shell.nix

   1 let
   2   nixpkgs_channel = builtins.getEnv "nixpkgs_channel";
   3   # Bootstraping Nixpkgs to get tools to patch it.
   4   originNixpkgs = import (.config/nixpkgs-channel + ("/${nixpkgs_channel}.nix"));
   5   originPkgs = import originNixpkgs {
   6     config = {}; # Make the config pure, ignoring user's config.
   7     overlays = [];
   8   };
   9   remoteNixpkgsPatches = [
  10     { meta.description = "dstat: fix pluginpath";
  11       url = "https://github.com/NixOS/nixpkgs/pull/80151.diff";
  12       sha256 = "0jjw2gvp7b7v2n2m2d6yj0gw711j6p9lyjf5ywp2y9ql6905qf4b";
  13     }
  14     { meta.description = "syncoid: fix PATH to let it use sudo";
  15       url = "https://github.com/NixOS/nixpkgs/pull/83901.diff";
  16       sha256 = "0q2dicmvl3h3hb9xdd870n5hf6lac489p000c7f1r6k70sh2id4l";
  17     }
  18     { meta.description = "sanoid: fix sanoid.conf generation";
  19       url = "https://github.com/NixOS/nixpkgs/pull/83904.diff";
  20       sha256 = "0lj4krmmbz82zpmbacw0qj2ywsx895bq4d1psjn753ymh7jjqj8k";
  21     }
  22     { meta.description = "nixos/public-inbox: init";
  23       url = "https://github.com/NixOS/nixpkgs/pull/77450.diff";
  24       sha256 = "13ikg7chpbf6rrg5sngbdb95q3awhdgl4g8vci42xmqyf208hzzd";
  25     }
  26     /*
  27     { meta.description = "transmission: apply RFC0042 and harden the service";
  28       url = "https://github.com/NixOS/nixpkgs/pull/92106.diff";
  29       sha256 = "0h1105qy0wrirvi9fk5d00qsjvm745196vb7wgr648d56rm17vv1";
  30     }
  31     { meta.description = "apparmor: fix and improve the service";
  32       url = "https://github.com/NixOS/nixpkgs/pull/93457.diff";
  33       sha256 = "0y1kvsnm8xiplbm4w4cadmfkr452vipswkz3kwyyikknh06vj3mn";
  34     }
  35     */
  36   ];
  37   localNixpkgsPatches = [
  38     nixpkgs/patches/transmission+apparmor.diff
  39     nixpkgs/patches/installer.ssh-nixos.diff
  40     nixpkgs/patches/security.gnupg.diff
  41     nixpkgs/patches/services.croc.diff
  42     nixpkgs/patches/fix-flushBeforeStage2.diff
  43   ];
  44   # Build nixpkgs with some patches.
  45   nixpkgs = originPkgs.applyPatches {
  46     name = "nixpkgs-patched";
  47     src = originNixpkgs;
  48     patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  49     postPatch = ''
  50       patch=$(printf '%s\n' ${builtins.concatStringsSep " "
  51          (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
  52         sort | sha256sum | cut -c -7)
  53       echo "+patch-$patch" >.version-suffix
  54     '';
  55   };
  56   # Final pkgs with custom overlays.
  57   pkgs = import nixpkgs {
  58     config = {}; # Make the config pure, ignoring user's config.
  59     overlays = import nixpkgs/overlays.nix;
  60   };
  61
  62   # Configuration of shell/modules/
  63   # to expand shellHook and buildInputs of this shell.nix
  64   shellConfig = {config, ...}: {
  65     imports = [
  66       shell/gnupg.nix
  67     ];
  68     nix = {
  69       nixConf = ''
  70         auto-optimise-store = true
  71       '';
  72     };
  73     nix-plugins = {
  74       enable = true;
  75     };
  76     gnupg = {
  77       enable = true;
  78       gnupgHome = toString ../sec/gnupg;
  79       gpgExtraConf = ''
  80         # julm@sourcephile.fr
  81         trusted-key 0xB2450D97085B7B8C
  82       '';
  83       gpgAgentExtraConf = ''
  84         #pretend-request-origin remote
  85         #extra-socket ${toString ./.}/S.gpg-agent.extra
  86         #log-file ${toString ./.}/gpg-agent.log
  87         #no-grab
  88         #debug-level expert
  89         #allow-loopback-pinentry
  90       '';
  91     };
  92     openssl = {
  93       enable = true;
  94       opensslHome = toString ../sec/openssl;
  95       certificates = import shell/x509.nix;
  96     };
  97     openssh = {
  98       enable = true;
  99       sshConf = ''
 100         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
 101         Compression no
 102         #CompressionLevel 4
 103         ControlMaster auto
 104         ControlPath ${toString ../sec/ssh}/ssh-%h-%p-%r.socket
 105         HashKnownHosts no
 106         #SSAPIAuthentication no
 107         SendEnv LANG LC_*
 108         StrictHostKeyChecking yes
 109         UserKnownHostsFile ${toString ../sec/ssh/known_hosts}
 110       '';
 111     };
 112     virtualbox = {
 113       enable = false;
 114     };
 115   };
 116
 117   # Using modules enables to separate specific configurations
 118   # from reusable code in shell/modules.nix and shell/modules/
 119   # which may find its way in another git repository one day.
