shell.nix

   1 let
   2   nixpkgs_channel = builtins.getEnv "nixpkgs_channel";
   3   originNixpkgs = import (.config/nixpkgs-channel + ("/" + nixpkgs_channel + ".nix"));
   4   originPkgs = import originNixpkgs {
   5     config   = {}; # Make the config pure, ignoring user's config.
   6     overlays = [];
   7   };
   8   nixpkgsPatches = [
   9     /*
  10     { meta.description = "nsd : use types.lines where appropriate";
  11       url = "https://github.com/NixOS/nixpkgs/pull/78968.diff";
  12       sha256 = "11bqq1g1ax6i7xghihyhklmqpsq3njalardp6nvzphkjgxrypb47";
  13     }
  14     { meta.description = "shorewall: init at 5.2.3.3";
  15       url = "https://github.com/NixOS/nixpkgs/pull/46131.diff";
  16       sha256 = "0mfzlcr23ni5spnwksmmls50sw10alqbr5j6hjrwp9i30z0419yx";
  17     }
  18     */
  19     { meta.description = "Dovecot plugin for Full Text Search (FTS) with Xapian";
  20       url = "https://github.com/NixOS/nixpkgs/pull/78780.diff";
  21       sha256 = "053md69ryybj27cp0xdfrza48zyzpblk6wvb2m2dbs9hm0gmcwc4";
  22     }
  23     /* Disabled because it triggers the local build of too many reverse-dependencies
  24     { meta.description = "openldap: enable sha2 and pbkdf2 modules";
  25       url = "https://github.com/NixOS/nixpkgs/pull/79286.diff";
  26       sha256 = "0y255x74qksqy7fm4bdwlknhm3s55vgfgbv4dd7580p4lcavya0m";
  27     }
  28     */
  29     { meta.description = "Replace simp-le with lego and support DNS-01 challenge";
  30       url = "https://github.com/NixOS/nixpkgs/pull/77578.diff";
  31       sha256 = "15zs2146zh54jg1gywrcwyqxpx7izc35vlakk3cvrlqwwsvlr2rf";
  32     }
  33   ];
  34   localNixpkgsPatches = [
  35   ];
  36   nixpkgs = originPkgs.stdenv.mkDerivation {
  37     name = "nixpkgs-patched";
  38     src = originNixpkgs;
  39     phases = [ "unpackPhase" "patchPhase" ];
  40     patches = map originPkgs.fetchpatch nixpkgsPatches ++ localNixpkgsPatches;
  41     postPatch = ''
  42       patch=$(printf '%s\n' ${builtins.concatStringsSep " " (map (p: p.sha256) nixpkgsPatches)} |
  43         sort | sha256sum | cut -c -7)
  44       mv $PWD $out
  45       echo "+patch-$patch" >$out/.version-suffix
  46     '';
  47   };
  48   pkgs = import nixpkgs {
  49     config = {}; # Make the config pure, ignoring user's config.
  50     overlays = import ./overlays.nix;
  51   };
  52
  53
  54   lib = pkgs.lib;
  55   nixos = pkgs.nixos {};
  56   # Configuration of shell/modules/
  57   configuration = {config, ...}: {
  58     imports = [
  59     ];
  60     nix = {
  61       nixConf = ''
  62         auto-optimise-store = true
  63       '';
  64     };
  65     nix-plugins = {
  66       enable = true;
  67     };
  68     gnupg = {
  69       enable = true;
  70       gnupgHome = toString ../sec/gnupg;
  71       keys = import shell/openpgp.nix;
  72       gpgExtraConf = ''
  73         trusted-key 0xB2450D97085B7B8C
  74       '';
  75     };
  76     openssl = {
  77       enable = true;
  78       opensslHome = toString ../sec/openssl;
  79       certificates = import shell/x509.nix;
  80     };
  81     openssh = {
  82       # WARNING: nixops uses its own ssh, not this one.
  83       enable = true;
  84       sshConf = ''
  85         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
  86         Compression no
  87         #CompressionLevel 4
  88         ControlMaster auto
  89         ControlPath ${builtins.toString ../sec/ssh}/ssh-%h-%p-%r.socket
  90         HashKnownHosts no
  91         #SSAPIAuthentication no
  92         SendEnv LANG LC_*
  93         StrictHostKeyChecking yes
  94         UserKnownHostsFile ${builtins.toString ../sec/ssh/known_hosts}
  95       '';
  96     };
  97     virtualbox = {
  98       enable = true;
  99     };
 100   };
 101
 102   # Using modules enables to separate specific configurations
 103   # from reusable code in shell/modules.nix and shell/modules/
 104   # which may find its way in another git repository one day.
