shell.nix

   1 let
   2   originNixpkgs = import .config/nixpkgs-channel/nixos-19.09-small.nix;
   3   originPkgs = import originNixpkgs {
   4     config   = {}; # Make the config pure, ignoring user's config.
   5     overlays = [];
   6   };
   7   nixpkgsPatches = [
   8     { meta.description = "nsd : use types.lines where appropriate";
   9       url = "https://github.com/NixOS/nixpkgs/pull/78968.diff";
  10       sha256 = "11bqq1g1ax6i7xghihyhklmqpsq3njalardp6nvzphkjgxrypb47";
  11     }
  12     { meta.description = "shorewall: init at 5.2.3.3";
  13       url = "https://github.com/NixOS/nixpkgs/pull/46131.diff";
  14       sha256 = "0mfzlcr23ni5spnwksmmls50sw10alqbr5j6hjrwp9i30z0419yx";
  15     }
  16     { meta.description = "Dovecot plugin for Full Text Search (FTS) with Xapian";
  17       url = "https://github.com/NixOS/nixpkgs/pull/78780.diff";
  18       sha256 = "053md69ryybj27cp0xdfrza48zyzpblk6wvb2m2dbs9hm0gmcwc4";
  19     }
  20   ];
  21   nixpkgs = originPkgs.stdenv.mkDerivation {
  22     name = "nixpkgs-patched";
  23     src = originNixpkgs;
  24     phases = [ "unpackPhase" "patchPhase" ];
  25     patches = map originPkgs.fetchpatch nixpkgsPatches;
  26     postPatch = ''
  27       patch=$(printf '%s\n' ${builtins.concatStringsSep " " (map (p: p.sha256) nixpkgsPatches)} |
  28         sort | sha256sum | cut -c -7)
  29       mv $PWD $out
  30       echo "+patch-$patch" >$out/.version-suffix
  31     '';
  32   };
  33   pkgs = import nixpkgs {
  34     config = {}; # Make the config pure, ignoring user's config.
  35     overlays = import ./overlays.nix;
  36   };
  37
  38
  39   lib = pkgs.lib;
  40   nixos = pkgs.nixos {};
  41   # Configuration of shell/modules/
  42   configuration = {config, ...}: {
  43     imports = [
  44     ];
  45     nix = {
  46       nixConf = ''
  47         auto-optimise-store = true
  48       '';
  49     };
  50     nix-plugins = {
  51       enable = true;
  52     };
  53     gnupg = {
  54       enable = true;
  55       gnupgHome = toString ../sec/gnupg;
  56       keys = import shell/openpgp.nix;
  57       gpgExtraConf = ''
  58         trusted-key 0xB2450D97085B7B8C
  59       '';
  60     };
  61     openssl = {
  62       enable = true;
  63       opensslHome = toString ../sec/openssl;
  64       certificates = import shell/x509.nix;
  65     };
  66     openssh = {
  67       # WARNING: nixops uses its own ssh, not this one.
  68       enable = true;
  69       sshConf = ''
  70         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
  71         Compression no
  72         #CompressionLevel 4
  73         ControlMaster auto
  74         ControlPath ${builtins.toString ../sec/ssh}/ssh-%h-%p-%r.socket
  75         HashKnownHosts no
  76         #SSAPIAuthentication no
  77         SendEnv LANG LC_*
  78         StrictHostKeyChecking yes
  79         UserKnownHostsFile ${builtins.toString ../sec/ssh/known_hosts}
  80       '';
  81     };
  82     virtualbox = {
  83       enable = true;
  84     };
  85   };
  86
  87   # Using modules enables to separate specific configurations
  88   # from reusable code in shell/modules.nix and shell/modules/
  89   # which may find its way in another git repository one day.
