let
  nixpkgs = import .lib/nix/nixpkgs.nix;
  pkgs = import nixpkgs {
    config   = {}; # Make the config pure, ignoring user's config.
    overlays = import ./overlays.nix;
  };
  # Using modules enables to separate specific configurations in shell/configuration.nix
  # from reusable code in shell/modules.nix
  # which may find its way in another git repository one day.
  modules =
    (import shell/modules.nix {
      inherit pkgs;
      inherit (pkgs) lib;
      modules = [ ( import shell/configuration.nix ) ];
    }).config;
  /*
  sourcephile-nix-build =
    pkgs.stdenv.mkDerivation {
      name = "sourcephile-nix-build";
      preferLocalBuild = true;
      allowSubstitutes = false;
      inherit (pkgs) coreutils;
      builder = pkgs.writeText "builder.sh" modules.init.builder;
    };
  */
  sourcephile-nix-build =
    pkgs.buildEnv {
      name        = "sourcephile-nix-build";
      pathsToLink = [ "/bin" ];
      paths       = with modules; [
        gnupg.init
        #gnupg.gpg-fingerprint
        #nix-plugins.nix-with-extra-builtins
      ];
    };
  nixos = pkgs.nixos {};
  nixos-generate-config = nixos.nixos-generate-config;
  nixos-install         = nixos.nixos-install;
  nixos-enter           = nixos.nixos-enter;
in
pkgs.stdenv.mkDerivation {
  name = "sourcephile-nix";
  src = null;
  #preferLocalBuild = true;
  #allowSubstitutes = false;
  buildInputs = [
    sourcephile-nix-build
    nixpkgs
    nixos-generate-config
    nixos-install
    nixos-enter
    #pkgs.binutils
    pkgs.coreutils
    pkgs.cryptsetup
    pkgs.curl
    #pkgs.direnv
    #pkgs.dnsutils
    #pkgs.dropbear
    pkgs.e2fsprogs
    pkgs.git
    pkgs.glibcLocales
    pkgs.gnumake
    pkgs.gnupg
    pkgs.htop
    #pkgs.inetutils
    pkgs.less
    pkgs.libfaketime
    #pkgs.mailutils
    pkgs.man
    pkgs.mdadm
    pkgs.gptfdisk
    pkgs.ncdu
    pkgs.ncurses
    pkgs.nixops
    #pkgs.openssl
    pkgs.pass
    pkgs.procps
    #pkgs.rxvt_unicode.terminfo
    #pkgs.sqlite
    pkgs.sqlite
    pkgs.sudo
    pkgs.tig
    pkgs.time
    #pkgs.tmux
    pkgs.tree
    pkgs.utillinux
    pkgs.vim
    #pkgs.virtualbox
    pkgs.which
    pkgs.xdg_utils
    pkgs.zfs
    pkgs.fio
    pkgs.strace
    #pkgs.zfstools
  ];
  #enableParallelBuilding = true;
  shellHook = ''
    echo >&2 "nix: running shellHook"

    # nix
    export NIX_PATH="nixpkgs=${nixpkgs}:nixpkgs-sourcephile=$PWD/.lib/nixpkgs-sourcephile"
    NIX_PATH+=":nixpkgs-overlays="$PWD"/overlays"
    #NIX_PATH+=""

    # executables
    PATH_NIX=$(dirname $(readlink -e ~/.nix-profile/bin/nix))
    PATH_NIXOS=/run/wrappers/bin
    PATH_FHS="$PWD"/.lib/nix/fhs-bin
    PATH_FHS_VBOX="$PWD"/.lib/fhs-vbox-bin
    export PATH="$PATH_NIXOS:$PATH_FHS_VBOX:$PATH_FHS:$PATH:$PATH_NIX"
    ln -sfn ${sourcephile-nix-build}/bin "$PWD"/.bin

    # nix.conf
    export NIX_CONF_DIR="$PWD"/.config/nix
    install -D /dev/stdin "$PWD"/.config/nix/nix.conf <<-EOF
    auto-optimise-store = true
    plugin-files        = ${pkgs.nix-plugins}/lib/nix/plugins/libnix-extra-builtins.so
    extra-builtins-file = ${modules.nix-plugins.extra-builtins}
    EOF

    # NOTE: sudo needs to be own by root with the setuid bit,
    # but this won't be the case for the sudo provided by Nix outside NixOS,
    # hence the addition of $PATH_FHS in shellHook
    # to provide the host system's sudo.
    # WARNING: beware that sudo may reset the environment,
    # and especially PATH, to some system's default.

    # locales
    export LANG=fr_FR.UTF-8
    export LC_CTYPE=fr_FR.UTF-8

    # gnupg
    export GNUPGHOME="$PWD"/../sec/gnupg
    install -dm700 "$GNUPGHOME"
    export GPG_TTY=$(tty)
    gpgconf --launch gpg-agent
    export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)

    # password-store
    export PASSWORD_STORE_DIR="$PWD"/../sec/pass

    # openssl
    export NIX_SSL_CERT_FILE="${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
    export SSL_CERT_FILE="${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"

    # git
    gitdir="$PWD"/.git
    test ! -f "$gitdir" || while IFS=" :" read -r hdr gitdir; do [ "$hdr" != gitdir ] || break; done <"$gitdir"
    ln -fnsr \
     "$PWD"/.lib/git/hooks/prepare-commit-msg--longuest-common-prefix \
     "$gitdir"/hooks/prepare-commit-msg

    # nixops
    #export NIXOPS_DEPLOYMENT="staging"
    export NIXOPS_STATE="$PWD"/.sec/nixops/state.nixops
    # Extend the Nix interpreter
    # to enable builtins.extraBuiltins,
    # which provides an unsafe exec useful to get secrets
    # from the local password-store.
    NIXOPS_OPTS+=" --show-trace"
    NIXOPS_OPTS+=" --option plugin-files ${pkgs.nix-plugins}/lib/nix/plugins/libnix-extra-builtins.so"
    NIXOPS_OPTS+=" --option extra-builtins-file ${modules.nix-plugins.extra-builtins}"
    export NIXOPS_OPTS

    # disnix
    #export DISNIXOS_USE_NIXOPS=1
    #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
    #export DISNIX_PROFILE=default
    #export DISNIX_TARGET_PROPERTY=hostname
    #export DYSNOMIA_STATEDIR="$PWD"/.sec/dysnomia
  '';
}