 120   shell = (pkgs.lib.evalModules {
 121     modules = [ shellConfig ] ++ map import (pkgs.lib.findFiles ".*\\.nix" shell/modules);
 122     args = { inherit pkgs; };
 123   }).config;
 124
 125   pwd = toString (./. + "");
 126   sourcephile-shred-tmp = pkgs.writeShellScriptBin "sourcephile-shred-tmp" ''
 127     # This is done when entering the nix-shell
 128     # because direnv already hooks trap EXIT.
 129     cd "${pwd}"
 130     test ! -e sec/tmp || {
 131     find sec/tmp -type f -exec shred -fu {} +
 132     rm -rf sec/tmp
 133     }
 134   '';
 135 in
 136 pkgs.mkShell {
 137   name = "sourcephile-nix";
 138   src = null;
 139   #preferLocalBuild = true;
 140   #allowSubstitutes = false;
 141   buildInputs = shell.nix-shell.buildInputs ++ [
 142     sourcephile-shred-tmp
 143     (pkgs.nixos []).nixos-generate-config
 144     (pkgs.nixos []).nixos-install
 145     (pkgs.nixos []).nixos-enter
 146     #pkgs.binutils
 147     pkgs.coreutils
 148     pkgs.cryptsetup
 149     pkgs.curl
 150     #pkgs.direnv
 151     pkgs.dnsutils
 152     #pkgs.dropbear
 153     pkgs.e2fsprogs
 154     pkgs.git
 155     pkgs.glibcLocales
 156     pkgs.gnumake
 157     pkgs.gnupg
 158     pkgs.htop
 159     #pkgs.inetutils
 160     pkgs.ipcalc
 161     #pkgs.iputils
 162     pkgs.less
 163     pkgs.libfaketime
 164     pkgs.ldns
 165     #pkgs.ldns.examples
 166     #pkgs.mailutils
 167     pkgs.man
 168     pkgs.mdadm
 169     pkgs.gptfdisk
 170     pkgs.ncdu
 171     pkgs.ncurses
 172     #pkgs.nixops
 173     #pkgs.openssl
 174     pkgs.pass
 175     pkgs.procps
 176     pkgs.rsync
 177     #pkgs.rxvt_unicode.terminfo
 178     #pkgs.sqlite
 179     pkgs.sqlite
 180     #pkgs.sudo
 181     pkgs.tig
 182     pkgs.time
 183     #pkgs.tmux
 184     pkgs.tree
 185     pkgs.utillinux
 186     #pkgs.vim
 187     #pkgs.virtualbox
 188     pkgs.which
 189     pkgs.xdg_utils
 190     pkgs.zfs
 191     pkgs.fio
 192     pkgs.strace
 193     pkgs.utillinux
 194     #pkgs.zfstools
 195     pkgs.linuxPackages.perf
 196     #pkgs.go2nix
 197     pkgs.wireguard
 198   ];
 199   #enableParallelBuilding = true;
 200   shellHook = ''
 201     echo >&2 "nix: running shellHook"
 202
 203     # password-store
 204     export PASSWORD_STORE_DIR="$PWD"/../sec/pass
 205
 206     # Nix
 207     PATH=$NIX_SHELL_PATH:$PATH
 208     export NIX_PATH="${pkgs.lib.concatStringsSep ":" [
 209       "machines=$PWD/machines.nix"
 210       #"pass=$PASSWORD_STORE_DIR"
 211       "nixpkgs=${toString pkgs.path}"
 212       "nixpkgs-overlays=$PWD/nixpkgs/overlays.nix"
 213     ]}"
 214
 215     # Since the .envrc calls this shellHook
 216     # the EXIT trap cannot be freely used
 217     # because it's already used by direnv,
 218     # hence shred at startup, which is not ideal.
 219     sourcephile-shred-tmp
 220
 221     ${shell.nix-shell.shellHook}
 222
 223     # gpg
 224     export GPG_TTY=$(tty)
 225     gpg-connect-agent updatestartuptty /bye >/dev/null
 226   '';
 227 }