shell.nix

   1 let
   2   originNixpkgs = import (.config/nixpkgs-channel + ("/" + builtins.getEnv "nixpkgs_channel" + ".nix"));
   3   originPkgs = import originNixpkgs {
   4     config   = {}; # Make the config pure, ignoring user's config.
   5     overlays = [];
   6   };
   7   nixpkgsPatches = [
   8     /*
   9     { meta.description = "nsd : use types.lines where appropriate";
  10       url = "https://github.com/NixOS/nixpkgs/pull/78968.diff";
  11       sha256 = "11bqq1g1ax6i7xghihyhklmqpsq3njalardp6nvzphkjgxrypb47";
  12     }
  13     { meta.description = "shorewall: init at 5.2.3.3";
  14       url = "https://github.com/NixOS/nixpkgs/pull/46131.diff";
  15       sha256 = "0mfzlcr23ni5spnwksmmls50sw10alqbr5j6hjrwp9i30z0419yx";
  16     }
  17     */
  18     { meta.description = "Dovecot plugin for Full Text Search (FTS) with Xapian";
  19       url = "https://github.com/NixOS/nixpkgs/pull/78780.diff";
  20       sha256 = "053md69ryybj27cp0xdfrza48zyzpblk6wvb2m2dbs9hm0gmcwc4";
  21     }
  22     /* Disabled because it triggers the local build of too many reverse-dependencies
  23     { meta.description = "openldap: enable sha2 and pbkdf2 modules";
  24       url = "https://github.com/NixOS/nixpkgs/pull/79286.diff";
  25       sha256 = "0y255x74qksqy7fm4bdwlknhm3s55vgfgbv4dd7580p4lcavya0m";
  26     }
  27     */
  28     { meta.description = "Replace simp-le with lego and support DNS-01 challenge";
  29       url = "https://github.com/NixOS/nixpkgs/pull/77578.diff";
  30       sha256 = "15zs2146zh54jg1gywrcwyqxpx7izc35vlakk3cvrlqwwsvlr2rf";
  31     }
  32   ];
  33   localNixpkgsPatches = [
  34   ];
  35   nixpkgs = originPkgs.stdenv.mkDerivation {
  36     name = "nixpkgs-patched";
  37     src = originNixpkgs;
  38     phases = [ "unpackPhase" "patchPhase" ];
  39     patches = map originPkgs.fetchpatch nixpkgsPatches ++ localNixpkgsPatches;
  40     postPatch = ''
  41       patch=$(printf '%s\n' ${builtins.concatStringsSep " " (map (p: p.sha256) nixpkgsPatches)} |
  42         sort | sha256sum | cut -c -7)
  43       mv $PWD $out
  44       echo "+patch-$patch" >$out/.version-suffix
  45     '';
  46   };
  47   pkgs = import nixpkgs {
  48     config = {}; # Make the config pure, ignoring user's config.
  49     overlays = import ./overlays.nix;
  50   };
  51
  52
  53   lib = pkgs.lib;
  54   nixos = pkgs.nixos {};
  55   # Configuration of shell/modules/
  56   configuration = {config, ...}: {
  57     imports = [
  58     ];
  59     nix = {
  60       nixConf = ''
  61         auto-optimise-store = true
  62       '';
  63     };
  64     nix-plugins = {
  65       enable = true;
  66     };
  67     gnupg = {
  68       enable = true;
  69       gnupgHome = toString ../sec/gnupg;
  70       keys = import shell/openpgp.nix;
  71       gpgExtraConf = ''
  72         trusted-key 0xB2450D97085B7B8C
  73       '';
  74     };
  75     openssl = {
  76       enable = true;
  77       opensslHome = toString ../sec/openssl;
  78       certificates = import shell/x509.nix;
  79     };
  80     openssh = {
  81       # WARNING: nixops uses its own ssh, not this one.
  82       enable = true;
  83       sshConf = ''
  84         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
  85         Compression no
  86         #CompressionLevel 4
  87         ControlMaster auto
  88         ControlPath ${builtins.toString ../sec/ssh}/ssh-%h-%p-%r.socket
  89         HashKnownHosts no
  90         #SSAPIAuthentication no
  91         SendEnv LANG LC_*
  92         StrictHostKeyChecking yes
  93         UserKnownHostsFile ${builtins.toString ../sec/ssh/known_hosts}
  94       '';
  95     };
  96     virtualbox = {
  97       enable = true;
  98     };
  99   };
 100
 101   # Using modules enables to separate specific configurations
 102   # from reusable code in shell/modules.nix and shell/modules/
 103   # which may find its way in another git repository one day.
