shell.nix

   1 let
   2   nixpkgs = import .lib/nix/nixpkgs.nix;
   3   pkgs = import nixpkgs {
   4     config   = {}; # Make the config pure, ignoring user's config.
   5     overlays = import ./overlays.nix;
   6   };
   7   lib = pkgs.lib;
   8   nixos = pkgs.nixos {};
   9
  10   # Configuration of shell/modules/
  11   configuration = {config, ...}: {
  12     imports = [
  13     ];
  14     nix = {
  15       nixConf = ''
  16         auto-optimise-store = true
  17       '';
  18     };
  19     nix-plugins = {
  20       enable = true;
  21     };
  22     gnupg = {
  23       enable = true;
  24       gnupgHome = toString ../sec/gnupg;
  25       keys = import shell/openpgp.nix;
  26     };
  27     openssl = {
  28       enable = true;
  29       opensslHome = toString ../sec/openssl;
  30       certificates = import shell/x509.nix;
  31     };
  32     openssh = {
  33       # WARNING: nixops uses its own ssh, not this one.
  34       enable = true;
  35       sshConf = ''
  36         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com
  37         Compression no
  38         #CompressionLevel 4
  39         ControlMaster auto
  40         ControlPath ${builtins.toString ../sec/ssh}/ssh-%h-%p-%r.socket
  41         HashKnownHosts no
  42         #SSAPIAuthentication no
  43         SendEnv LANG LC_*
  44         StrictHostKeyChecking yes
  45         UserKnownHostsFile ${builtins.toString ../sec/ssh/known_hosts}
  46       '';
  47     };
  48   };
  49
  50   # Using modules enables to separate specific configurations
  51   # from reusable code in shell/modules.nix and shell/modules/
  52   # which may find its way in another git repository one day.
  53   modules =
  54     (import shell/modules.nix {
  55       inherit pkgs lib;
  56       modules = [ configuration ];
  57     }).config;
  58 in
  59 pkgs.stdenv.mkDerivation {
  60   name = "sourcephile-nix";
  61   src = null;
  62   #preferLocalBuild = true;
  63   #allowSubstitutes = false;
  64   buildInputs = modules.nix-shell.buildInputs ++ [
  65     nixpkgs
  66     nixos.nixos-generate-config
  67     nixos.nixos-install
  68     nixos.nixos-enter
  69     #pkgs.binutils
  70     pkgs.coreutils
  71     pkgs.cryptsetup
  72     pkgs.curl
  73     #pkgs.direnv
  74     pkgs.dnsutils
  75     #pkgs.dropbear
  76     pkgs.e2fsprogs
  77     pkgs.git
  78     pkgs.glibcLocales
  79     pkgs.gnumake
  80     pkgs.gnupg
  81     pkgs.htop
  82     #pkgs.inetutils
  83     pkgs.ipcalc
  84     #pkgs.iputils
  85     pkgs.less
  86     pkgs.libfaketime
  87     #pkgs.mailutils
  88     pkgs.man
  89     pkgs.mdadm
  90     pkgs.gptfdisk
  91     pkgs.ncdu
  92     pkgs.ncurses
  93     pkgs.nixops
  94     #pkgs.openssl
  95     pkgs.pass
  96     pkgs.procps
  97     pkgs.rsync
  98     #pkgs.rxvt_unicode.terminfo
  99     #pkgs.sqlite
 100     pkgs.sqlite
 101     pkgs.sudo
 102     pkgs.tig
 103     pkgs.time
 104     #pkgs.tmux
 105     pkgs.tree
 106     pkgs.utillinux
 107     pkgs.vim
 108     #pkgs.virtualbox
 109     pkgs.which
 110     pkgs.xdg_utils
 111     pkgs.zfs
 112     pkgs.fio
 113     pkgs.strace
 114     pkgs.utillinux
 115     #pkgs.zfstools
 116   ];
 117   #enableParallelBuilding = true;
 118   shellHook = ''
 119     echo >&2 "nix: running shellHook"
 120
 121     # Cleanup "../sec/tmp/"
 122     # This is done when exiting the nix-shell
 123     # (or when… entering the directory with direnv
 124     # which spawns a nix-shell just to get the env).
 125     trap "cd '$PWD' && find ../sec/tmp -type f -exec shred -fu {} +" EXIT
 126
 127     ${modules.nix-shell.shellHook}
 128
 129     # nix
 130     export NIX_PATH="nixpkgs=${nixpkgs}"
 131     NIX_PATH+=":nixpkgs-overlays="$PWD"/overlays"
 132     #NIX_PATH+=""
 133
 134     # executables
 135     PATH_NIX="$(dirname "$(PATH="${builtins.getEnv "PATH"}"; which nix)")"
 136     PATH_NIXOS=/run/wrappers/bin
 137     PATH_FHS="$PWD"/.lib/nix/fhs-bin
 138     PATH_FHS_VBOX="$PWD"/.lib/fhs-vbox-bin
 139     export PATH="$PATH_NIXOS:$PATH_FHS_VBOX:$PATH_FHS:$PATH:$PATH_NIX"
 140
 141     # NOTE: sudo needs to be own by root with the setuid bit,
 142     # but this won't be the case for the sudo provided by Nix outside NixOS,
 143     # hence the addition of $PATH_FHS in shellHook
 144     # to provide the host system's sudo.
 145     # WARNING: beware that sudo may reset the environment,
 146     # and especially PATH, to some system's default.
 147
 148     # locales
 149     export LANG=fr_FR.UTF-8
 150     export LC_CTYPE=fr_FR.UTF-8
 151
 152     # password-store
 153     export PASSWORD_STORE_DIR="$PWD"/../sec/pass
 154
 155     # git
 156     gitdir="$PWD"/.git
 157     test ! -f "$gitdir" || while IFS=" :" read -r hdr gitdir; do [ "$hdr" != gitdir ] || break; done <"$gitdir"
 158     ln -fnsr \
 159      "$PWD"/.lib/git/hooks/prepare-commit-msg--longuest-common-prefix \
 160      "$gitdir"/hooks/prepare-commit-msg
 161
 162     # nixops
 163     #export NIXOPS_DEPLOYMENT="staging"
 164     export NIXOPS_STATE="$PWD"/../sec/nixops/state.nixops
 165     NIXOPS_OPTS+=" --show-trace"
 166     export NIXOPS_OPTS
 167
 168     # disnix
 169     #export DISNIXOS_USE_NIXOPS=1
 170     #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
 171     #export DISNIX_PROFILE=default
 172     #export DISNIX_TARGET_PROPERTY=hostname
 173     #export DYSNOMIA_STATEDIR="$PWD"/../sec/dysnomia
 174   '';
 175 }