shell.nix

   1 let
   2   nixpkgs_channel = builtins.getEnv "nixpkgs_channel";
   3   originNixpkgs = import (.config/nixpkgs-channel + ("/" + nixpkgs_channel + ".nix"));
   4   originPkgs = import originNixpkgs {
   5     config   = {}; # Make the config pure, ignoring user's config.
   6     overlays = [];
   7   };
   8   remoteNixpkgsPatches = [
   9     /*
  10     { meta.description = "nsd : use types.lines where appropriate";
  11       url = "https://github.com/NixOS/nixpkgs/pull/78968.diff";
  12       sha256 = "11bqq1g1ax6i7xghihyhklmqpsq3njalardp6nvzphkjgxrypb47";
  13     }
  14     { meta.description = "shorewall: init at 5.2.3.3";
  15       url = "https://github.com/NixOS/nixpkgs/pull/46131.diff";
  16       sha256 = "0mfzlcr23ni5spnwksmmls50sw10alqbr5j6hjrwp9i30z0419yx";
  17     }
  18     */
  19     { meta.description = "Dovecot plugin for Full Text Search (FTS) with Xapian";
  20       url = "https://github.com/NixOS/nixpkgs/pull/78780.diff";
  21       sha256 = "15ix8kwisjcgf4n7x7vlh223rb3206lcd5b13wbcvld07rzinjkc";
  22     }
  23     /* Disabled because it triggers the local build of too many reverse-dependencies
  24     { meta.description = "openldap: enable sha2 and pbkdf2 modules";
  25       url = "https://github.com/NixOS/nixpkgs/pull/79286.diff";
  26       sha256 = "0y255x74qksqy7fm4bdwlknhm3s55vgfgbv4dd7580p4lcavya0m";
  27     }
  28     */
  29     /*
  30     { meta.description = "Replace simp-le with lego and support DNS-01 challenge";
  31       url = "https://github.com/NixOS/nixpkgs/pull/77578.diff";
  32       sha256 = "15zs2146zh54jg1gywrcwyqxpx7izc35vlakk3cvrlqwwsvlr2rf";
  33     }
  34     */
  35     { meta.description = "dstat: fix pluginpath";
  36       url = "https://github.com/NixOS/nixpkgs/pull/80151.diff";
  37       sha256 = "0jjw2gvp7b7v2n2m2d6yj0gw711j6p9lyjf5ywp2y9ql6905qf4b";
  38     }
  39     /*
  40     { meta.description = "shorewall: fix warnings due to types.loaOf being deprecated";
  41       url = "https://github.com/NixOS/nixpkgs/pull/80154.diff";
  42       sha256 = "0b216m1rib3jl6s3r5cbkd5h1bfhppikg4cz9ayr1fspsflr3bci";
  43     }
  44     { meta.description = "shorewall: fix RestartTriggers";
  45       url = "https://github.com/NixOS/nixpkgs/pull/81774.diff";
  46       sha256 = "14drpym2mq9gq505psjzqq23gv0wkbwrrvh438h5jirzcym3467a";
  47     }
  48     */
  49     { meta.description = "syncoid: fix PATH to let it use sudo";
  50       url = "https://github.com/NixOS/nixpkgs/pull/83901.diff";
  51       sha256 = "0q2dicmvl3h3hb9xdd870n5hf6lac489p000c7f1r6k70sh2id4l";
  52     }
  53     { meta.description = "sanoid: fix sanoid.conf generation";
  54       url = "https://github.com/NixOS/nixpkgs/pull/83904.diff";
  55       sha256 = "1mipad5lwg60m1s4nz5inmp68v7ncyaddvs8hpa9lni775vlf2r0";
  56     }
  57   ];
  58   localNixpkgsPatches = [
  59     patches/direnv.diff
  60     #patches/sanoid.diff
  61   ];
  62   nixpkgs = originPkgs.applyPatches {
  63     name = "nixpkgs-patched";
  64     src = originNixpkgs;
  65     patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  66     postPatch = ''
  67       patch=$(printf '%s\n' ${builtins.concatStringsSep " "
  68          (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
  69         sort | sha256sum | cut -c -7)
  70       echo "+patch-$patch" >.version-suffix
  71     '';
  72   };
  73   pkgs = import nixpkgs {
  74     config = {}; # Make the config pure, ignoring user's config.
  75     overlays = import ./overlays.nix;
  76   };
  77
  78   lib = pkgs.lib;
  79   nixos = pkgs.nixos {};
  80   # Configuration of shell/modules/
  81   configuration = {config, ...}: {
  82     imports = [
  83     ];
  84     nix = {
  85       nixConf = ''
  86         auto-optimise-store = true
  87       '';
  88     };
  89     nix-plugins = {
  90       enable = true;
  91     };
  92     gnupg = {
  93       enable = true;
  94       gnupgHome = toString ../sec/gnupg;
  95       keys = import shell/openpgp.nix;
  96       gpgExtraConf = ''
  97         # julm@sourcephile.fr
  98         trusted-key 0xB2450D97085B7B8C
  99       '';
 100     };
 101     openssl = {
 102       enable = true;
 103       opensslHome = toString ../sec/openssl;
 104       certificates = import shell/x509.nix;
 105     };
 106     openssh = {
 107       # WARNING: nixops uses its own ssh, not this one.
