shell.nix

   1 let
   2   originNixpkgs = import .config/nixpkgs-channel/nixos-19.09-small.nix;
   3   originPkgs = import originNixpkgs {
   4     config   = {}; # Make the config pure, ignoring user's config.
   5     overlays = [];
   6   };
   7   nixpkgsPatches = [
   8     { meta.description = "nsd : use types.lines where appropriate";
   9       url = "https://github.com/NixOS/nixpkgs/pull/78968.diff";
  10       sha256 = "11bqq1g1ax6i7xghihyhklmqpsq3njalardp6nvzphkjgxrypb47";
  11     }
  12     { meta.description = "shorewall: init at 5.2.3.3";
  13       url = "https://github.com/NixOS/nixpkgs/pull/46131.diff";
  14       sha256 = "0mfzlcr23ni5spnwksmmls50sw10alqbr5j6hjrwp9i30z0419yx";
  15     }
  16     { meta.description = "Dovecot plugin for Full Text Search (FTS) with Xapian";
  17       url = "https://github.com/NixOS/nixpkgs/pull/78780.diff";
  18       sha256 = "053md69ryybj27cp0xdfrza48zyzpblk6wvb2m2dbs9hm0gmcwc4";
  19     }
  20   ];
  21   nixpkgs = originPkgs.stdenv.mkDerivation {
  22     name = "nixpkgs-patched";
  23     src = originNixpkgs;
  24     phases = [ "unpackPhase" "patchPhase" ];
  25     patches = map originPkgs.fetchpatch nixpkgsPatches;
  26     postPatch = ''
  27       patch=$(printf '%s\n' ${builtins.concatStringsSep " " (map (p: p.sha256) nixpkgsPatches)} |
  28         sort | sha256sum | cut -c -7)
  29       mv $PWD $out
  30       echo "+patch-$patch" >$out/.version-suffix
  31     '';
  32   };
  33   pkgs = import nixpkgs {
  34     config = {}; # Make the config pure, ignoring user's config.
  35     overlays = import ./overlays.nix;
  36   };
  37
  38
  39   lib = pkgs.lib;
  40   nixos = pkgs.nixos {};
  41   # Configuration of shell/modules/
  42   configuration = {config, ...}: {
  43     imports = [
  44     ];
  45     nix = {
  46       nixConf = ''
  47         auto-optimise-store = true
  48       '';
  49     };
  50     nix-plugins = {
  51       enable = true;
  52     };
  53     gnupg = {
  54       enable = true;
  55       gnupgHome = toString ../sec/gnupg;
  56       keys = import shell/openpgp.nix;
  57     };
  58     openssl = {
  59       enable = true;
  60       opensslHome = toString ../sec/openssl;
  61       certificates = import shell/x509.nix;
  62     };
  63     openssh = {
  64       # WARNING: nixops uses its own ssh, not this one.
  65       enable = true;
  66       sshConf = ''
  67         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
  68         Compression no
  69         #CompressionLevel 4
  70         ControlMaster auto
  71         ControlPath ${builtins.toString ../sec/ssh}/ssh-%h-%p-%r.socket
  72         HashKnownHosts no
  73         #SSAPIAuthentication no
  74         SendEnv LANG LC_*
  75         StrictHostKeyChecking yes
  76         UserKnownHostsFile ${builtins.toString ../sec/ssh/known_hosts}
  77       '';
  78     };
  79     virtualbox = {
  80       enable = true;
  81     };
  82   };
  83
  84   # Using modules enables to separate specific configurations
  85   # from reusable code in shell/modules.nix and shell/modules/
  86   # which may find its way in another git repository one day.
