shell.nix

   1 let
   2   nixpkgs_channel = builtins.getEnv "nixpkgs_channel";
   3   originNixpkgs = import (.config/nixpkgs-channel + ("/" + nixpkgs_channel + ".nix"));
   4   originPkgs = import originNixpkgs {
   5     config   = {}; # Make the config pure, ignoring user's config.
   6     overlays = [];
   7   };
   8   nixpkgsPatches = [
   9     /*
  10     { meta.description = "nsd : use types.lines where appropriate";
  11       url = "https://github.com/NixOS/nixpkgs/pull/78968.diff";
  12       sha256 = "11bqq1g1ax6i7xghihyhklmqpsq3njalardp6nvzphkjgxrypb47";
  13     }
  14     { meta.description = "shorewall: init at 5.2.3.3";
  15       url = "https://github.com/NixOS/nixpkgs/pull/46131.diff";
  16       sha256 = "0mfzlcr23ni5spnwksmmls50sw10alqbr5j6hjrwp9i30z0419yx";
  17     }
  18     */
  19     { meta.description = "Dovecot plugin for Full Text Search (FTS) with Xapian";
  20       url = "https://github.com/NixOS/nixpkgs/pull/78780.diff";
  21       sha256 = "053md69ryybj27cp0xdfrza48zyzpblk6wvb2m2dbs9hm0gmcwc4";
  22     }
  23     /* Disabled because it triggers the local build of too many reverse-dependencies
  24     { meta.description = "openldap: enable sha2 and pbkdf2 modules";
  25       url = "https://github.com/NixOS/nixpkgs/pull/79286.diff";
  26       sha256 = "0y255x74qksqy7fm4bdwlknhm3s55vgfgbv4dd7580p4lcavya0m";
  27     }
  28     */
  29     /*
  30     { meta.description = "Replace simp-le with lego and support DNS-01 challenge";
  31       url = "https://github.com/NixOS/nixpkgs/pull/77578.diff";
  32       sha256 = "15zs2146zh54jg1gywrcwyqxpx7izc35vlakk3cvrlqwwsvlr2rf";
  33     }
  34     */
  35     { meta.description = "dstat: fix pluginpath";
  36       url = "https://github.com/NixOS/nixpkgs/pull/80151.diff";
  37       sha256 = "0jjw2gvp7b7v2n2m2d6yj0gw711j6p9lyjf5ywp2y9ql6905qf4b";
  38     }
  39     { meta.description = "shorewall: fix warnings due to types.loaOf being deprecated";
  40       url = "https://github.com/NixOS/nixpkgs/pull/80154.diff";
  41       sha256 = "0b216m1rib3jl6s3r5cbkd5h1bfhppikg4cz9ayr1fspsflr3bci";
  42     }
  43   ];
  44   localNixpkgsPatches = [
  45   ];
  46   nixpkgs = originPkgs.stdenv.mkDerivation {
  47     name = "nixpkgs-patched";
  48     src = originNixpkgs;
  49     phases = [ "unpackPhase" "patchPhase" ];
  50     patches = map originPkgs.fetchpatch nixpkgsPatches ++ localNixpkgsPatches;
  51     postPatch = ''
  52       patch=$(printf '%s\n' ${builtins.concatStringsSep " " (map (p: p.sha256) nixpkgsPatches)} |
  53         sort | sha256sum | cut -c -7)
  54       mv $PWD $out
  55       echo "+patch-$patch" >$out/.version-suffix
  56     '';
  57   };
  58   pkgs = import nixpkgs {
  59     config = {}; # Make the config pure, ignoring user's config.
  60     overlays = import ./overlays.nix;
  61   };
  62
  63
  64   lib = pkgs.lib;
  65   nixos = pkgs.nixos {};
  66   # Configuration of shell/modules/
  67   configuration = {config, ...}: {
  68     imports = [
  69     ];
  70     nix = {
  71       nixConf = ''
  72         auto-optimise-store = true
  73       '';
  74     };
  75     nix-plugins = {
  76       enable = true;
  77     };
  78     gnupg = {
  79       enable = true;
  80       gnupgHome = toString ../sec/gnupg;
  81       keys = import shell/openpgp.nix;
  82       gpgExtraConf = ''
  83         trusted-key 0xB2450D97085B7B8C
  84       '';
  85     };
  86     openssl = {
  87       enable = true;
  88       opensslHome = toString ../sec/openssl;
  89       certificates = import shell/x509.nix;
  90     };
  91     openssh = {
  92       # WARNING: nixops uses its own ssh, not this one.
  93       enable = true;
  94       sshConf = ''
  95         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
  96         Compression no
  97         #CompressionLevel 4
  98         ControlMaster auto
  99         ControlPath ${builtins.toString ../sec/ssh}/ssh-%h-%p-%r.socket
 100         HashKnownHosts no
 101         #SSAPIAuthentication no
 102         SendEnv LANG LC_*
 103         StrictHostKeyChecking yes
 104         UserKnownHostsFile ${builtins.toString ../sec/ssh/known_hosts}
 105       '';
 106     };
 107     virtualbox = {
 108       enable = true;
 109     };
 110   };
 111
 112   # Using modules enables to separate specific configurations
 113   # from reusable code in shell/modules.nix and shell/modules/
 114   # which may find its way in another git repository one day.
