shell.nix

   1 let
   2   nixpkgs_channel = builtins.getEnv "nixpkgs_channel";
   3   originNixpkgs = import (.config/nixpkgs-channel + ("/" + nixpkgs_channel + ".nix"));
   4   originPkgs = import originNixpkgs {
   5     config   = {}; # Make the config pure, ignoring user's config.
   6     overlays = [];
   7   };
   8   nixpkgsPatches = [
   9     /*
  10     { meta.description = "nsd : use types.lines where appropriate";
  11       url = "https://github.com/NixOS/nixpkgs/pull/78968.diff";
  12       sha256 = "11bqq1g1ax6i7xghihyhklmqpsq3njalardp6nvzphkjgxrypb47";
  13     }
  14     { meta.description = "shorewall: init at 5.2.3.3";
  15       url = "https://github.com/NixOS/nixpkgs/pull/46131.diff";
  16       sha256 = "0mfzlcr23ni5spnwksmmls50sw10alqbr5j6hjrwp9i30z0419yx";
  17     }
  18     */
  19     { meta.description = "Dovecot plugin for Full Text Search (FTS) with Xapian";
  20       url = "https://github.com/NixOS/nixpkgs/pull/78780.diff";
  21       sha256 = "053md69ryybj27cp0xdfrza48zyzpblk6wvb2m2dbs9hm0gmcwc4";
  22     }
  23     /* Disabled because it triggers the local build of too many reverse-dependencies
  24     { meta.description = "openldap: enable sha2 and pbkdf2 modules";
  25       url = "https://github.com/NixOS/nixpkgs/pull/79286.diff";
  26       sha256 = "0y255x74qksqy7fm4bdwlknhm3s55vgfgbv4dd7580p4lcavya0m";
  27     }
  28     */
  29     /*
  30     { meta.description = "Replace simp-le with lego and support DNS-01 challenge";
  31       url = "https://github.com/NixOS/nixpkgs/pull/77578.diff";
  32       sha256 = "15zs2146zh54jg1gywrcwyqxpx7izc35vlakk3cvrlqwwsvlr2rf";
  33     }
  34     */
  35     { meta.description = "dstat: fix pluginpath";
  36       url = "https://github.com/NixOS/nixpkgs/pull/80151.diff";
  37       sha256 = "0jjw2gvp7b7v2n2m2d6yj0gw711j6p9lyjf5ywp2y9ql6905qf4b";
  38     }
  39     /*
  40     { meta.description = "shorewall: fix warnings due to types.loaOf being deprecated";
  41       url = "https://github.com/NixOS/nixpkgs/pull/80154.diff";
  42       sha256 = "0b216m1rib3jl6s3r5cbkd5h1bfhppikg4cz9ayr1fspsflr3bci";
  43     }
  44     { meta.description = "shorewall: fix RestartTriggers";
  45       url = "https://github.com/NixOS/nixpkgs/pull/81774.diff";
  46       sha256 = "14drpym2mq9gq505psjzqq23gv0wkbwrrvh438h5jirzcym3467a";
  47     }
  48     */
  49   ];
  50   localNixpkgsPatches = [
  51     patches/direnv.diff
  52   ];
  53   nixpkgs = originPkgs.stdenv.mkDerivation {
  54     name = "nixpkgs-patched";
  55     src = originNixpkgs;
  56     phases = [ "unpackPhase" "patchPhase" ];
  57     patches = map originPkgs.fetchpatch nixpkgsPatches ++ localNixpkgsPatches;
  58     postPatch = ''
  59       patch=$(printf '%s\n' ${builtins.concatStringsSep " " (map (p: p.sha256) nixpkgsPatches)} |
  60         sort | sha256sum | cut -c -7)
  61       mv $PWD $out
  62       echo "+patch-$patch" >$out/.version-suffix
  63     '';
  64   };
  65   pkgs = import nixpkgs {
  66     config = {}; # Make the config pure, ignoring user's config.
  67     overlays = import ./overlays.nix;
  68   };
  69
  70
  71   lib = pkgs.lib;
  72   nixos = pkgs.nixos {};
  73   # Configuration of shell/modules/
  74   configuration = {config, ...}: {
  75     imports = [
  76     ];
  77     nix = {
  78       nixConf = ''
  79         auto-optimise-store = true
  80       '';
  81     };
  82     nix-plugins = {
  83       enable = true;
  84     };
  85     gnupg = {
  86       enable = true;
  87       gnupgHome = toString ../sec/gnupg;
  88       keys = import shell/openpgp.nix;
  89       gpgExtraConf = ''
  90         trusted-key 0xB2450D97085B7B8C
  91       '';
  92     };
  93     openssl = {
  94       enable = true;
  95       opensslHome = toString ../sec/openssl;
  96       certificates = import shell/x509.nix;
  97     };
  98     openssh = {
  99       # WARNING: nixops uses its own ssh, not this one.
