shell.nix

   1 let
   2   nixpkgs_channel = builtins.getEnv "nixpkgs_channel";
   3   # Bootstraping Nixpkgs to get tools to patch it.
   4   originNixpkgs = import (.config/nixpkgs-channel + ("/${nixpkgs_channel}.nix"));
   5   originPkgs = import originNixpkgs {
   6     config = {}; # Make the config pure, ignoring user's config.
   7     overlays = [];
   8   };
   9   remoteNixpkgsPatches = [
  10     { meta.description = "Dovecot plugin for Full Text Search (FTS) with Xapian";
  11       url = "https://github.com/NixOS/nixpkgs/pull/78780.diff";
  12       sha256 = "1h45qhbragp5ky6xix198qhadj1j7gd3qswa135mnmw1ijfczyry";
  13     }
  14     { meta.description = "dstat: fix pluginpath";
  15       url = "https://github.com/NixOS/nixpkgs/pull/80151.diff";
  16       sha256 = "0jjw2gvp7b7v2n2m2d6yj0gw711j6p9lyjf5ywp2y9ql6905qf4b";
  17     }
  18     { meta.description = "syncoid: fix PATH to let it use sudo";
  19       url = "https://github.com/NixOS/nixpkgs/pull/83901.diff";
  20       sha256 = "0q2dicmvl3h3hb9xdd870n5hf6lac489p000c7f1r6k70sh2id4l";
  21     }
  22     { meta.description = "sanoid: fix sanoid.conf generation";
  23       url = "https://github.com/NixOS/nixpkgs/pull/83904.diff";
  24       sha256 = "0lj4krmmbz82zpmbacw0qj2ywsx895bq4d1psjn753ymh7jjqj8k";
  25     }
  26     { meta.description = "nixos/public-inbox: init";
  27       url = "https://github.com/NixOS/nixpkgs/pull/77450.diff";
  28       sha256 = "13ikg7chpbf6rrg5sngbdb95q3awhdgl4g8vci42xmqyf208hzzd";
  29     }
  30     { meta.description = "stig: update to 0.11.0a";
  31       url = "https://github.com/NixOS/nixpkgs/pull/89557.diff";
  32       sha256 = "1gjx3kd2fh2l1pz1r0v2wgdyi7vfi0404aq80y2v89k6zinb7kpy";
  33     }
  34   ];
  35   localNixpkgsPatches = [
  36   ];
  37   # Build nixpkgs with some patches.
  38   nixpkgs = originPkgs.applyPatches {
  39     name = "nixpkgs-patched";
  40     src = originNixpkgs;
  41     patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
  42     postPatch = ''
  43       patch=$(printf '%s\n' ${builtins.concatStringsSep " "
  44          (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
  45         sort | sha256sum | cut -c -7)
  46       echo "+patch-$patch" >.version-suffix
  47     '';
  48   };
  49   # Final pkgs with custom overlays.
  50   pkgs = import nixpkgs {
  51     config = {}; # Make the config pure, ignoring user's config.
  52     overlays = import nixpkgs/overlays.nix;
  53   };
  54
  55   lib = pkgs.lib;
  56   nixos = pkgs.nixos {};
  57   # Configuration of shell/modules/
  58   # to expand shellHook and buildInputs of this shell.nix
  59   configuration = {config, ...}: {
  60     imports = [
  61       shell/gnupg.nix
  62     ];
  63     nix = {
  64       nixConf = ''
  65         auto-optimise-store = true
  66       '';
  67     };
  68     nix-plugins = {
  69       enable = true;
  70     };
  71     gnupg = {
  72       enable = true;
  73       gnupgHome = toString ../sec/gnupg;
  74       gpgExtraConf = ''
  75         # julm@sourcephile.fr
  76         trusted-key 0xB2450D97085B7B8C
  77       '';
  78     };
  79     openssl = {
  80       enable = true;
  81       opensslHome = toString ../sec/openssl;
  82       certificates = import shell/x509.nix;
  83     };
  84     openssh = {
  85       enable = true;
  86       sshConf = ''
  87         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
  88         Compression no
  89         #CompressionLevel 4
  90         ControlMaster auto
  91         ControlPath ${toString ../sec/ssh}/ssh-%h-%p-%r.socket
  92         HashKnownHosts no
  93         #SSAPIAuthentication no
  94         SendEnv LANG LC_*
  95         StrictHostKeyChecking yes
  96         UserKnownHostsFile ${toString ../sec/ssh/known_hosts}
  97       '';
  98     };
  99     virtualbox = {
 100       enable = false;
 101     };
 102   };
 103
 104   # Using modules enables to separate specific configurations
 105   # from reusable code in shell/modules.nix and shell/modules/
 106   # which may find its way in another git repository one day.
