shell.nix

   1 let
   2   nixpkgs_channel = builtins.getEnv "nixpkgs_channel";
   3   # Bootstraping Nixpkgs to get tools to patch it.
   4   originNixpkgs = import (.config/nixpkgs-channel + ("/${nixpkgs_channel}.nix"));
   5   originPkgs = import originNixpkgs {
   6     config = {}; # Make the config pure, ignoring user's config.
   7     overlays = [];
   8   };
   9   remoteNixpkgsPatches = [
  10     { meta.description = "Dovecot plugin for Full Text Search (FTS) with Xapian";
  11       url = "https://github.com/NixOS/nixpkgs/pull/78780.diff";
  12       sha256 = "1h45qhbragp5ky6xix198qhadj1j7gd3qswa135mnmw1ijfczyry";
  13     }
  14     { meta.description = "dstat: fix pluginpath";
  15       url = "https://github.com/NixOS/nixpkgs/pull/80151.diff";
  16       sha256 = "0jjw2gvp7b7v2n2m2d6yj0gw711j6p9lyjf5ywp2y9ql6905qf4b";
  17     }
  18     { meta.description = "syncoid: fix PATH to let it use sudo";
  19       url = "https://github.com/NixOS/nixpkgs/pull/83901.diff";
  20       sha256 = "0q2dicmvl3h3hb9xdd870n5hf6lac489p000c7f1r6k70sh2id4l";
  21     }
  22     { meta.description = "sanoid: fix sanoid.conf generation";
  23       url = "https://github.com/NixOS/nixpkgs/pull/83904.diff";
  24       sha256 = "0lj4krmmbz82zpmbacw0qj2ywsx895bq4d1psjn753ymh7jjqj8k";
  25     }
  26     { meta.description = "nixos/public-inbox: init";
  27       url = "https://github.com/NixOS/nixpkgs/pull/77450.diff";
  28       sha256 = "13ikg7chpbf6rrg5sngbdb95q3awhdgl4g8vci42xmqyf208hzzd";
  29     }
  30   ];
  31   localNixpkgsPatches = [
  32     #patches/fts_xapian.diff
  33   ];
  34   # Build nixpkgs with some patches.
  35   nixpkgs = originPkgs.applyPatches {
  36     name = "nixpkgs-patched";
  37     src = originNixpkgs;
  38     patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  39     postPatch = ''
  40       patch=$(printf '%s\n' ${builtins.concatStringsSep " "
  41          (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
  42         sort | sha256sum | cut -c -7)
  43       echo "+patch-$patch" >.version-suffix
  44     '';
  45   };
  46   # Final pkgs with custom overlays.
  47   pkgs = import nixpkgs {
  48     config = {}; # Make the config pure, ignoring user's config.
  49     overlays = import ./overlays.nix;
  50   };
  51
  52   lib = pkgs.lib;
  53   nixos = pkgs.nixos {};
  54   # Configuration of shell/modules/
  55   # to expand shellHook and buildInputs of this shell.nix
  56   configuration = {config, ...}: {
  57     imports = [
  58     ];
  59     nix = {
  60       nixConf = ''
  61         auto-optimise-store = true
  62       '';
  63     };
  64     nix-plugins = {
  65       enable = true;
  66     };
  67     gnupg = {
  68       enable = true;
  69       gnupgHome = toString ../sec/gnupg;
  70       keys = import shell/openpgp.nix;
  71       gpgExtraConf = ''
  72         # julm@sourcephile.fr
  73         trusted-key 0xB2450D97085B7B8C
  74       '';
  75     };
  76     openssl = {
  77       enable = true;
  78       opensslHome = toString ../sec/openssl;
  79       certificates = import shell/x509.nix;
  80     };
  81     openssh = {
  82       enable = true;
  83       sshConf = ''
  84         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
  85         Compression no
  86         #CompressionLevel 4
  87         ControlMaster auto
  88         ControlPath ${toString ../sec/ssh}/ssh-%h-%p-%r.socket
  89         HashKnownHosts no
  90         #SSAPIAuthentication no
  91         SendEnv LANG LC_*
  92         StrictHostKeyChecking yes
  93         UserKnownHostsFile ${toString ../sec/ssh/known_hosts}
  94       '';
  95     };
  96     virtualbox = {
  97       enable = false;
  98     };
  99   };
 100
 101   # Using modules enables to separate specific configurations
 102   # from reusable code in shell/modules.nix and shell/modules/
 103   # which may find its way in another git repository one day.
