shell.nix

   1 { inputs, pkgs, shellHook ? "", ... }:
   2 let
   3   # Configuration of shell/modules/
   4   # to expand shellHook and buildInputs of this shell.nix
   5   shellConfig = { ... }: {
   6     imports = [
   7       shell/gnupg.nix
   8     ];
   9     gnupg = {
  10       enable = true;
  11       gnupgHome = "../sec/gnupg";
  12       gpgExtraConf = ''
  13         # julm@sourcephile.fr
  14         trusted-key 0xB2450D97085B7B8C
  15         default-key 0x4FE467034C11017B429BAC53A58CD81C3863926F
  16       '';
  17       gpgAgentExtraConf = ''
  18         #pretend-request-origin remote
  19         #extra-socket ${toString ./.}/S.gpg-agent.extra
  20         #log-file ${toString ./.}/gpg-agent.log
  21         #no-grab
  22         #debug-level expert
  23         #allow-loopback-pinentry
  24       '';
  25     };
  26     /*
  27       openssl = {
  28       enable = true;
  29       opensslHome = "../sec/openssl";
  30       certificates = import shell/x509.nix;
  31       };
  32     */
  33     openssh = {
  34       enable = true;
  35       sshConf = ''
  36         Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
  37         Compression no
  38         #CompressionLevel 4
  39         ControlMaster auto
  40         ControlPath .ssh-%h-%p-%r.socket
  41         HashKnownHosts no
  42         #SSAPIAuthentication no
  43         SendEnv LANG LC_*
  44         StrictHostKeyChecking yes
  45         #UserKnownHostsFile ''${inputs.secrets + "/ssh/known_hosts"}
  46       '';
  47     };
  48     virtualbox = {
  49       enable = false;
  50     };
  51   };
  52
  53   # Using modules enables to separate specific configurations
  54   # from reusable code in shell/modules.nix and shell/modules/
  55   # which may find its way in another git repository one day.
  56   shell = (pkgs.lib.evalModules {
  57     modules = [
  58       shellConfig
  59       { config._module.args = { inherit inputs pkgs; }; }
  60     ] ++ map import (pkgs.lib.findFiles ".*\\.nix" shell/modules);
  61   }).config;
  62 in
  63 pkgs.mkShell {
  64   name = "sourcephile-nix";
  65   src = null;
  66   #preferLocalBuild = true;
  67   #allowSubstitutes = false;
  68   buildInputs = shell.nix-shell.buildInputs ++ [
  69     (pkgs.nixos [ ]).nixos-generate-config
  70     (pkgs.nixos [ ]).nixos-install
  71     (pkgs.nixos [ ]).nixos-enter
  72     #pkgs.binutils
  73     pkgs.coreutils
  74     pkgs.cryptsetup
  75     pkgs.curl
  76     #pkgs.direnv
  77     pkgs.dnsutils
  78     #pkgs.dropbear
  79     pkgs.e2fsprogs
  80     pkgs.git
  81     pkgs.glibcLocales
  82     pkgs.gnumake
  83     pkgs.gnupg
  84     pkgs.htop
  85     #pkgs.inetutils
  86     pkgs.ipcalc
  87     #pkgs.iputils
  88     pkgs.less
  89     pkgs.libfaketime
  90     pkgs.ldns
  91     #pkgs.ldns.examples
  92     #pkgs.mailutils
  93     pkgs.man
  94     pkgs.mdadm
  95     pkgs.gptfdisk
  96     pkgs.ncdu
  97     pkgs.ncurses
  98     #pkgs.nixops
  99     #pkgs.openssl
 100     pkgs.pass
 101     pkgs.procps
 102     pkgs.rsync
 103     #pkgs.rxvt_unicode.terminfo
 104     #pkgs.sqlite
 105     pkgs.sqlite
 106     #pkgs.sudo
 107     pkgs.tig
 108     pkgs.time
 109     #pkgs.tmux
 110     pkgs.tree
 111     pkgs.utillinux
 112     #pkgs.vim
 113     #pkgs.virtualbox
 114     pkgs.which
 115     pkgs.xdg_utils
 116     pkgs.fio
 117     pkgs.strace
 118     pkgs.utillinux
 119     #pkgs.zfstools
 120     pkgs.linuxPackages.perf
 121     #pkgs.go2nix
 122     pkgs.wireguard-tools
 123     pkgs.stun
 124     pkgs.mkpasswd
 125     #pkgs.ubootTools
 126     #pkgs.hydra-unstable
 127   ];
 128   #enableParallelBuilding = true;
 129
 130   NIX_PATH = pkgs.lib.concatStringsSep ":" [
 131     "nixpkgs=${pkgs.path}"
 132     ("nixpkgs-overlays=" + pkgs.writeText "overlays.nix" ''
 133       import ${inputs.self + "/nixpkgs/overlays.nix"} ++
 134       import ${inputs.julm-nix + "/nixpkgs/overlays.nix"}
 135     '')
 136   ];
 137
 138   shellHook = ''
 139     echo >&2 "nix: running shellHook"
 140
 141     ${shell.nix-shell.shellHook}
 142
 143     # gpg
 144     export GNUPGHOME=$(realpath -e ${shell.gnupg.gnupgHome});
 145     export GPG_TTY=$(tty)
 146     gpg-connect-agent updatestartuptty /bye >/dev/null
 147
 148     # pass
 149     export PASSWORD_STORE_DIR="$PWD"
 150   '' + shellHook;
 151 }