 107   modules =
 108     (import shell/modules.nix {
 109       inherit pkgs lib;
 110       modules = [ configuration ];
 111     }).config;
 112
 113   pwd = toString (./. + "");
 114   sourcephile-shred-tmp = pkgs.writeShellScriptBin "sourcephile-shred-tmp" ''
 115     # This is done when entering the nix-shell
 116     # because direnv already hooks trap EXIT.
 117     cd "${pwd}"
 118     test ! -e sec/tmp || {
 119     find sec/tmp -type f -exec shred -fu {} +
 120     rm -rf sec/tmp
 121     }
 122   '';
 123 in
 124 pkgs.mkShell {
 125   name = "sourcephile-nix";
 126   src = null;
 127   #preferLocalBuild = true;
 128   #allowSubstitutes = false;
 129   buildInputs = modules.nix-shell.buildInputs ++ [
 130     sourcephile-shred-tmp
 131     nixos.nixos-generate-config
 132     nixos.nixos-install
 133     nixos.nixos-enter
 134     #pkgs.binutils
 135     pkgs.coreutils
 136     pkgs.cryptsetup
 137     pkgs.curl
 138     #pkgs.direnv
 139     pkgs.dnsutils
 140     #pkgs.dropbear
 141     pkgs.e2fsprogs
 142     pkgs.git
 143     pkgs.glibcLocales
 144     pkgs.gnumake
 145     pkgs.gnupg
 146     pkgs.htop
 147     #pkgs.inetutils
 148     pkgs.ipcalc
 149     #pkgs.iputils
 150     pkgs.less
 151     pkgs.libfaketime
 152     pkgs.ldns
 153     #pkgs.ldns.examples
 154     #pkgs.mailutils
 155     pkgs.man
 156     pkgs.mdadm
 157     pkgs.gptfdisk
 158     pkgs.ncdu
 159     pkgs.ncurses
 160     #pkgs.nixops
 161     #pkgs.openssl
 162     pkgs.pass
 163     pkgs.procps
 164     pkgs.rsync
 165     #pkgs.rxvt_unicode.terminfo
 166     #pkgs.sqlite
 167     pkgs.sqlite
 168     #pkgs.sudo
 169     pkgs.tig
 170     pkgs.time
 171     #pkgs.tmux
 172     pkgs.tree
 173     pkgs.utillinux
 174     #pkgs.vim
 175     #pkgs.virtualbox
 176     pkgs.which
 177     pkgs.xdg_utils
 178     pkgs.zfs
 179     pkgs.fio
 180     pkgs.strace
 181     pkgs.utillinux
 182     #pkgs.zfstools
 183   ];
 184   #enableParallelBuilding = true;
 185   shellHook = ''
 186     echo >&2 "nix: running shellHook"
 187
 188     # password-store
 189     export PASSWORD_STORE_DIR="$PWD"/../sec/pass
 190
 191     # Nix
 192     PATH=$NIX_SHELL_PATH:$PATH
 193     export NIX_PATH="${lib.concatStringsSep ":" [
 194       "servers=$PWD/servers.nix"
 195       #"pass=$PASSWORD_STORE_DIR"
 196       "nixpkgs=${toString pkgs.path}"
 197       "nixpkgs-overlays=$PWD/nixpkgs/overlays.nix"
 198     ]}"
 199
 200     # Since the .envrc calls this shellHook
 201     # the EXIT trap cannot be freely used
 202     # because it's already used by direnv,
 203     # hence shred at startup, which is not ideal.
 204     sourcephile-shred-tmp
 205
 206     ${modules.nix-shell.shellHook}
 207
 208     # gpg
 209     export GPG_TTY=$(tty)
 210     gpg-connect-agent updatestartuptty /bye >/dev/null
 211   '';
 212 }