]> Git — Sourcephile - sourcephile-nix.git/blob - shell.nix
gitolite: update
[sourcephile-nix.git] / shell.nix
1 let
2 nixpkgs_channel = builtins.getEnv "nixpkgs_channel";
3 originNixpkgs = import (.config/nixpkgs-channel + ("/" + nixpkgs_channel + ".nix"));
4 originPkgs = import originNixpkgs {
5 config = {}; # Make the config pure, ignoring user's config.
6 overlays = [];
7 };
8 nixpkgsPatches = [
9 /*
10 { meta.description = "nsd : use types.lines where appropriate";
11 url = "https://github.com/NixOS/nixpkgs/pull/78968.diff";
12 sha256 = "11bqq1g1ax6i7xghihyhklmqpsq3njalardp6nvzphkjgxrypb47";
13 }
14 { meta.description = "shorewall: init at 5.2.3.3";
15 url = "https://github.com/NixOS/nixpkgs/pull/46131.diff";
16 sha256 = "0mfzlcr23ni5spnwksmmls50sw10alqbr5j6hjrwp9i30z0419yx";
17 }
18 */
19 { meta.description = "Dovecot plugin for Full Text Search (FTS) with Xapian";
20 url = "https://github.com/NixOS/nixpkgs/pull/78780.diff";
21 sha256 = "053md69ryybj27cp0xdfrza48zyzpblk6wvb2m2dbs9hm0gmcwc4";
22 }
23 /* Disabled because it triggers the local build of too many reverse-dependencies
24 { meta.description = "openldap: enable sha2 and pbkdf2 modules";
25 url = "https://github.com/NixOS/nixpkgs/pull/79286.diff";
26 sha256 = "0y255x74qksqy7fm4bdwlknhm3s55vgfgbv4dd7580p4lcavya0m";
27 }
28 */
29 /*
30 { meta.description = "Replace simp-le with lego and support DNS-01 challenge";
31 url = "https://github.com/NixOS/nixpkgs/pull/77578.diff";
32 sha256 = "15zs2146zh54jg1gywrcwyqxpx7izc35vlakk3cvrlqwwsvlr2rf";
33 }
34 */
35 { meta.description = "dstat: fix pluginpath";
36 url = "https://github.com/NixOS/nixpkgs/pull/80151.diff";
37 sha256 = "0jjw2gvp7b7v2n2m2d6yj0gw711j6p9lyjf5ywp2y9ql6905qf4b";
38 }
39 /*
40 { meta.description = "shorewall: fix warnings due to types.loaOf being deprecated";
41 url = "https://github.com/NixOS/nixpkgs/pull/80154.diff";
42 sha256 = "0b216m1rib3jl6s3r5cbkd5h1bfhppikg4cz9ayr1fspsflr3bci";
43 }
44 { meta.description = "shorewall: fix RestartTriggers";
45 url = "https://github.com/NixOS/nixpkgs/pull/81774.diff";
46 sha256 = "14drpym2mq9gq505psjzqq23gv0wkbwrrvh438h5jirzcym3467a";
47 }
48 */
49 ];
50 localNixpkgsPatches = [
51 patches/direnv.diff
52 ];
53 nixpkgs = originPkgs.stdenv.mkDerivation {
54 name = "nixpkgs-patched";
55 src = originNixpkgs;
56 phases = [ "unpackPhase" "patchPhase" ];
57 patches = map originPkgs.fetchpatch nixpkgsPatches ++ localNixpkgsPatches;
58 postPatch = ''
59 patch=$(printf '%s\n' ${builtins.concatStringsSep " " (map (p: p.sha256) nixpkgsPatches)} |
60 sort | sha256sum | cut -c -7)
61 mv $PWD $out
62 echo "+patch-$patch" >$out/.version-suffix
63 '';
64 };
65 pkgs = import nixpkgs {
66 config = {}; # Make the config pure, ignoring user's config.
67 overlays = import ./overlays.nix;
68 };
69
70
71 lib = pkgs.lib;
72 nixos = pkgs.nixos {};
73 # Configuration of shell/modules/
74 configuration = {config, ...}: {
75 imports = [
76 ];
77 nix = {
78 nixConf = ''
79 auto-optimise-store = true
80 '';
81 };
82 nix-plugins = {
83 enable = true;
84 };
85 gnupg = {
86 enable = true;
87 gnupgHome = toString ../sec/gnupg;
88 keys = import shell/openpgp.nix;
89 gpgExtraConf = ''
90 # julm@sourcephile.fr
91 trusted-key 0xB2450D97085B7B8C
92 '';
93 };
94 openssl = {
95 enable = true;
96 opensslHome = toString ../sec/openssl;
97 certificates = import shell/x509.nix;
98 };
99 openssh = {
100 # WARNING: nixops uses its own ssh, not this one.
