shell.nix

   1 let
   2   nixpkgs = import .config/nixpkgs-channel/nixos-19.09-small.nix;
   3   pkgs = import nixpkgs {
   4     config   = {}; # Make the config pure, ignoring user's config.
   5     overlays = import ./overlays.nix;
   6   };
   7   lib = pkgs.lib;
   8   nixos = pkgs.nixos {};
   9   # Configuration of shell/modules/
  10   configuration = {config, ...}: {
  11     imports = [
  12     ];
  13     nix = {
  14       nixConf = ''
  15         auto-optimise-store = true
  16       '';
  17     };
  18     nix-plugins = {
  19       enable = true;
  20     };
  21     gnupg = {
  22       enable = true;
  23       gnupgHome = toString ../sec/gnupg;
  24       keys = import shell/openpgp.nix;
  25     };
  26     openssl = {
  27       enable = true;
  28       opensslHome = toString ../sec/openssl;
  29       certificates = import shell/x509.nix;
  30     };
  31     openssh = {
  32       # WARNING: nixops uses its own ssh, not this one.
  33       enable = true;
  34       sshConf = ''
  35         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
  36         Compression no
  37         #CompressionLevel 4
  38         ControlMaster auto
  39         ControlPath ${builtins.toString ../sec/ssh}/ssh-%h-%p-%r.socket
  40         HashKnownHosts no
  41         #SSAPIAuthentication no
  42         SendEnv LANG LC_*
  43         StrictHostKeyChecking yes
  44         UserKnownHostsFile ${builtins.toString ../sec/ssh/known_hosts}
  45       '';
  46     };
  47     virtualbox = {
  48       enable = true;
  49     };
  50   };
  51
  52   # Using modules enables to separate specific configurations
  53   # from reusable code in shell/modules.nix and shell/modules/
  54   # which may find its way in another git repository one day.
  55   modules =
  56     (import shell/modules.nix {
  57       inherit pkgs lib;
  58       modules = [ configuration ];
  59     }).config;
  60 in
  61 pkgs.stdenv.mkDerivation {
  62   name = "sourcephile-nix";
  63   src = null;
  64   #preferLocalBuild = true;
  65   #allowSubstitutes = false;
  66   buildInputs = modules.nix-shell.buildInputs ++ [
  67     nixpkgs
  68     nixos.nixos-generate-config
  69     nixos.nixos-install
  70     nixos.nixos-enter
  71     #pkgs.binutils
  72     pkgs.coreutils
  73     pkgs.cryptsetup
  74     pkgs.curl
  75     #pkgs.direnv
  76     pkgs.dnsutils
  77     #pkgs.dropbear
  78     pkgs.e2fsprogs
  79     pkgs.git
  80     pkgs.glibcLocales
  81     pkgs.gnumake
  82     pkgs.gnupg
  83     pkgs.htop
  84     #pkgs.inetutils
  85     pkgs.ipcalc
  86     #pkgs.iputils
  87     pkgs.less
  88     pkgs.libfaketime
  89     pkgs.ldns
  90     #pkgs.ldns.examples
  91     #pkgs.mailutils
  92     pkgs.man
  93     pkgs.mdadm
  94     pkgs.gptfdisk
  95     pkgs.ncdu
  96     pkgs.ncurses
  97     pkgs.nixops
  98     #pkgs.openssl
  99     pkgs.pass
 100     pkgs.procps
 101     pkgs.rsync
 102     #pkgs.rxvt_unicode.terminfo
 103     #pkgs.sqlite
 104     pkgs.sqlite
 105     #pkgs.sudo
 106     pkgs.tig
 107     pkgs.time
 108     #pkgs.tmux
 109     pkgs.tree
 110     pkgs.utillinux
 111     #pkgs.vim
 112     #pkgs.virtualbox
 113     pkgs.which
 114     pkgs.xdg_utils
 115     pkgs.zfs
 116     pkgs.fio
 117     pkgs.strace
 118     pkgs.utillinux
 119     #pkgs.zfstools
 120   ];
 121   #enableParallelBuilding = true;
 122   shellHook = ''
 123     echo >&2 "nix: running shellHook"
 124     # WARNING: beware that sudo may reset the environment,
 125     # and especially PATH, to some system's default.
 126
 127     NIX_SHELL_PATH=$PATH
 128     unset __ETC_PROFILE_SOURCED
 129     unset __NIXOS_SET_ENVIRONMENT_DONE
 130     test ! -e /etc/profile || . /etc/profile
 131     test ! -e ~/.profile || . ~/.profile
 132
 133     # nix
 134     test ! -e ~/.nix-profile/etc/profile.d/nix.sh ||
 135     . ~/.nix-profile/etc/profile.d/nix.sh
 136
 137     # home-manager
 138     unset __HM_SESS_VARS_SOURCED
 139     test ! -e ~/.nix-profile/etc/profile.d/hm-session-vars.sh ||
 140     . ~/.nix-profile/etc/profile.d/hm-session-vars.sh
 141
 142     PATH=$NIX_SHELL_PATH:$PATH
 143     export NIX_PATH="nixpkgs=${nixpkgs}:nixpkgs-overlays="$PWD"/overlays"
 144
 145     # Cleanup "../sec/tmp/"
 146     # This is done when exiting the nix-shell
 147     # (or when… entering the directory with direnv
 148     # which spawns a nix-shell just to get the env).
 149     trap "cd '$PWD' && find ../sec/tmp -type f -exec shred -fu {} +" EXIT
 150
 151     ${modules.nix-shell.shellHook}
 152
 153     # locales
 154     export LANG=fr_FR.UTF-8
 155     export LC_CTYPE=fr_FR.UTF-8
 156
 157     # password-store
 158     export PASSWORD_STORE_DIR="$PWD"/../sec/pass
 159
 160     # gpg
 161     export GPG_TTY=$(tty)
 162     gpg-connect-agent updatestartuptty /bye >/dev/null
 163
 164     # git
 165     gitdir="$PWD"/.git
 166     test ! -f "$gitdir" || while IFS=" :" read -r hdr gitdir; do [ "$hdr" != gitdir ] || break; done <"$gitdir"
 167     ln -fnsr \
 168      "$PWD"/.lib/git/hooks/prepare-commit-msg--longuest-common-prefix \
 169      "$gitdir"/hooks/prepare-commit-msg
 170
 171     # nixops
 172     #export NIXOPS_DEPLOYMENT="staging"
 173     export NIXOPS_STATE="$PWD"/../sec/nixops/state.nixops
 174     NIXOPS_OPTS+=" --show-trace"
 175     export NIXOPS_OPTS
 176
 177     # disnix
 178     #export DISNIXOS_USE_NIXOPS=1
 179     #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
 180     #export DISNIX_PROFILE=default
 181     #export DISNIX_TARGET_PROPERTY=hostname
 182     #export DYSNOMIA_STATEDIR="$PWD"/../sec/dysnomia
 183   '';
 184 }