shell.nix

   1 let
   2   nixpkgs_channel = builtins.getEnv "nixpkgs_channel";
   3   # Bootstraping Nixpkgs to get tools to patch it.
   4   originNixpkgs = import (.config/nixpkgs-channel + ("/${nixpkgs_channel}.nix"));
   5   originPkgs = import originNixpkgs {
   6     config = {}; # Make the config pure, ignoring user's config.
   7     overlays = [];
   8   };
   9   remoteNixpkgsPatches = [
  10     { meta.description = "dstat: fix pluginpath";
  11       url = "https://github.com/NixOS/nixpkgs/pull/80151.diff";
  12       sha256 = "0jjw2gvp7b7v2n2m2d6yj0gw711j6p9lyjf5ywp2y9ql6905qf4b";
  13     }
  14     { meta.description = "syncoid: fix PATH to let it use sudo";
  15       url = "https://github.com/NixOS/nixpkgs/pull/83901.diff";
  16       sha256 = "0q2dicmvl3h3hb9xdd870n5hf6lac489p000c7f1r6k70sh2id4l";
  17     }
  18     { meta.description = "sanoid: fix sanoid.conf generation";
  19       url = "https://github.com/NixOS/nixpkgs/pull/83904.diff";
  20       sha256 = "0lj4krmmbz82zpmbacw0qj2ywsx895bq4d1psjn753ymh7jjqj8k";
  21     }
  22     { meta.description = "nixos/public-inbox: init";
  23       url = "https://github.com/NixOS/nixpkgs/pull/77450.diff";
  24       sha256 = "13ikg7chpbf6rrg5sngbdb95q3awhdgl4g8vci42xmqyf208hzzd";
  25     }
  26     { meta.description = "transmission: apply RFC0042 and harden the service";
  27       url = "https://github.com/NixOS/nixpkgs/pull/92106.diff";
  28       sha256 = "0d3dd511h7fw0k5q0k6wp7hcwkk7xikfwracp68f1y7hn4jj0pn0";
  29     }
  30     { meta.description = "apparmor: fix and improve the service";
  31       url = "https://github.com/NixOS/nixpkgs/pull/93457.diff";
  32       sha256 = "1yhs0459r7mxdzl70l67yzbj6i67ps2znaca852hd1gffi650bkr";
  33     }
  34     { meta.description = "nixos/security.gnupg: provisioning GnuPG-protected secrets through the Nix store";
  35       url = "https://github.com/NixOS/nixpkgs/pull/93659.diff";
  36       sha256 = "08pmka7ryz2gbyc8by40p31ky7s3dqxlj90dnw7fmlgb4pb3pkn0";
  37     }
  38     { meta.description = "nixos/croc: init";
  39       url = "https://github.com/NixOS/nixpkgs/pull/93629.diff";
  40       sha256 = "0fv3lpj244hvxyixxv4akrr70jv5wwbhb3kmbmd2yskx59a71rch";
  41     }
  42     { meta.description = "prosody-modules: update to revision 2dcbc01c9931";
  43       url = "https://github.com/NixOS/nixpkgs/pull/94916.diff";
  44       sha256 = "1cpdv5bd3837qh54yd0n6vvbfpn0p0cshkic5q0lv60lmm9raqk4";
  45     }
  46     { meta.description = "nixos/biboumi: init";
  47       url = "https://github.com/NixOS/nixpkgs/pull/94917.diff";
  48       sha256 = "18my9hpl3y44yikqryrygwl0jg3dgsn1p778lja6bac6m512xk2w";
  49     }
  50     { meta.description = "dovecot_fts_xapian: 1.3.1 -> 1.3.3";
  51       url = "https://github.com/NixOS/nixpkgs/pull/94938.diff";
  52       sha256 = "10bjwcwpvq7nnqdpz0n7c61kb3b27v1abyc80pki7d13jmzzjc04";
  53     }
  54   ];
  55   localNixpkgsPatches = [
  56     nixpkgs/patches/installer.ssh-nixos.diff
  57     nixpkgs/patches/fix-flushBeforeStage2.diff
  58   ];
  59   # Build nixpkgs with some patches.
  60   nixpkgs = originPkgs.applyPatches {
  61     name = "nixpkgs-patched";
  62     src = originNixpkgs;
  63     patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  64     postPatch = ''
  65       patch=$(printf '%s\n' ${builtins.concatStringsSep " "
  66          (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
  67         sort | sha256sum | cut -c -7)
  68       echo "+patch-$patch" >.version-suffix
  69     '';
  70   };
  71   # Final pkgs with custom overlays.
  72   pkgs = import nixpkgs {
  73     config = {}; # Make the config pure, ignoring user's config.