  87   modules =
  88     (import shell/modules.nix {
  89       inherit pkgs lib;
  90       modules = [ configuration ];
  91     }).config;
  92 in
  93 pkgs.mkShell {
  94   name = "sourcephile-nix";
  95   src = null;
  96   #preferLocalBuild = true;
  97   #allowSubstitutes = false;
  98   buildInputs = modules.nix-shell.buildInputs ++ [
  99     nixpkgs
 100     nixos.nixos-generate-config
 101     nixos.nixos-install
 102     nixos.nixos-enter
 103     #pkgs.binutils
 104     pkgs.coreutils
 105     pkgs.cryptsetup
 106     pkgs.curl
 107     #pkgs.direnv
 108     pkgs.dnsutils
 109     #pkgs.dropbear
 110     pkgs.e2fsprogs
 111     pkgs.git
 112     pkgs.glibcLocales
 113     pkgs.gnumake
 114     pkgs.gnupg
 115     pkgs.htop
 116     #pkgs.inetutils
 117     pkgs.ipcalc
 118     #pkgs.iputils
 119     pkgs.less
 120     pkgs.libfaketime
 121     pkgs.ldns
 122     #pkgs.ldns.examples
 123     #pkgs.mailutils
 124     pkgs.man
 125     pkgs.mdadm
 126     pkgs.gptfdisk
 127     pkgs.ncdu
 128     pkgs.ncurses
 129     pkgs.nixops
 130     #pkgs.openssl
 131     pkgs.pass
 132     pkgs.procps
 133     pkgs.rsync
 134     #pkgs.rxvt_unicode.terminfo
 135     #pkgs.sqlite
 136     pkgs.sqlite
 137     #pkgs.sudo
 138     pkgs.tig
 139     pkgs.time
 140     #pkgs.tmux
 141     pkgs.tree
 142     pkgs.utillinux
 143     #pkgs.vim
 144     #pkgs.virtualbox
 145     pkgs.which
 146     pkgs.xdg_utils
 147     pkgs.zfs
 148     pkgs.fio
 149     pkgs.strace
 150     pkgs.utillinux
 151     #pkgs.zfstools
 152   ];
 153   #enableParallelBuilding = true;
 154   shellHook = ''
 155     echo >&2 "nix: running shellHook"
 156     # WARNING: beware that sudo may reset the environment,
 157     # and especially PATH, to some system's default.
 158
 159     NIX_SHELL_PATH=$PATH
 160     unset __ETC_PROFILE_SOURCED
 161     unset __NIXOS_SET_ENVIRONMENT_DONE
 162     test ! -e /etc/profile || . /etc/profile
 163     test ! -e ~/.profile || . ~/.profile
 164
 165     # nix
 166     test ! -e ~/.nix-profile/etc/profile.d/nix.sh ||
 167     . ~/.nix-profile/etc/profile.d/nix.sh
 168
 169     # home-manager
 170     unset __HM_SESS_VARS_SOURCED
 171     test ! -e ~/.nix-profile/etc/profile.d/hm-session-vars.sh ||
 172     . ~/.nix-profile/etc/profile.d/hm-session-vars.sh
 173
 174     PATH=$NIX_SHELL_PATH:$PATH
 175     export NIX_PATH="nixpkgs=${pkgs.path}:nixpkgs-overlays="$PWD"/overlays"
 176
 177     # Cleanup "../sec/tmp/"
 178     # This is done when exiting the nix-shell
 179     # (or when… entering the directory with direnv
 180     # which spawns a nix-shell just to get the env).
 181     trap "cd '$PWD' && find ../sec/tmp -type f -exec shred -fu {} +" EXIT
 182
 183     ${modules.nix-shell.shellHook}
 184
 185     # locales
 186     export LANG=fr_FR.UTF-8
 187     export LC_CTYPE=fr_FR.UTF-8
 188
 189     # password-store
 190     export PASSWORD_STORE_DIR="$PWD"/../sec/pass
 191
 192     # gpg
 193     export GPG_TTY=$(tty)
 194     gpg-connect-agent updatestartuptty /bye >/dev/null
 195
 196     # git
 197     gitdir="$PWD"/.git
 198     test ! -f "$gitdir" || while IFS=" :" read -r hdr gitdir; do [ "$hdr" != gitdir ] || break; done <"$gitdir"
 199     ln -fnsr \
 200      "$PWD"/.lib/git/hooks/prepare-commit-msg--longuest-common-prefix \
 201      "$gitdir"/hooks/prepare-commit-msg
 202
 203     # nixops
 204     #export NIXOPS_DEPLOYMENT="staging"
 205     export NIXOPS_STATE="$PWD"/../sec/nixops/state.nixops
 206     NIXOPS_OPTS+=" --show-trace"
 207     export NIXOPS_OPTS
 208
 209     # disnix
 210     #export DISNIXOS_USE_NIXOPS=1
 211     #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
 212     #export DISNIX_PROFILE=default
 213     #export DISNIX_TARGET_PROPERTY=hostname
 214     #export DYSNOMIA_STATEDIR="$PWD"/../sec/dysnomia
 215   '';
 216 }