shell.nix

   1 let
   2   originNixpkgs = import .config/nixpkgs-channel/nixos-19.09-small.nix;
   3   originPkgs = import originNixpkgs {
   4     config   = {}; # Make the config pure, ignoring user's config.
   5     overlays = [];
   6   };
   7   nixpkgsPatches = [
   8     { meta.description = "nsd : use types.lines where appropriate";
   9       url = "https://github.com/NixOS/nixpkgs/pull/78968.diff";
  10       sha256 = "11bqq1g1ax6i7xghihyhklmqpsq3njalardp6nvzphkjgxrypb47";
  11     }
  12     { meta.description = "shorewall: init at 5.2.3.3";
  13       url = "https://github.com/NixOS/nixpkgs/pull/46131.diff";
  14       sha256 = "0mfzlcr23ni5spnwksmmls50sw10alqbr5j6hjrwp9i30z0419yx";
  15     }
  16     { meta.description = "Dovecot plugin for Full Text Search (FTS) with Xapian";
  17       url = "https://github.com/NixOS/nixpkgs/pull/78780.diff";
  18       sha256 = "053md69ryybj27cp0xdfrza48zyzpblk6wvb2m2dbs9hm0gmcwc4";
  19     }
  20     { meta.description = "openldap: enable sha2 and pbkdf2 modules";
  21       url = "https://github.com/NixOS/nixpkgs/pull/79286.diff";
  22       sha256 = "0y255x74qksqy7fm4bdwlknhm3s55vgfgbv4dd7580p4lcavya0m";
  23     }
  24   ];
  25   nixpkgs = originPkgs.stdenv.mkDerivation {
  26     name = "nixpkgs-patched";
  27     src = originNixpkgs;
  28     phases = [ "unpackPhase" "patchPhase" ];
  29     patches = map originPkgs.fetchpatch nixpkgsPatches;
  30     postPatch = ''
  31       patch=$(printf '%s\n' ${builtins.concatStringsSep " " (map (p: p.sha256) nixpkgsPatches)} |
  32         sort | sha256sum | cut -c -7)
  33       mv $PWD $out
  34       echo "+patch-$patch" >$out/.version-suffix
  35     '';
  36   };
  37   pkgs = import nixpkgs {
  38     config = {}; # Make the config pure, ignoring user's config.
  39     overlays = import ./overlays.nix;
  40   };
  41
  42
  43   lib = pkgs.lib;
  44   nixos = pkgs.nixos {};
  45   # Configuration of shell/modules/
  46   configuration = {config, ...}: {
  47     imports = [
  48     ];
  49     nix = {
  50       nixConf = ''
  51         auto-optimise-store = true
  52       '';
  53     };
  54     nix-plugins = {
  55       enable = true;
  56     };
  57     gnupg = {
  58       enable = true;
  59       gnupgHome = toString ../sec/gnupg;
  60       keys = import shell/openpgp.nix;
  61       gpgExtraConf = ''
  62         trusted-key 0xB2450D97085B7B8C
  63       '';
  64     };
  65     openssl = {
  66       enable = true;
  67       opensslHome = toString ../sec/openssl;
  68       certificates = import shell/x509.nix;
  69     };
  70     openssh = {
  71       # WARNING: nixops uses its own ssh, not this one.
  72       enable = true;
  73       sshConf = ''
  74         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
  75         Compression no
  76         #CompressionLevel 4
  77         ControlMaster auto
  78         ControlPath ${builtins.toString ../sec/ssh}/ssh-%h-%p-%r.socket
  79         HashKnownHosts no
  80         #SSAPIAuthentication no
  81         SendEnv LANG LC_*
  82         StrictHostKeyChecking yes
  83         UserKnownHostsFile ${builtins.toString ../sec/ssh/known_hosts}
  84       '';
  85     };
  86     virtualbox = {
  87       enable = true;
  88     };
  89   };
  90
  91   # Using modules enables to separate specific configurations
  92   # from reusable code in shell/modules.nix and shell/modules/
  93   # which may find its way in another git repository one day.