 108       enable = true;
 109       sshConf = ''
 110         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
 111         Compression no
 112         #CompressionLevel 4
 113         ControlMaster auto
 114         ControlPath ${builtins.toString ../sec/ssh}/ssh-%h-%p-%r.socket
 115         HashKnownHosts no
 116         #SSAPIAuthentication no
 117         SendEnv LANG LC_*
 118         StrictHostKeyChecking yes
 119         UserKnownHostsFile ${builtins.toString ../sec/ssh/known_hosts}
 120       '';
 121     };
 122     virtualbox = {
 123       enable = true;
 124     };
 125   };
 126
 127   # Using modules enables to separate specific configurations
 128   # from reusable code in shell/modules.nix and shell/modules/
 129   # which may find its way in another git repository one day.
 130   modules =
 131     (import shell/modules.nix {
 132       inherit pkgs lib;
 133       modules = [ configuration ];
 134     }).config;
 135
 136   # Utility to query the Nix files like nixops show-option
 137   # but without requiring a nixops database, and not limited to config entries.
 138   pwd = toString (./. + "");
 139   sourcephile-nix-get = pkgs.writeShellScriptBin "sourcephile-nix-get" ''
 140     nix-instantiate --read-write-mode \
 141      --arg networkExprs "[${pwd}/servers.nix ${pwd}/servers/production.nix]" \
 142      --arg args '{}' --argstr "uuid" whatever \
 143      --argstr deploymentName production "<nixops/eval-machine-info.nix>" \
 144      --eval-only --strict --arg checkConfigurationOptions false -A "$@"
 145   '';
 146   sourcephile-shred-tmp = pkgs.writeShellScriptBin "sourcephile-shred-tmp" ''
 147     # Cleanup "../sec/tmp/"
 148     # This is done when entering the nix-shell
 149     # because direnv already hooks trap EXIT.
 150     cd "${pwd}"
 151     test ! -e sec/tmp || {
 152     find sec/tmp -type f -exec shred -fu {} +
 153     rm -rf sec/tmp
 154     }
 155   '';
 156 in
 157 pkgs.mkShell {
 158   name = "sourcephile-nix";
 159   src = null;
 160   #preferLocalBuild = true;
 161   #allowSubstitutes = false;
 162   buildInputs = modules.nix-shell.buildInputs ++ [
 163     sourcephile-nix-get
 164     sourcephile-shred-tmp
 165     nixos.nixos-generate-config
 166     nixos.nixos-install
 167     nixos.nixos-enter
 168     #pkgs.binutils
 169     pkgs.coreutils
 170     pkgs.cryptsetup
 171     pkgs.curl
 172     #pkgs.direnv
 173     pkgs.dnsutils
 174     #pkgs.dropbear
 175     pkgs.e2fsprogs
 176     pkgs.git
 177     pkgs.glibcLocales
 178     pkgs.gnumake
 179     pkgs.gnupg
 180     pkgs.htop
 181     #pkgs.inetutils
 182     pkgs.ipcalc
 183     #pkgs.iputils
 184     pkgs.less
 185     pkgs.libfaketime
 186     pkgs.ldns
 187     #pkgs.ldns.examples
 188     #pkgs.mailutils
 189     pkgs.man
 190     pkgs.mdadm
 191     pkgs.gptfdisk
 192     pkgs.ncdu
 193     pkgs.ncurses
 194     pkgs.nixops
 195     #pkgs.openssl
 196     pkgs.pass
 197     pkgs.procps
 198     pkgs.rsync
 199     #pkgs.rxvt_unicode.terminfo
 200     #pkgs.sqlite
 201     pkgs.sqlite
 202     #pkgs.sudo
 203     pkgs.tig
 204     pkgs.time
 205     #pkgs.tmux
 206     pkgs.tree
 207     pkgs.utillinux
 208     #pkgs.vim
 209     #pkgs.virtualbox
 210     pkgs.which
 211     pkgs.xdg_utils
 212     pkgs.zfs
 213     pkgs.fio
 214     pkgs.strace
 215     pkgs.utillinux
 216     #pkgs.zfstools
 217   ];
 218   #enableParallelBuilding = true;
 219   shellHook = ''
 220     echo >&2 "nix: running shellHook"
 221
 222     # Nix
 223     PATH=$NIX_SHELL_PATH:$PATH
 224     export NIX_PATH="nixpkgs=${toString pkgs.path}:nixpkgs-overlays="$PWD"/overlays:nixops=${toString pkgs.nixops}/share/nix/nixops"
 225
 226     # Since the .envrc calls this shellHook
 227     # the EXIT trap cannot be freely used
 228     # because it's already used by direnv,
 229     # hence shred at startup, which is not ideal.
 230     sourcephile-shred-tmp
 231
 232     ${modules.nix-shell.shellHook}
 233
 234     # password-store
 235     export PASSWORD_STORE_DIR="$PWD"/../sec/pass
 236
 237     # gpg
 238     export GPG_TTY=$(tty)
 239     gpg-connect-agent updatestartuptty /bye >/dev/null
 240
 241     # nixops
 242     #export NIXOPS_DEPLOYMENT="staging"
 243     export MERMET_DEPLOYMENT=production
 244     export LOSURDO_DEPLOYMENT=production
 245     export NIXOPS_STATE="$PWD"/../sec/nixops/state.nixops
 246     NIXOPS_OPTS+=" --show-trace"
 247     export NIXOPS_OPTS
 248
 249     # disnix
 250     #export DISNIXOS_USE_NIXOPS=1
 251     #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
 252     #export DISNIX_PROFILE=default
 253     #export DISNIX_TARGET_PROPERTY=hostname
 254     #export DYSNOMIA_STATEDIR="$PWD"/../sec/dysnomia
 255   '';
 256 }