgs/overlays.nix"
 201     ]}"
 202
 203     # Since the .envrc calls this shellHook
 204     # the EXIT trap cannot be freely used
 205     # because it's already used by direnv,
 206     # hence shred at startup, which is not ideal.
 207     sourcephile-shred-tmp
 208
 209     ${modules.nix-shell.shellHook}
 210
 211     # gpg
 212     export GPG_TTY=$(tty)
 213     gpg-connect-agent updatestartuptty /bye >/dev/null
 214   '';
 215 }