2 nixpkgs_channel = builtins.getEnv "nixpkgs_channel";
3 # Bootstraping Nixpkgs to get tools to patch it.
4 originNixpkgs = import (.config/nixpkgs-channel + ("/${nixpkgs_channel}.nix"));
5 originPkgs = import originNixpkgs {
6 config = {}; # Make the config pure, ignoring user's config.
9 remoteNixpkgsPatches = [
10 { meta.description = "dstat: fix pluginpath";
11 url = "https://github.com/NixOS/nixpkgs/pull/80151.diff";
12 sha256 = "0jjw2gvp7b7v2n2m2d6yj0gw711j6p9lyjf5ywp2y9ql6905qf4b";
14 { meta.description = "syncoid: fix PATH to let it use sudo";
15 url = "https://github.com/NixOS/nixpkgs/pull/83901.diff";
16 sha256 = "0q2dicmvl3h3hb9xdd870n5hf6lac489p000c7f1r6k70sh2id4l";
18 { meta.description = "sanoid: fix sanoid.conf generation";
19 url = "https://github.com/NixOS/nixpkgs/pull/83904.diff";
20 sha256 = "0lj4krmmbz82zpmbacw0qj2ywsx895bq4d1psjn753ymh7jjqj8k";
22 { meta.description = "nixos/public-inbox: init";
23 url = "https://github.com/NixOS/nixpkgs/pull/77450.diff";
24 sha256 = "13ikg7chpbf6rrg5sngbdb95q3awhdgl4g8vci42xmqyf208hzzd";
27 { meta.description = "transmission: apply RFC0042 and harden the service";
28 url = "https://github.com/NixOS/nixpkgs/pull/92106.diff";
29 sha256 = "0h1105qy0wrirvi9fk5d00qsjvm745196vb7wgr648d56rm17vv1";
31 { meta.description = "apparmor: fix and improve the service";
32 url = "https://github.com/NixOS/nixpkgs/pull/93457.diff";
33 sha256 = "0y1kvsnm8xiplbm4w4cadmfkr452vipswkz3kwyyikknh06vj3mn";
37 localNixpkgsPatches = [
38 #/home/julm/src/nix/nixpkgs/wip.patch
39 nixpkgs/patches/transmission+apparmor.diff
40 nixpkgs/patches/installer.ssh-nixos.diff
41 nixpkgs/patches/security.pass.diff
43 # Build nixpkgs with some patches.
44 nixpkgs = originPkgs.applyPatches {
45 name = "nixpkgs-patched";
47 patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
49 patch=$(printf '%s\n' ${builtins.concatStringsSep " "
50 (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
51 sort | sha256sum | cut -c -7)
52 echo "+patch-$patch" >.version-suffix
55 # Final pkgs with custom overlays.
56 pkgs = import nixpkgs {
57 config = {}; # Make the config pure, ignoring user's config.
58 overlays = import nixpkgs/overlays.nix;
62 nixos = pkgs.nixos {};
63 # Configuration of shell/modules/
64 # to expand shellHook and buildInputs of this shell.nix
65 configuration = {config, ...}: {
71 auto-optimise-store = true
79 gnupgHome = toString ../sec/gnupg;
82 trusted-key 0xB2450D97085B7B8C
87 opensslHome = toString ../sec/openssl;
88 certificates = import shell/x509.nix;
93 Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
97 ControlPath ${toString ../sec/ssh}/ssh-%h-%p-%r.socket
99 #SSAPIAuthentication no
101 StrictHostKeyChecking yes
102 UserKnownHostsFile ${toString ../sec/ssh/known_hosts}
110 # Using modules enables to separate specific configurations
111 # from reusable code in shell/modules.nix and shell/modules/
112 # which may find its way in another git repository one day.
114 (import shell/modules.nix {
116 modules = [ configuration ];
119 pwd = toString (./. + "");
120 sourcephile-shred-tmp = pkgs.writeShellScriptBin "sourcephile-shred-tmp" ''
121 # This is done when entering the nix-shell
122 # because direnv already hooks trap EXIT.
124 test ! -e sec/tmp || {
125 find sec/tmp -type f -exec shred -fu {} +
131 name = "sourcephile-nix";
133 #preferLocalBuild = true;
134 #allowSubstitutes = false;
135 buildInputs = modules.nix-shell.buildInputs ++ [
136 sourcephile-shred-tmp
137 nixos.nixos-generate-config
171 #pkgs.rxvt_unicode.terminfo
190 #enableParallelBuilding = true;
192 echo >&2 "nix: running shellHook"
195 export PASSWORD_STORE_DIR="$PWD"/../sec/pass
198 PATH=$NIX_SHELL_PATH:$PATH
199 export NIX_PATH="${lib.concatStringsSep ":" [
200 "machines=$PWD/machines.nix"
201 #"pass=$PASSWORD_STORE_DIR"
202 "nixpkgs=${toString pkgs.path}"
203 "nixpkgs-overlays=$PWD/nixpkgs/overlays.nix"
206 # Since the .envrc calls this shellHook
207 # the EXIT trap cannot be freely used
208 # because it's already used by direnv,
209 # hence shred at startup, which is not ideal.
210 sourcephile-shred-tmp
212 ${modules.nix-shell.shellHook}
215 export GPG_TTY=$(tty)
216 gpg-connect-agent updatestartuptty /bye >/dev/null