 104   modules =
 105     (import shell/modules.nix {
 106       inherit pkgs lib;
 107       modules = [ configuration ];
 108     }).config;
 109
 110   pwd = toString (./. + "");
 111   sourcephile-shred-tmp = pkgs.writeShellScriptBin "sourcephile-shred-tmp" ''
 112     # This is done when entering the nix-shell
 113     # because direnv already hooks trap EXIT.
 114     cd "${pwd}"
 115     test ! -e sec/tmp || {
 116     find sec/tmp -type f -exec shred -fu {} +
 117     rm -rf sec/tmp
 118     }
 119   '';
 120 in
 121 pkgs.mkShell {
 122   name = "sourcephile-nix";
 123   src = null;
 124   #preferLocalBuild = true;
 125   #allowSubstitutes = false;
 126   buildInputs = modules.nix-shell.buildInputs ++ [
 127     sourcephile-shred-tmp
 128     nixos.nixos-generate-config
 129     nixos.nixos-install
 130     nixos.nixos-enter
 131     #pkgs.binutils
 132     pkgs.coreutils
 133     pkgs.cryptsetup
 134     pkgs.curl
 135     #pkgs.direnv
 136     pkgs.dnsutils
 137     #pkgs.dropbear
 138     pkgs.e2fsprogs
 139     pkgs.git
 140     pkgs.glibcLocales
 141     pkgs.gnumake
 142     pkgs.gnupg
 143     pkgs.htop
 144     #pkgs.inetutils
 145     pkgs.ipcalc
 146     #pkgs.iputils
 147     pkgs.less
 148     pkgs.libfaketime
 149     pkgs.ldns
 150     #pkgs.ldns.examples
 151     #pkgs.mailutils
 152     pkgs.man
 153     pkgs.mdadm
 154     pkgs.gptfdisk
 155     pkgs.ncdu
 156     pkgs.ncurses
 157     #pkgs.nixops
 158     #pkgs.openssl
 159     pkgs.pass
 160     pkgs.procps
 161     pkgs.rsync
 162     #pkgs.rxvt_unicode.terminfo
 163     #pkgs.sqlite
 164     pkgs.sqlite
 165     #pkgs.sudo
 166     pkgs.tig
 167     pkgs.time
 168     #pkgs.tmux
 169     pkgs.tree
 170     pkgs.utillinux
 171     #pkgs.vim
 172     #pkgs.virtualbox
 173     pkgs.which
 174     pkgs.xdg_utils
 175     pkgs.zfs
 176     pkgs.fio
 177     pkgs.strace
 178     pkgs.utillinux
 179     #pkgs.zfstools
 180   ];
 181   #enableParallelBuilding = true;
 182   shellHook = ''
 183     echo >&2 "nix: running shellHook"
 184
 185     # Nix
 186     PATH=$NIX_SHELL_PATH:$PATH
 187     export NIX_PATH="nixpkgs=${toString pkgs.path}:nixpkgs-overlays="$PWD"/overlays.nix"
 188
 189     # Since the .envrc calls this shellHook
 190     # the EXIT trap cannot be freely used
 191     # because it's already used by direnv,
 192     # hence shred at startup, which is not ideal.
 193     sourcephile-shred-tmp
 194
 195     ${modules.nix-shell.shellHook}
 196
 197     # password-store
 198     export PASSWORD_STORE_DIR="$PWD"/../sec/pass
 199
 200     # gpg
 201     export GPG_TTY=$(tty)
 202     gpg-connect-agent updatestartuptty /bye >/dev/null
 203   '';
 204 }