  94   modules =
  95     (import shell/modules.nix {
  96       inherit pkgs lib;
  97       modules = [ configuration ];
  98     }).config;
  99 in
 100 pkgs.mkShell {
 101   name = "sourcephile-nix";
 102   src = null;
 103   #preferLocalBuild = true;
 104   #allowSubstitutes = false;
 105   buildInputs = modules.nix-shell.buildInputs ++ [
 106     nixpkgs
 107     nixos.nixos-generate-config
 108     nixos.nixos-install
 109     nixos.nixos-enter
 110     #pkgs.binutils
 111     pkgs.coreutils
 112     pkgs.cryptsetup
 113     pkgs.curl
 114     #pkgs.direnv
 115     pkgs.dnsutils
 116     #pkgs.dropbear
 117     pkgs.e2fsprogs
 118     pkgs.git
 119     pkgs.glibcLocales
 120     pkgs.gnumake
 121     pkgs.gnupg
 122     pkgs.htop
 123     #pkgs.inetutils
 124     pkgs.ipcalc
 125     #pkgs.iputils
 126     pkgs.less
 127     pkgs.libfaketime
 128     pkgs.ldns
 129     #pkgs.ldns.examples
 130     #pkgs.mailutils
 131     pkgs.man
 132     pkgs.mdadm
 133     pkgs.gptfdisk
 134     pkgs.ncdu
 135     pkgs.ncurses
 136     pkgs.nixops
 137     #pkgs.openssl
 138     pkgs.pass
 139     pkgs.procps
 140     pkgs.rsync
 141     #pkgs.rxvt_unicode.terminfo
 142     #pkgs.sqlite
 143     pkgs.sqlite
 144     #pkgs.sudo
 145     pkgs.tig
 146     pkgs.time
 147     #pkgs.tmux
 148     pkgs.tree
 149     pkgs.utillinux
 150     #pkgs.vim
 151     #pkgs.virtualbox
 152     pkgs.which
 153     pkgs.xdg_utils
 154     pkgs.zfs
 155     pkgs.fio
 156     pkgs.strace
 157     pkgs.utillinux
 158     #pkgs.zfstools
 159   ];
 160   #enableParallelBuilding = true;
 161   shellHook = ''
 162     echo >&2 "nix: running shellHook"
 163     # WARNING: beware that sudo may reset the environment,
 164     # and especially PATH, to some system's default.
 165
 166     NIX_SHELL_PATH=$PATH
 167     unset __ETC_PROFILE_SOURCED
 168     unset __NIXOS_SET_ENVIRONMENT_DONE
 169     test ! -e /etc/profile || . /etc/profile
 170     test ! -e ~/.profile || . ~/.profile
 171
 172     # nix
 173     test ! -e ~/.nix-profile/etc/profile.d/nix.sh ||
 174     . ~/.nix-profile/etc/profile.d/nix.sh
 175
 176     # home-manager
 177     unset __HM_SESS_VARS_SOURCED
 178     test ! -e ~/.nix-profile/etc/profile.d/hm-session-vars.sh ||
 179     . ~/.nix-profile/etc/profile.d/hm-session-vars.sh
 180
 181     PATH=$NIX_SHELL_PATH:$PATH
 182     export NIX_PATH="nixpkgs=${pkgs.path}:nixpkgs-overlays="$PWD"/overlays"
 183
 184     # Cleanup "../sec/tmp/"
 185     # This is done when exiting the nix-shell
 186     # (or when… entering the directory with direnv
 187     # which spawns a nix-shell just to get the env).
 188     trap "cd '$PWD' && find ../sec/tmp -type f -exec shred -fu {} +" EXIT
 189
 190     ${modules.nix-shell.shellHook}
 191
 192     # locales
 193     export LANG=fr_FR.UTF-8
 194     export LC_CTYPE=fr_FR.UTF-8
 195
 196     # password-store
 197     export PASSWORD_STORE_DIR="$PWD"/../sec/pass
 198
 199     # gpg
 200     export GPG_TTY=$(tty)
 201     gpg-connect-agent updatestartuptty /bye >/dev/null
 202
 203     # git
 204     gitdir="$PWD"/.git
 205     test ! -f "$gitdir" || while IFS=" :" read -r hdr gitdir; do [ "$hdr" != gitdir ] || break; done <"$gitdir"
 206     ln -fnsr \
 207      "$PWD"/.lib/git/hooks/prepare-commit-msg--longuest-common-prefix \
 208      "$gitdir"/hooks/prepare-commit-msg
 209
 210     # nixops
 211     #export NIXOPS_DEPLOYMENT="staging"
 212     export NIXOPS_STATE="$PWD"/../sec/nixops/state.nixops
 213     NIXOPS_OPTS+=" --show-trace"
 214     export NIXOPS_OPTS
 215
 216     # disnix
 217     #export DISNIXOS_USE_NIXOPS=1
 218     #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
 219     #export DISNIX_PROFILE=default
 220     #export DISNIX_TARGET_PROPERTY=hostname
 221     #export DYSNOMIA_STATEDIR="$PWD"/../sec/dysnomia
 222   '';
 223 }