101 enable = true;
102 sshConf = ''
103 Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
104 Compression no
105 #CompressionLevel 4
106 ControlMaster auto
107 ControlPath ${builtins.toString ../sec/ssh}/ssh-%h-%p-%r.socket
108 HashKnownHosts no
109 #SSAPIAuthentication no
110 SendEnv LANG LC_*
111 StrictHostKeyChecking yes
112 UserKnownHostsFile ${builtins.toString ../sec/ssh/known_hosts}
113 '';
114 };
115 virtualbox = {
116 enable = true;
117 };
118 };
119
120 # Using modules enables to separate specific configurations
121 # from reusable code in shell/modules.nix and shell/modules/
122 # which may find its way in another git repository one day.
123 modules =
124 (import shell/modules.nix {
125 inherit pkgs lib;
126 modules = [ configuration ];
127 }).config;
128
129 # Utility to query the Nix files like nixops show-option
130 # but without requiring a nixops database, and not limited to config entries.
131 pwd = toString (./. + "");
132 sourcephile-nix-get = pkgs.writeShellScriptBin "sourcephile-nix-get" ''
133 nix-instantiate --read-write-mode \
134 --arg networkExprs "[${pwd}/servers.nix ${pwd}/servers/production.nix]" \
135 --arg args '{}' --argstr "uuid" whatever \
136 --argstr deploymentName production "<nixops/eval-machine-info.nix>" \
137 --eval-only --strict --arg checkConfigurationOptions false -A "$@"
138 '';
139 sourcephile-shred-tmp = pkgs.writeShellScriptBin "sourcephile-shred-tmp" ''
140 # Cleanup "../sec/tmp/"
141 # This is done when entering the nix-shell
142 # because direnv already hooks trap EXIT.
143 cd "${pwd}"
144 test ! -e sec/tmp || {
145 find sec/tmp -type f -exec shred -fu {} +
146 rm -rf sec/tmp
147 }
148 '';
149 in
150 pkgs.mkShell {
151 name = "sourcephile-nix";
152 src = null;
153 #preferLocalBuild = true;
154 #allowSubstitutes = false;
155 buildInputs = modules.nix-shell.buildInputs ++ [
156 sourcephile-nix-get
157 sourcephile-shred-tmp
158 nixos.nixos-generate-config
159 nixos.nixos-install
160 nixos.nixos-enter
161 #pkgs.binutils
162 pkgs.coreutils
163 pkgs.cryptsetup
164 pkgs.curl
165 #pkgs.direnv
166 pkgs.dnsutils
167 #pkgs.dropbear
168 pkgs.e2fsprogs
169 pkgs.git
170 pkgs.glibcLocales
171 pkgs.gnumake
172 pkgs.gnupg
173 pkgs.htop
174 #pkgs.inetutils
175 pkgs.ipcalc
176 #pkgs.iputils
177 pkgs.less
178 pkgs.libfaketime
179 pkgs.ldns
180 #pkgs.ldns.examples
181 #pkgs.mailutils
182 pkgs.man
183 pkgs.mdadm
184 pkgs.gptfdisk
185 pkgs.ncdu
186 pkgs.ncurses
187 pkgs.nixops
188 #pkgs.openssl
189 pkgs.pass
190 pkgs.procps
191 pkgs.rsync
192 #pkgs.rxvt_unicode.terminfo
193 #pkgs.sqlite
194 pkgs.sqlite
195 #pkgs.sudo
196 pkgs.tig
197 pkgs.time
198 #pkgs.tmux
199 pkgs.tree
200 pkgs.utillinux
201 #pkgs.vim
202 #pkgs.virtualbox
203 pkgs.which
204 pkgs.xdg_utils
205 pkgs.zfs
206 pkgs.fio
207 pkgs.strace
208 pkgs.utillinux
209 #pkgs.zfstools
210 ];
211 #enableParallelBuilding = true;
212 shellHook = ''
213 echo >&2 "nix: running shellHook"
214
215 # Nix
216 PATH=$NIX_SHELL_PATH:$PATH
217 export NIX_PATH="nixpkgs=${toString pkgs.path}:nixpkgs-overlays="$PWD"/overlays:nixops=${toString pkgs.nixops}/share/nix/nixops"
218
219 # Since the .envrc calls this shellHook
220 # the EXIT trap cannot be freely used
221 # because it's already used by direnv,
222 # hence shred at startup, which is not ideal.
223 sourcephile-shred-tmp
224
225 ${modules.nix-shell.shellHook}
226
227 # password-store
228 export PASSWORD_STORE_DIR="$PWD"/../sec/pass
229
230 # gpg
231 export GPG_TTY=$(tty)
232 gpg-connect-agent updatestartuptty /bye >/dev/null
233
234 # nixops
235 #export NIXOPS_DEPLOYMENT="staging"
236 export MERMET_DEPLOYMENT=production
237 export LOSURDO_DEPLOYMENT=production
238 export NIXOPS_STATE="$PWD"/../sec/nixops/state.nixops
239 NIXOPS_OPTS+=" --show-trace"
240 export NIXOPS_OPTS
241
242 # disnix
243 #export DISNIXOS_USE_NIXOPS=1
244 #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
245 #export DISNIX_PROFILE=default
246 #export DISNIX_TARGET_PROPERTY=hostname
247 #export DYSNOMIA_STATEDIR="$PWD"/../sec/dysnomia
248 '';
249 }