2 nixpkgs_channel = builtins.getEnv "nixpkgs_channel";
3 originNixpkgs = import (.config/nixpkgs-channel + ("/" + nixpkgs_channel + ".nix"));
4 originPkgs = import originNixpkgs {
5 config = {}; # Make the config pure, ignoring user's config.
8 remoteNixpkgsPatches = [
9 { meta.description = "Dovecot plugin for Full Text Search (FTS) with Xapian";
10 url = "https://github.com/NixOS/nixpkgs/pull/78780.diff";
11 sha256 = "1h45qhbragp5ky6xix198qhadj1j7gd3qswa135mnmw1ijfczyry";
13 { meta.description = "dstat: fix pluginpath";
14 url = "https://github.com/NixOS/nixpkgs/pull/80151.diff";
15 sha256 = "0jjw2gvp7b7v2n2m2d6yj0gw711j6p9lyjf5ywp2y9ql6905qf4b";
17 { meta.description = "syncoid: fix PATH to let it use sudo";
18 url = "https://github.com/NixOS/nixpkgs/pull/83901.diff";
19 sha256 = "0q2dicmvl3h3hb9xdd870n5hf6lac489p000c7f1r6k70sh2id4l";
21 { meta.description = "sanoid: fix sanoid.conf generation";
22 url = "https://github.com/NixOS/nixpkgs/pull/83904.diff";
23 sha256 = "0lj4krmmbz82zpmbacw0qj2ywsx895bq4d1psjn753ymh7jjqj8k";
26 localNixpkgsPatches = [
28 #patches/fts_xapian.diff
30 nixpkgs = originPkgs.applyPatches {
31 name = "nixpkgs-patched";
33 patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
35 patch=$(printf '%s\n' ${builtins.concatStringsSep " "
36 (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
37 sort | sha256sum | cut -c -7)
38 echo "+patch-$patch" >.version-suffix
41 pkgs = import nixpkgs {
42 config = {}; # Make the config pure, ignoring user's config.
43 overlays = import ./overlays.nix;
47 nixos = pkgs.nixos {};
48 # Configuration of shell/modules/
49 configuration = {config, ...}: {
54 auto-optimise-store = true
62 gnupgHome = toString ../sec/gnupg;
63 keys = import shell/openpgp.nix;
66 trusted-key 0xB2450D97085B7B8C
71 opensslHome = toString ../sec/openssl;
72 certificates = import shell/x509.nix;
75 # WARNING: nixops uses its own ssh, not this one.
78 Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
82 ControlPath ${builtins.toString ../sec/ssh}/ssh-%h-%p-%r.socket
84 #SSAPIAuthentication no
86 StrictHostKeyChecking yes
87 UserKnownHostsFile ${builtins.toString ../sec/ssh/known_hosts}
95 # Using modules enables to separate specific configurations
96 # from reusable code in shell/modules.nix and shell/modules/
97 # which may find its way in another git repository one day.
99 (import shell/modules.nix {
101 modules = [ configuration ];
104 # Utility to query the Nix files like nixops show-option
105 # but without requiring a nixops database, and not limited to config entries.
106 pwd = toString (./. + "");
107 sourcephile-nix-get = pkgs.writeShellScriptBin "sourcephile-nix-get" ''
108 nix-instantiate --read-write-mode \
109 --arg networkExprs "[${pwd}/servers.nix ${pwd}/servers/production.nix]" \
110 --arg args '{}' --argstr "uuid" whatever \
111 --argstr deploymentName production "<nixops/eval-machine-info.nix>" \
112 --eval-only --strict --arg checkConfigurationOptions false -A "$@"
114 sourcephile-shred-tmp = pkgs.writeShellScriptBin "sourcephile-shred-tmp" ''
115 # Cleanup "../sec/tmp/"
116 # This is done when entering the nix-shell
117 # because direnv already hooks trap EXIT.
119 test ! -e sec/tmp || {
120 find sec/tmp -type f -exec shred -fu {} +
126 name = "sourcephile-nix";
128 #preferLocalBuild = true;
129 #allowSubstitutes = false;
130 buildInputs = modules.nix-shell.buildInputs ++ [
132 sourcephile-shred-tmp
133 nixos.nixos-generate-config
167 #pkgs.rxvt_unicode.terminfo
186 #enableParallelBuilding = true;
188 echo >&2 "nix: running shellHook"
191 PATH=$NIX_SHELL_PATH:$PATH
192 export NIX_PATH="nixpkgs=${toString pkgs.path}:nixpkgs-overlays="$PWD"/overlays.nix:nixops=${toString pkgs.nixops}/share/nix/nixops"
194 # Since the .envrc calls this shellHook
195 # the EXIT trap cannot be freely used
196 # because it's already used by direnv,
197 # hence shred at startup, which is not ideal.
198 sourcephile-shred-tmp
200 ${modules.nix-shell.shellHook}
203 export PASSWORD_STORE_DIR="$PWD"/../sec/pass
206 export GPG_TTY=$(tty)
207 gpg-connect-agent updatestartuptty /bye >/dev/null
210 #export NIXOPS_DEPLOYMENT="staging"
211 export MERMET_DEPLOYMENT=production
212 export LOSURDO_DEPLOYMENT=production
213 export NIXOPS_STATE="$PWD"/../sec/nixops/state.nixops
214 NIXOPS_OPTS+=" --show-trace"
218 #export DISNIXOS_USE_NIXOPS=1
219 #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
220 #export DISNIX_PROFILE=default
221 #export DISNIX_TARGET_PROPERTY=hostname
222 #export DYSNOMIA_STATEDIR="$PWD"/../sec/dysnomia