 100       enable = true;
 101       sshConf = ''
 102         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
 103         Compression no
 104         #CompressionLevel 4
 105         ControlMaster auto
 106         ControlPath ${builtins.toString ../sec/ssh}/ssh-%h-%p-%r.socket
 107         HashKnownHosts no
 108         #SSAPIAuthentication no
 109         SendEnv LANG LC_*
 110         StrictHostKeyChecking yes
 111         UserKnownHostsFile ${builtins.toString ../sec/ssh/known_hosts}
 112       '';
 113     };
 114     virtualbox = {
 115       enable = true;
 116     };
 117   };
 118
 119   # Using modules enables to separate specific configurations
 120   # from reusable code in shell/modules.nix and shell/modules/
 121   # which may find its way in another git repository one day.
 122   modules =
 123     (import shell/modules.nix {
 124       inherit pkgs lib;
 125       modules = [ configuration ];
 126     }).config;
 127 in
 128 pkgs.mkShell {
 129   name = "sourcephile-nix";
 130   src = null;
 131   #preferLocalBuild = true;
 132   #allowSubstitutes = false;
 133   buildInputs = modules.nix-shell.buildInputs ++ [
 134     nixos.nixos-generate-config
 135     nixos.nixos-install
 136     nixos.nixos-enter
 137     #pkgs.binutils
 138     pkgs.coreutils
 139     pkgs.cryptsetup
 140     pkgs.curl
 141     #pkgs.direnv
 142     pkgs.dnsutils
 143     #pkgs.dropbear
 144     pkgs.e2fsprogs
 145     pkgs.git
 146     pkgs.glibcLocales
 147     pkgs.gnumake
 148     pkgs.gnupg
 149     pkgs.htop
 150     #pkgs.inetutils
 151     pkgs.ipcalc
 152     #pkgs.iputils
 153     pkgs.less
 154     pkgs.libfaketime
 155     pkgs.ldns
 156     #pkgs.ldns.examples
 157     #pkgs.mailutils
 158     pkgs.man
 159     pkgs.mdadm
 160     pkgs.gptfdisk
 161     pkgs.ncdu
 162     pkgs.ncurses
 163     pkgs.nixops
 164     #pkgs.openssl
 165     pkgs.pass
 166     pkgs.procps
 167     pkgs.rsync
 168     #pkgs.rxvt_unicode.terminfo
 169     #pkgs.sqlite
 170     pkgs.sqlite
 171     #pkgs.sudo
 172     pkgs.tig
 173     pkgs.time
 174     #pkgs.tmux
 175     pkgs.tree
 176     pkgs.utillinux
 177     #pkgs.vim
 178     #pkgs.virtualbox
 179     pkgs.which
 180     pkgs.xdg_utils
 181     pkgs.zfs
 182     pkgs.fio
 183     pkgs.strace
 184     pkgs.utillinux
 185     #pkgs.zfstools
 186   ];
 187   #enableParallelBuilding = true;
 188   shellHook = ''
 189     echo >&2 "nix: running shellHook"
 190
 191     # Nix
 192     PATH=$NIX_SHELL_PATH:$PATH
 193     export NIX_PATH="nixpkgs=${toString pkgs.path}:nixpkgs-overlays="$PWD"/overlays"
 194     export nixpkgs_channel=${nixpkgs_channel}
 195
 196     # Cleanup "../sec/tmp/"
 197     # This is done when entering the nix-shell
 198     # because direnv already hooks trap EXIT.
 199     (cd "$PWD" && find ../sec/tmp -type f -exec shred -fu {} +)
 200
 201     ${modules.nix-shell.shellHook}
 202
 203     # password-store
 204     export PASSWORD_STORE_DIR="$PWD"/../sec/pass
 205
 206     # gpg
 207     export GPG_TTY=$(tty)
 208     gpg-connect-agent updatestartuptty /bye >/dev/null
 209
 210     # NixOS
 211     export MERMET_DEPLOYMENT=production
 212     export LOSURDO_DEPLOYMENT=production
 213
 214     # nixops
 215     #export NIXOPS_DEPLOYMENT="staging"
 216     export NIXOPS_STATE="$PWD"/../sec/nixops/state.nixops
 217     NIXOPS_OPTS+=" --show-trace"
 218     export NIXOPS_OPTS
 219
 220     # disnix
 221     #export DISNIXOS_USE_NIXOPS=1
 222     #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
 223     #export DISNIX_PROFILE=default
 224     #export DISNIX_TARGET_PROPERTY=hostname
 225     #export DYSNOMIA_STATEDIR="$PWD"/../sec/dysnomia
 226   '';
 227 }