2 nixpkgs_channel = builtins.getEnv "nixpkgs_channel";
3 # Bootstraping Nixpkgs to get tools to patch it.
4 originNixpkgs = import (.config/nixpkgs-channel + ("/${nixpkgs_channel}.nix"));
5 originPkgs = import originNixpkgs {
6 config = {}; # Make the config pure, ignoring user's config.
9 remoteNixpkgsPatches = [
10 { meta.description = "dstat: fix pluginpath";
11 url = "https://github.com/NixOS/nixpkgs/pull/80151.diff";
12 sha256 = "0jjw2gvp7b7v2n2m2d6yj0gw711j6p9lyjf5ywp2y9ql6905qf4b";
14 { meta.description = "syncoid: fix PATH to let it use sudo";
15 url = "https://github.com/NixOS/nixpkgs/pull/83901.diff";
16 sha256 = "0q2dicmvl3h3hb9xdd870n5hf6lac489p000c7f1r6k70sh2id4l";
18 { meta.description = "sanoid: fix sanoid.conf generation";
19 url = "https://github.com/NixOS/nixpkgs/pull/83904.diff";
20 sha256 = "0lj4krmmbz82zpmbacw0qj2ywsx895bq4d1psjn753ymh7jjqj8k";
22 { meta.description = "nixos/public-inbox: init";
23 url = "https://github.com/NixOS/nixpkgs/pull/77450.diff";
24 sha256 = "13ikg7chpbf6rrg5sngbdb95q3awhdgl4g8vci42xmqyf208hzzd";
26 { meta.description = "transmission: apply RFC0042 and harden the service";
27 url = "https://github.com/NixOS/nixpkgs/pull/92106.diff";
28 sha256 = "0d3dd511h7fw0k5q0k6wp7hcwkk7xikfwracp68f1y7hn4jj0pn0";
30 { meta.description = "apparmor: fix and improve the service";
31 url = "https://github.com/NixOS/nixpkgs/pull/93457.diff";
32 sha256 = "1yhs0459r7mxdzl70l67yzbj6i67ps2znaca852hd1gffi650bkr";
34 { meta.description = "nixos/security.gnupg: provisioning GnuPG-protected secrets through the Nix store";
35 url = "https://github.com/NixOS/nixpkgs/pull/93659.diff";
36 sha256 = "08pmka7ryz2gbyc8by40p31ky7s3dqxlj90dnw7fmlgb4pb3pkn0";
38 { meta.description = "nixos/croc: init";
39 url = "https://github.com/NixOS/nixpkgs/pull/93629.diff";
40 sha256 = "0fv3lpj244hvxyixxv4akrr70jv5wwbhb3kmbmd2yskx59a71rch";
42 { meta.description = "prosody-modules: update to revision 2dcbc01c9931";
43 url = "https://github.com/NixOS/nixpkgs/pull/94916.diff";
44 sha256 = "1cpdv5bd3837qh54yd0n6vvbfpn0p0cshkic5q0lv60lmm9raqk4";
46 { meta.description = "nixos/biboumi: init";
47 url = "https://github.com/NixOS/nixpkgs/pull/94917.diff";
48 sha256 = "19rizzxiszszsr1xz1ax0rsagx14ka0ndllb0s9y1fvdjxhb87iz";
51 localNixpkgsPatches = [
52 nixpkgs/patches/installer.ssh-nixos.diff
53 nixpkgs/patches/fix-flushBeforeStage2.diff
55 # Build nixpkgs with some patches.
56 nixpkgs = originPkgs.applyPatches {
57 name = "nixpkgs-patched";
59 patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
61 patch=$(printf '%s\n' ${builtins.concatStringsSep " "
62 (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
63 sort | sha256sum | cut -c -7)
64 echo "+patch-$patch" >.version-suffix
67 # Final pkgs with custom overlays.
68 pkgs = import nixpkgs {
69 config = {}; # Make the config pure, ignoring user's config.
70 overlays = import nixpkgs/overlays.nix;
73 # Configuration of shell/modules/
74 # to expand shellHook and buildInputs of this shell.nix
75 shellConfig = {config, ...}: {
81 auto-optimise-store = true
89 gnupgHome = toString ../sec/gnupg;
92 trusted-key 0xB2450D97085B7B8C
94 gpgAgentExtraConf = ''
95 #pretend-request-origin remote
96 #extra-socket ${toString ./.}/S.gpg-agent.extra
97 #log-file ${toString ./.}/gpg-agent.log
100 #allow-loopback-pinentry
105 opensslHome = toString ../sec/openssl;
106 certificates = import shell/x509.nix;
111 Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
115 ControlPath ${toString ../sec/ssh}/ssh-%h-%p-%r.socket
117 #SSAPIAuthentication no
119 StrictHostKeyChecking yes
120 UserKnownHostsFile ${toString ../sec/ssh/known_hosts}
128 # Using modules enables to separate specific configurations
129 # from reusable code in shell/modules.nix and shell/modules/
130 # which may find its way in another git repository one day.
131 shell = (pkgs.lib.evalModules {
132 modules = [ shellConfig ] ++ map import (pkgs.lib.findFiles ".*\\.nix" shell/modules);
133 args = { inherit pkgs; };
136 pwd = toString (./. + "");
137 sourcephile-shred-tmp = pkgs.writeShellScriptBin "sourcephile-shred-tmp" ''
138 # This is done when entering the nix-shell
139 # because direnv already hooks trap EXIT.
141 test ! -e sec/tmp || {
142 find sec/tmp -type f -exec shred -fu {} +
148 name = "sourcephile-nix";
150 #preferLocalBuild = true;
151 #allowSubstitutes = false;
152 buildInputs = shell.nix-shell.buildInputs ++ [
153 sourcephile-shred-tmp
154 (pkgs.nixos []).nixos-generate-config
155 (pkgs.nixos []).nixos-install
156 (pkgs.nixos []).nixos-enter
188 #pkgs.rxvt_unicode.terminfo
206 pkgs.linuxPackages.perf
211 #enableParallelBuilding = true;
213 echo >&2 "nix: running shellHook"
216 export PASSWORD_STORE_DIR="$PWD"/../sec/pass
219 PATH=$NIX_SHELL_PATH:$PATH
220 export NIX_PATH="${pkgs.lib.concatStringsSep ":" [
221 "machines=$PWD/machines.nix"
222 #"pass=$PASSWORD_STORE_DIR"
223 "nixpkgs=${toString pkgs.path}"
224 "nixpkgs-overlays=$PWD/nixpkgs/overlays.nix"
227 # Since the .envrc calls this shellHook
228 # the EXIT trap cannot be freely used
229 # because it's already used by direnv,
230 # hence shred at startup, which is not ideal.
231 sourcephile-shred-tmp
233 ${shell.nix-shell.shellHook}
236 export GPG_TTY=$(tty)
237 gpg-connect-agent updatestartuptty /bye >/dev/null