]> Git — Sourcephile - sourcephile-nix.git/blob - shell.nix
nginx: fix error_log off no longer working and remove boring indent
[sourcephile-nix.git] / shell.nix
1 let
2 nixpkgs_channel = builtins.getEnv "nixpkgs_channel";
3 # Bootstraping Nixpkgs to get tools to patch it.
4 originNixpkgs = import (.config/nixpkgs-channel + ("/${nixpkgs_channel}.nix"));
5 originPkgs = import originNixpkgs {
6 config = {}; # Make the config pure, ignoring user's config.
7 overlays = [];
8 };
9 remoteNixpkgsPatches = [
10 { meta.description = "Dovecot plugin for Full Text Search (FTS) with Xapian";
11 url = "https://github.com/NixOS/nixpkgs/pull/78780.diff";
12 sha256 = "1h45qhbragp5ky6xix198qhadj1j7gd3qswa135mnmw1ijfczyry";
13 }
14 { meta.description = "dstat: fix pluginpath";
15 url = "https://github.com/NixOS/nixpkgs/pull/80151.diff";
16 sha256 = "0jjw2gvp7b7v2n2m2d6yj0gw711j6p9lyjf5ywp2y9ql6905qf4b";
17 }
18 { meta.description = "syncoid: fix PATH to let it use sudo";
19 url = "https://github.com/NixOS/nixpkgs/pull/83901.diff";
20 sha256 = "0q2dicmvl3h3hb9xdd870n5hf6lac489p000c7f1r6k70sh2id4l";
21 }
22 { meta.description = "sanoid: fix sanoid.conf generation";
23 url = "https://github.com/NixOS/nixpkgs/pull/83904.diff";
24 sha256 = "0lj4krmmbz82zpmbacw0qj2ywsx895bq4d1psjn753ymh7jjqj8k";
25 }
26 ];
27 localNixpkgsPatches = [
28 #patches/fts_xapian.diff
29 ];
30 # Build nixpkgs with some patches.
31 nixpkgs = originPkgs.applyPatches {
32 name = "nixpkgs-patched";
33 src = originNixpkgs;
34 patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
35 postPatch = ''
36 patch=$(printf '%s\n' ${builtins.concatStringsSep " "
37 (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
38 sort | sha256sum | cut -c -7)
39 echo "+patch-$patch" >.version-suffix
40 '';
41 };
42 # Final pkgs with custom overlays.
43 pkgs = import nixpkgs {
44 config = {}; # Make the config pure, ignoring user's config.
45 overlays = import ./overlays.nix;
46 };
47
48 lib = pkgs.lib;
49 nixos = pkgs.nixos {};
50 # Configuration of shell/modules/
51 # to expand shellHook and buildInputs of this shell.nix
52 configuration = {config, ...}: {
53 imports = [
54 ];
55 nix = {
56 nixConf = ''
57 auto-optimise-store = true
58 '';
59 };
60 nix-plugins = {
61 enable = true;
62 };
63 gnupg = {
64 enable = true;
65 gnupgHome = toString ../sec/gnupg;
66 keys = import shell/openpgp.nix;
67 gpgExtraConf = ''
68 # julm@sourcephile.fr
69 trusted-key 0xB2450D97085B7B8C
70 '';
71 };
72 openssl = {
73 enable = true;
74 opensslHome = toString ../sec/openssl;
75 certificates = import shell/x509.nix;
76 };
77 openssh = {
78 enable = true;
79 sshConf = ''
80 Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
81 Compression no
82 #CompressionLevel 4
83 ControlMaster auto
84 ControlPath ${toString ../sec/ssh}/ssh-%h-%p-%r.socket
85 HashKnownHosts no
86 #SSAPIAuthentication no
87 SendEnv LANG LC_*
88 StrictHostKeyChecking yes
89 UserKnownHostsFile ${toString ../sec/ssh/known_hosts}
90 '';
91 };
92 virtualbox = {
93 enable = false;
94 };
95 };
96
97 # Using modules enables to separate specific configurations
98 # from reusable code in shell/modules.nix and shell/modules/
99 # which may find its way in another git repository one day.
100 modules =
101 (import shell/modules.nix {
102 inherit pkgs lib;
103 modules = [ configuration ];
104 }).config;
105
106 pwd = toString (./. + "");
107 sourcephile-shred-tmp = pkgs.writeShellScriptBin "sourcephile-shred-tmp" ''
108 # This is done when entering the nix-shell
109 # because direnv already hooks trap EXIT.
110 cd "${pwd}"
111 test ! -e sec/tmp || {
112 find sec/tmp -type f -exec shred -fu {} +
113 rm -rf sec/tmp
114 }
115 '';
116 in
117 pkgs.mkShell {
118 name = "sourcephile-nix";
119 src = null;
120 #preferLocalBuild = true;
121 #allowSubstitutes = false;
122 buildInputs = modules.nix-shell.buildInputs ++ [
123 sourcephile-shred-tmp
124 nixos.nixos-generate-config
125 nixos.nixos-install
126 nixos.nixos-enter
127 #pkgs.binutils
128 pkgs.coreutils
129 pkgs.cryptsetup
130 pkgs.curl
131 #pkgs.direnv
132 pkgs.dnsutils
133 #pkgs.dropbear
134 pkgs.e2fsprogs
135 pkgs.git
136 pkgs.glibcLocales
137 pkgs.gnumake
138 pkgs.gnupg
139 pkgs.htop
140 #pkgs.inetutils
141 pkgs.ipcalc
142 #pkgs.iputils
143 pkgs.less
144 pkgs.libfaketime
145 pkgs.ldns
146 #pkgs.ldns.examples
147 #pkgs.mailutils
148 pkgs.man
149 pkgs.mdadm
150 pkgs.gptfdisk
151 pkgs.ncdu
152 pkgs.ncurses
153 #pkgs.nixops
154 #pkgs.openssl
155 pkgs.pass
156 pkgs.procps
157 pkgs.rsync
158 #pkgs.rxvt_unicode.terminfo
159 #pkgs.sqlite
160 pkgs.sqlite
161 #pkgs.sudo
162 pkgs.tig
163 pkgs.time
164 #pkgs.tmux
165 pkgs.tree
166 pkgs.utillinux
167 #pkgs.vim
168 #pkgs.virtualbox
169 pkgs.which
170 pkgs.xdg_utils
171 pkgs.zfs
172 pkgs.fio
173 pkgs.strace
174 pkgs.utillinux
175 #pkgs.zfstools
176 ];
177 #enableParallelBuilding = true;
178 shellHook = ''
179 echo >&2 "nix: running shellHook"
180
181 # Nix
182 PATH=$NIX_SHELL_PATH:$PATH
183 export NIX_PATH="nixpkgs=${toString pkgs.path}:nixpkgs-overlays="$PWD"/overlays.nix"
184
185 # Since the .envrc calls this shellHook
186 # the EXIT trap cannot be freely used
187 # because it's already used by direnv,
188 # hence shred at startup, which is not ideal.
189 sourcephile-shred-tmp
190
191 ${modules.nix-shell.shellHook}
192
193 # password-store
194 export PASSWORD_STORE_DIR="$PWD"/../sec/pass
195
196 # gpg
197 export GPG_TTY=$(tty)
198 gpg-connect-agent updatestartuptty /bye >/dev/null
199 '';
200 }