  90   modules =
  91     (import shell/modules.nix {
  92       inherit pkgs lib;
  93       modules = [ configuration ];
  94     }).config;
  95 in
  96 pkgs.mkShell {
  97   name = "sourcephile-nix";
  98   src = null;
  99   #preferLocalBuild = true;
 100   #allowSubstitutes = false;
 101   buildInputs = modules.nix-shell.buildInputs ++ [
 102     nixpkgs
 103     nixos.nixos-generate-config
 104     nixos.nixos-install
 105     nixos.nixos-enter
 106     #pkgs.binutils
 107     pkgs.coreutils
 108     pkgs.cryptsetup
 109     pkgs.curl
 110     #pkgs.direnv
 111     pkgs.dnsutils
 112     #pkgs.dropbear
 113     pkgs.e2fsprogs
 114     pkgs.git
 115     pkgs.glibcLocales
 116     pkgs.gnumake
 117     pkgs.gnupg
 118     pkgs.htop
 119     #pkgs.inetutils
 120     pkgs.ipcalc
 121     #pkgs.iputils
 122     pkgs.less
 123     pkgs.libfaketime
 124     pkgs.ldns
 125     #pkgs.ldns.examples
 126     #pkgs.mailutils
 127     pkgs.man
 128     pkgs.mdadm
 129     pkgs.gptfdisk
 130     pkgs.ncdu
 131     pkgs.ncurses
 132     pkgs.nixops
 133     #pkgs.openssl
 134     pkgs.pass
 135     pkgs.procps
 136     pkgs.rsync
 137     #pkgs.rxvt_unicode.terminfo
 138     #pkgs.sqlite
 139     pkgs.sqlite
 140     #pkgs.sudo
 141     pkgs.tig
 142     pkgs.time
 143     #pkgs.tmux
 144     pkgs.tree
 145     pkgs.utillinux
 146     #pkgs.vim
 147     #pkgs.virtualbox
 148     pkgs.which
 149     pkgs.xdg_utils
 150     pkgs.zfs
 151     pkgs.fio
 152     pkgs.strace
 153     pkgs.utillinux
 154     #pkgs.zfstools
 155   ];
 156   #enableParallelBuilding = true;
 157   shellHook = ''
 158     echo >&2 "nix: running shellHook"
 159     # WARNING: beware that sudo may reset the environment,
 160     # and especially PATH, to some system's default.
 161
 162     NIX_SHELL_PATH=$PATH
 163     unset __ETC_PROFILE_SOURCED
 164     unset __NIXOS_SET_ENVIRONMENT_DONE
 165     test ! -e /etc/profile || . /etc/profile
 166     test ! -e ~/.profile || . ~/.profile
 167
 168     # nix
 169     test ! -e ~/.nix-profile/etc/profile.d/nix.sh ||
 170     . ~/.nix-profile/etc/profile.d/nix.sh
 171
 172     # home-manager
 173     unset __HM_SESS_VARS_SOURCED
 174     test ! -e ~/.nix-profile/etc/profile.d/hm-session-vars.sh ||
 175     . ~/.nix-profile/etc/profile.d/hm-session-vars.sh
 176
 177     PATH=$NIX_SHELL_PATH:$PATH
 178     export NIX_PATH="nixpkgs=${pkgs.path}:nixpkgs-overlays="$PWD"/overlays"
 179
 180     # Cleanup "../sec/tmp/"
 181     # This is done when exiting the nix-shell
 182     # (or when… entering the directory with direnv
 183     # which spawns a nix-shell just to get the env).
 184     trap "cd '$PWD' && find ../sec/tmp -type f -exec shred -fu {} +" EXIT
 185
 186     ${modules.nix-shell.shellHook}
 187
 188     # locales
 189     export LANG=fr_FR.UTF-8
 190     export LC_CTYPE=fr_FR.UTF-8
 191
 192     # password-store
 193     export PASSWORD_STORE_DIR="$PWD"/../sec/pass
 194
 195     # gpg
 196     export GPG_TTY=$(tty)
 197     gpg-connect-agent updatestartuptty /bye >/dev/null
 198
 199     # git
 200     gitdir="$PWD"/.git
 201     test ! -f "$gitdir" || while IFS=" :" read -r hdr gitdir; do [ "$hdr" != gitdir ] || break; done <"$gitdir"
 202     ln -fnsr \
 203      "$PWD"/.lib/git/hooks/prepare-commit-msg--longuest-common-prefix \
 204      "$gitdir"/hooks/prepare-commit-msg
 205
 206     # nixops
 207     #export NIXOPS_DEPLOYMENT="staging"
 208     export NIXOPS_STATE="$PWD"/../sec/nixops/state.nixops
 209     NIXOPS_OPTS+=" --show-trace"
 210     export NIXOPS_OPTS
 211
 212     # disnix
 213     #export DISNIXOS_USE_NIXOPS=1
 214     #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
 215     #export DISNIX_PROFILE=default
 216     #export DISNIX_TARGET_PROPERTY=hostname
 217     #export DYSNOMIA_STATEDIR="$PWD"/../sec/dysnomia
 218   '';
 219 }