  74     overlays = import nixpkgs/overlays.nix;
  75   };
  76
  77   # Configuration of shell/modules/
  78   # to expand shellHook and buildInputs of this shell.nix
  79   shellConfig = {config, ...}: {
  80     imports = [
  81       shell/gnupg.nix
  82     ];
  83     nix = {
  84       nixConf = ''
  85         auto-optimise-store = true
  86       '';
  87     };
  88     nix-plugins = {
  89       enable = true;
  90     };
  91     gnupg = {
  92       enable = true;
  93       gnupgHome = toString ../sec/gnupg;
  94       gpgExtraConf = ''
  95         # julm@sourcephile.fr
  96         trusted-key 0xB2450D97085B7B8C
  97       '';
  98       gpgAgentExtraConf = ''
  99         #pretend-request-origin remote
 100         #extra-socket ${toString ./.}/S.gpg-agent.extra
 101         #log-file ${toString ./.}/gpg-agent.log
 102         #no-grab
 103         #debug-level expert
 104         #allow-loopback-pinentry
 105       '';
 106     };
 107     openssl = {
 108       enable = true;
 109       opensslHome = toString ../sec/openssl;
 110       certificates = import shell/x509.nix;
 111     };
 112     openssh = {
 113       enable = true;
 114       sshConf = ''
 115         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
 116         Compression no
 117         #CompressionLevel 4
 118         ControlMaster auto
 119         ControlPath ${toString ../sec/ssh}/ssh-%h-%p-%r.socket
 120         HashKnownHosts no
 121         #SSAPIAuthentication no
 122         SendEnv LANG LC_*
 123         StrictHostKeyChecking yes
 124         UserKnownHostsFile ${toString ../sec/ssh/known_hosts}
 125       '';
 126     };
 127     virtualbox = {
 128       enable = false;
 129     };
 130   };
 131
 132   # Using modules enables to separate specific configurations
 133   # from reusable code in shell/modules.nix and shell/modules/
 134   # which may find its way in another git repository one day.
 135   shell = (pkgs.lib.evalModules {
 136     modules = [ shellConfig ] ++ map import (pkgs.lib.findFiles ".*\\.nix" shell/modules);
 137     args = { inherit pkgs; };
 138   }).config;
 139
 140   pwd = toString (./. + "");
 141   sourcephile-shred-tmp = pkgs.writeShellScriptBin "sourcephile-shred-tmp" ''
 142     # This is done when entering the nix-shell
 143     # because direnv already hooks trap EXIT.
 144     cd "${pwd}"
 145     test ! -e sec/tmp || {
 146     find sec/tmp -type f -exec shred -fu {} +
 147     rm -rf sec/tmp
 148     }
 149   '';
 150 in
 151 pkgs.mkShell {
 152   name = "sourcephile-nix";
 153   src = null;
 154   #preferLocalBuild = true;
 155   #allowSubstitutes = false;
 156   buildInputs = shell.nix-shell.buildInputs ++ [
 157     sourcephile-shred-tmp
 158     (pkgs.nixos []).nixos-generate-config
 159     (pkgs.nixos []).nixos-install
 160     (pkgs.nixos []).nixos-enter
 161     #pkgs.binutils
 162     pkgs.coreutils
 163     pkgs.cryptsetup
 164     pkgs.curl
 165     #pkgs.direnv
 166     pkgs.dnsutils
 167     #pkgs.dropbear
 168     pkgs.e2fsprogs
 169     pkgs.git
 170     pkgs.glibcLocales
 171     pkgs.gnumake
 172     pkgs.gnupg
 173     pkgs.htop
 174     #pkgs.inetutils
 175     pkgs.ipcalc
 176     #pkgs.iputils
 177     pkgs.less
 178     pkgs.libfaketime
 179     pkgs.ldns
 180     #pkgs.ldns.examples
 181     #pkgs.mailutils
 182     pkgs.man
 183     pkgs.mdadm
 184     pkgs.gptfdisk
 185     pkgs.ncdu
 186     pkgs.ncurses
 187     #pkgs.nixops
 188     #pkgs.openssl
 189     pkgs.pass
 190     pkgs.procps
 191     pkgs.rsync
 192     #pkgs.rxvt_unicode.terminfo
 193     #pkgs.sqlite
 194     pkgs.sqlite
 195     #pkgs.sudo
 196     pkgs.tig
 197     pkgs.time
 198     #pkgs.tmux
 199     pkgs.tree
 200     pkgs.utillinux
 201     #pkgs.vim
 202     #pkgs.virtualbox
 203     pkgs.which
 204     pkgs.xdg_utils
 205     pkgs.zfs
 206     pkgs.fio
 207     pkgs.strace
 208     pkgs.utillinux
 209     #pkgs.zfstools
 210     pkgs.linuxPackages.perf
 211     #pkgs.go2nix
 212     pkgs.wireguard
 213     pkgs.stun
 214   ];
 215   #enableParallelBuilding = true;
 216   shellHook = ''
 217     echo >&2 "nix: running shellHook"
 218
 219     # password-store
 220     export PASSWORD_STORE_DIR="$PWD"/../sec/pass
 221
 222     # Nix
 223     PATH=$NIX_SHELL_PATH:$PATH
 224     export NIX_PATH="${pkgs.lib.concatStringsSep ":" [
 225       "machines=$PWD/machines.nix"
 226       #"pass=$PASSWORD_STORE_DIR"
 227       "nixpkgs=${toString pkgs.path}"
 228       "nixpkgs-overlays=$PWD/nixpkgs/overlays.nix"
 229     ]}"
 230
 231     # Since the .envrc calls this shellHook
 232     # the EXIT trap cannot be freely used
 233     # because it's already used by direnv,
 234     # hence shred at startup, which is not ideal.
 235     sourcephile-shred-tmp
 236
 237     ${shell.nix-shell.shellHook}
 238
 239     # gpg
 240     export GPG_TTY=$(tty)
 241     gpg-connect-agent updatestartuptty /bye >/dev/null
 242   '';
 243 }