 105   modules =
 106     (import shell/modules.nix {
 107       inherit pkgs lib;
 108       modules = [ configuration ];
 109     }).config;
 110 in
 111 pkgs.mkShell {
 112   name = "sourcephile-nix";
 113   src = null;
 114   #preferLocalBuild = true;
 115   #allowSubstitutes = false;
 116   buildInputs = modules.nix-shell.buildInputs ++ [
 117     nixpkgs
 118     nixos.nixos-generate-config
 119     nixos.nixos-install
 120     nixos.nixos-enter
 121     #pkgs.binutils
 122     pkgs.coreutils
 123     pkgs.cryptsetup
 124     pkgs.curl
 125     #pkgs.direnv
 126     pkgs.dnsutils
 127     #pkgs.dropbear
 128     pkgs.e2fsprogs
 129     pkgs.git
 130     pkgs.glibcLocales
 131     pkgs.gnumake
 132     pkgs.gnupg
 133     pkgs.htop
 134     #pkgs.inetutils
 135     pkgs.ipcalc
 136     #pkgs.iputils
 137     pkgs.less
 138     pkgs.libfaketime
 139     pkgs.ldns
 140     #pkgs.ldns.examples
 141     #pkgs.mailutils
 142     pkgs.man
 143     pkgs.mdadm
 144     pkgs.gptfdisk
 145     pkgs.ncdu
 146     pkgs.ncurses
 147     pkgs.nixops
 148     #pkgs.openssl
 149     pkgs.pass
 150     pkgs.procps
 151     pkgs.rsync
 152     #pkgs.rxvt_unicode.terminfo
 153     #pkgs.sqlite
 154     pkgs.sqlite
 155     #pkgs.sudo
 156     pkgs.tig
 157     pkgs.time
 158     #pkgs.tmux
 159     pkgs.tree
 160     pkgs.utillinux
 161     #pkgs.vim
 162     #pkgs.virtualbox
 163     pkgs.which
 164     pkgs.xdg_utils
 165     pkgs.zfs
 166     pkgs.fio
 167     pkgs.strace
 168     pkgs.utillinux
 169     #pkgs.zfstools
 170   ];
 171   #enableParallelBuilding = true;
 172   shellHook = ''
 173     echo >&2 "nix: running shellHook"
 174     # WARNING: beware that sudo may reset the environment,
 175     # and especially PATH, to some system's default.
 176
 177     NIX_SHELL_PATH=$PATH
 178     unset __ETC_PROFILE_SOURCED
 179     unset __NIXOS_SET_ENVIRONMENT_DONE
 180     test ! -e /etc/profile || . /etc/profile
 181     test ! -e ~/.profile || . ~/.profile
 182
 183     # nix
 184     test ! -e ~/.nix-profile/etc/profile.d/nix.sh ||
 185     . ~/.nix-profile/etc/profile.d/nix.sh
 186
 187     # home-manager
 188     unset __HM_SESS_VARS_SOURCED
 189     test ! -e ~/.nix-profile/etc/profile.d/hm-session-vars.sh ||
 190     . ~/.nix-profile/etc/profile.d/hm-session-vars.sh
 191
 192     PATH=$NIX_SHELL_PATH:$PATH
 193     export NIX_PATH="nixpkgs=${toString pkgs.path}:nixpkgs-overlays="$PWD"/overlays"
 194     export nixpkgs_channel=${nixpkgs_channel}
 195
 196     # Cleanup "../sec/tmp/"
 197     # This is done when exiting the nix-shell
 198     # (or when… entering the directory with direnv
 199     # which spawns a nix-shell just to get the env).
 200     trap "cd '$PWD' && find ../sec/tmp -type f -exec shred -fu {} +" EXIT
 201
 202     ${modules.nix-shell.shellHook}
 203
 204     # locales
 205     export LANG=fr_FR.UTF-8
 206     export LC_CTYPE=fr_FR.UTF-8
 207
 208     # password-store
 209     export PASSWORD_STORE_DIR="$PWD"/../sec/pass
 210
 211     # gpg
 212     export GPG_TTY=$(tty)
 213     gpg-connect-agent updatestartuptty /bye >/dev/null
 214
 215     # git
 216     gitdir="$PWD"/.git
 217     test ! -f "$gitdir" || while IFS=" :" read -r hdr gitdir; do [ "$hdr" != gitdir ] || break; done <"$gitdir"
 218     ln -fnsr \
 219      "$PWD"/.lib/git/hooks/prepare-commit-msg--longuest-common-prefix \
 220      "$gitdir"/hooks/prepare-commit-msg
 221
 222     # nixops
 223     #export NIXOPS_DEPLOYMENT="staging"
 224     export NIXOPS_STATE="$PWD"/../sec/nixops/state.nixops
 225     NIXOPS_OPTS+=" --show-trace"
 226     export NIXOPS_OPTS
 227
 228     # disnix
 229     #export DISNIXOS_USE_NIXOPS=1
 230     #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
 231     #export DISNIX_PROFILE=default
 232     #export DISNIX_TARGET_PROPERTY=hostname
 233     #export DYSNOMIA_STATEDIR="$PWD"/../sec/dysnomia
 234   '';
 235 }