 115   modules =
 116     (import shell/modules.nix {
 117       inherit pkgs lib;
 118       modules = [ configuration ];
 119     }).config;
 120 in
 121 pkgs.mkShell {
 122   name = "sourcephile-nix";
 123   src = null;
 124   #preferLocalBuild = true;
 125   #allowSubstitutes = false;
 126   buildInputs = modules.nix-shell.buildInputs ++ [
 127     nixos.nixos-generate-config
 128     nixos.nixos-install
 129     nixos.nixos-enter
 130     #pkgs.binutils
 131     pkgs.coreutils
 132     pkgs.cryptsetup
 133     pkgs.curl
 134     #pkgs.direnv
 135     pkgs.dnsutils
 136     #pkgs.dropbear
 137     pkgs.e2fsprogs
 138     pkgs.git
 139     pkgs.glibcLocales
 140     pkgs.gnumake
 141     pkgs.gnupg
 142     pkgs.htop
 143     #pkgs.inetutils
 144     pkgs.ipcalc
 145     #pkgs.iputils
 146     pkgs.less
 147     pkgs.libfaketime
 148     pkgs.ldns
 149     #pkgs.ldns.examples
 150     #pkgs.mailutils
 151     pkgs.man
 152     pkgs.mdadm
 153     pkgs.gptfdisk
 154     pkgs.ncdu
 155     pkgs.ncurses
 156     pkgs.nixops
 157     #pkgs.openssl
 158     pkgs.pass
 159     pkgs.procps
 160     pkgs.rsync
 161     #pkgs.rxvt_unicode.terminfo
 162     #pkgs.sqlite
 163     pkgs.sqlite
 164     #pkgs.sudo
 165     pkgs.tig
 166     pkgs.time
 167     #pkgs.tmux
 168     pkgs.tree
 169     pkgs.utillinux
 170     #pkgs.vim
 171     #pkgs.virtualbox
 172     pkgs.which
 173     pkgs.xdg_utils
 174     pkgs.zfs
 175     pkgs.fio
 176     pkgs.strace
 177     pkgs.utillinux
 178     #pkgs.zfstools
 179   ];
 180   #enableParallelBuilding = true;
 181   shellHook = ''
 182     echo >&2 "nix: running shellHook"
 183     # WARNING: beware that sudo may reset the environment,
 184     # and especially PATH, to some system's default.
 185
 186     NIX_SHELL_PATH=$PATH
 187     unset __ETC_PROFILE_SOURCED
 188     unset __NIXOS_SET_ENVIRONMENT_DONE
 189     test ! -e /etc/profile || . /etc/profile
 190     test ! -e ~/.profile || . ~/.profile
 191
 192     # nix
 193     test ! -e ~/.nix-profile/etc/profile.d/nix.sh ||
 194     . ~/.nix-profile/etc/profile.d/nix.sh
 195
 196     # home-manager
 197     unset __HM_SESS_VARS_SOURCED
 198     test ! -e ~/.nix-profile/etc/profile.d/hm-session-vars.sh ||
 199     . ~/.nix-profile/etc/profile.d/hm-session-vars.sh
 200
 201     PATH=$NIX_SHELL_PATH:$PATH
 202     export NIX_PATH="nixpkgs=${toString pkgs.path}:nixpkgs-overlays="$PWD"/overlays"
 203     export nixpkgs_channel=${nixpkgs_channel}
 204
 205     # Cleanup "../sec/tmp/"
 206     # This is done when entering the nix-shell
 207     # because direnv already hooks trap EXIT.
 208     (cd "$PWD" && find ../sec/tmp -type f -exec shred -fu {} +)
 209
 210     ${modules.nix-shell.shellHook}
 211
 212     # locales
 213     export LANG=fr_FR.UTF-8
 214     export LC_CTYPE=fr_FR.UTF-8
 215
 216     # password-store
 217     export PASSWORD_STORE_DIR="$PWD"/../sec/pass
 218
 219     # gpg
 220     export GPG_TTY=$(tty)
 221     gpg-connect-agent updatestartuptty /bye >/dev/null
 222
 223     # git
 224     gitdir="$PWD"/.git
 225     test ! -f "$gitdir" || while IFS=" :" read -r hdr gitdir; do [ "$hdr" != gitdir ] || break; done <"$gitdir"
 226     ln -fnsr \
 227      "$PWD"/.lib/git/hooks/prepare-commit-msg--longuest-common-prefix \
 228      "$gitdir"/hooks/prepare-commit-msg
 229
 230     # nixops
 231     #export NIXOPS_DEPLOYMENT="staging"
 232     export NIXOPS_STATE="$PWD"/../sec/nixops/state.nixops
 233     NIXOPS_OPTS+=" --show-trace"
 234     export NIXOPS_OPTS
 235
 236     # disnix
 237     #export DISNIXOS_USE_NIXOPS=1
 238     #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
 239     #export DISNIX_PROFILE=default
 240     #export DISNIX_TARGET_PROPERTY=hostname
 241     #export DYSNOMIA_STATEDIR="$PWD"/../sec/dysnomia
 242   '';
 243 }