 104   modules =
 105     (import shell/modules.nix {
 106       inherit pkgs lib;
 107       modules = [ configuration ];
 108     }).config;
 109 in
 110 pkgs.mkShell {
 111   name = "sourcephile-nix";
 112   src = null;
 113   #preferLocalBuild = true;
 114   #allowSubstitutes = false;
 115   buildInputs = modules.nix-shell.buildInputs ++ [
 116     nixpkgs
 117     nixos.nixos-generate-config
 118     nixos.nixos-install
 119     nixos.nixos-enter
 120     #pkgs.binutils
 121     pkgs.coreutils
 122     pkgs.cryptsetup
 123     pkgs.curl
 124     #pkgs.direnv
 125     pkgs.dnsutils
 126     #pkgs.dropbear
 127     pkgs.e2fsprogs
 128     pkgs.git
 129     pkgs.glibcLocales
 130     pkgs.gnumake
 131     pkgs.gnupg
 132     pkgs.htop
 133     #pkgs.inetutils
 134     pkgs.ipcalc
 135     #pkgs.iputils
 136     pkgs.less
 137     pkgs.libfaketime
 138     pkgs.ldns
 139     #pkgs.ldns.examples
 140     #pkgs.mailutils
 141     pkgs.man
 142     pkgs.mdadm
 143     pkgs.gptfdisk
 144     pkgs.ncdu
 145     pkgs.ncurses
 146     pkgs.nixops
 147     #pkgs.openssl
 148     pkgs.pass
 149     pkgs.procps
 150     pkgs.rsync
 151     #pkgs.rxvt_unicode.terminfo
 152     #pkgs.sqlite
 153     pkgs.sqlite
 154     #pkgs.sudo
 155     pkgs.tig
 156     pkgs.time
 157     #pkgs.tmux
 158     pkgs.tree
 159     pkgs.utillinux
 160     #pkgs.vim
 161     #pkgs.virtualbox
 162     pkgs.which
 163     pkgs.xdg_utils
 164     pkgs.zfs
 165     pkgs.fio
 166     pkgs.strace
 167     pkgs.utillinux
 168     #pkgs.zfstools
 169   ];
 170   #enableParallelBuilding = true;
 171   shellHook = ''
 172     echo >&2 "nix: running shellHook"
 173     # WARNING: beware that sudo may reset the environment,
 174     # and especially PATH, to some system's default.
 175
 176     NIX_SHELL_PATH=$PATH
 177     unset __ETC_PROFILE_SOURCED
 178     unset __NIXOS_SET_ENVIRONMENT_DONE
 179     test ! -e /etc/profile || . /etc/profile
 180     test ! -e ~/.profile || . ~/.profile
 181
 182     # nix
 183     test ! -e ~/.nix-profile/etc/profile.d/nix.sh ||
 184     . ~/.nix-profile/etc/profile.d/nix.sh
 185
 186     # home-manager
 187     unset __HM_SESS_VARS_SOURCED
 188     test ! -e ~/.nix-profile/etc/profile.d/hm-session-vars.sh ||
 189     . ~/.nix-profile/etc/profile.d/hm-session-vars.sh
 190
 191     PATH=$NIX_SHELL_PATH:$PATH
 192     export NIX_PATH="nixpkgs=${pkgs.path}:nixpkgs-overlays="$PWD"/overlays"
 193
 194     # Cleanup "../sec/tmp/"
 195     # This is done when exiting the nix-shell
 196     # (or when… entering the directory with direnv
 197     # which spawns a nix-shell just to get the env).
 198     trap "cd '$PWD' && find ../sec/tmp -type f -exec shred -fu {} +" EXIT
 199
 200     ${modules.nix-shell.shellHook}
 201
 202     # locales
 203     export LANG=fr_FR.UTF-8
 204     export LC_CTYPE=fr_FR.UTF-8
 205
 206     # password-store
 207     export PASSWORD_STORE_DIR="$PWD"/../sec/pass
 208
 209     # gpg
 210     export GPG_TTY=$(tty)
 211     gpg-connect-agent updatestartuptty /bye >/dev/null
 212
 213     # git
 214     gitdir="$PWD"/.git
 215     test ! -f "$gitdir" || while IFS=" :" read -r hdr gitdir; do [ "$hdr" != gitdir ] || break; done <"$gitdir"
 216     ln -fnsr \
 217      "$PWD"/.lib/git/hooks/prepare-commit-msg--longuest-common-prefix \
 218      "$gitdir"/hooks/prepare-commit-msg
 219
 220     # nixops
 221     #export NIXOPS_DEPLOYMENT="staging"
 222     export NIXOPS_STATE="$PWD"/../sec/nixops/state.nixops
 223     NIXOPS_OPTS+=" --show-trace"
 224     export NIXOPS_OPTS
 225
 226     # disnix
 227     #export DISNIXOS_USE_NIXOPS=1
 228     #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
 229     #export DISNIX_PROFILE=default
 230     #export DISNIX_TARGET_PROPERTY=hostname
 231     #export DYSNOMIA_STATEDIR="$PWD"/../sec/dysnomia
 232   '';
 233 }