let
  nixpkgs_channel = builtins.getEnv "nixpkgs_channel";
  originNixpkgs = import (.config/nixpkgs-channel + ("/" + nixpkgs_channel + ".nix"));
  originPkgs = import originNixpkgs {
    config   = {}; # Make the config pure, ignoring user's config.
    overlays = [];
  };
  remoteNixpkgsPatches = [
    /*
    { meta.description = "nsd : use types.lines where appropriate";
      url = "https://github.com/NixOS/nixpkgs/pull/78968.diff";
      sha256 = "11bqq1g1ax6i7xghihyhklmqpsq3njalardp6nvzphkjgxrypb47";
    }
    { meta.description = "shorewall: init at 5.2.3.3";
      url = "https://github.com/NixOS/nixpkgs/pull/46131.diff";
      sha256 = "0mfzlcr23ni5spnwksmmls50sw10alqbr5j6hjrwp9i30z0419yx";
    }
    */
    { meta.description = "Dovecot plugin for Full Text Search (FTS) with Xapian";
      url = "https://github.com/NixOS/nixpkgs/pull/78780.diff";
      sha256 = "15ix8kwisjcgf4n7x7vlh223rb3206lcd5b13wbcvld07rzinjkc";
    }
    /* Disabled because it triggers the local build of too many reverse-dependencies
    { meta.description = "openldap: enable sha2 and pbkdf2 modules";
      url = "https://github.com/NixOS/nixpkgs/pull/79286.diff";
      sha256 = "0y255x74qksqy7fm4bdwlknhm3s55vgfgbv4dd7580p4lcavya0m";
    }
    */
    /*
    { meta.description = "Replace simp-le with lego and support DNS-01 challenge";
      url = "https://github.com/NixOS/nixpkgs/pull/77578.diff";
      sha256 = "15zs2146zh54jg1gywrcwyqxpx7izc35vlakk3cvrlqwwsvlr2rf";
    }
    */
    { meta.description = "dstat: fix pluginpath";
      url = "https://github.com/NixOS/nixpkgs/pull/80151.diff";
      sha256 = "0jjw2gvp7b7v2n2m2d6yj0gw711j6p9lyjf5ywp2y9ql6905qf4b";
    }
    /*
    { meta.description = "shorewall: fix warnings due to types.loaOf being deprecated";
      url = "https://github.com/NixOS/nixpkgs/pull/80154.diff";
      sha256 = "0b216m1rib3jl6s3r5cbkd5h1bfhppikg4cz9ayr1fspsflr3bci";
    }
    { meta.description = "shorewall: fix RestartTriggers";
      url = "https://github.com/NixOS/nixpkgs/pull/81774.diff";
      sha256 = "14drpym2mq9gq505psjzqq23gv0wkbwrrvh438h5jirzcym3467a";
    }
    */
    { meta.description = "syncoid: fix PATH to let it use sudo";
      url = "https://github.com/NixOS/nixpkgs/pull/83901.diff";
      sha256 = "0q2dicmvl3h3hb9xdd870n5hf6lac489p000c7f1r6k70sh2id4l";
    }
    { meta.description = "sanoid: fix sanoid.conf generation";
      url = "https://github.com/NixOS/nixpkgs/pull/83904.diff";
      sha256 = "1prmlw7kxj076vn52hkhx3jzxrvz84kbhsc7z2z55p5nqhi6pi36";
    }
  ];
  localNixpkgsPatches = [
    patches/direnv.diff
  ];
  nixpkgs = originPkgs.applyPatches {
    name = "nixpkgs-patched";
    src = originNixpkgs;
    patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
    postPatch = ''
      patch=$(printf '%s\n' ${builtins.concatStringsSep " "
         (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
        sort | sha256sum | cut -c -7)
      echo "+patch-$patch" >.version-suffix
    '';
  };
  pkgs = import nixpkgs {
    config = {}; # Make the config pure, ignoring user's config.
    overlays = import ./overlays.nix;
  };

  lib = pkgs.lib;
  nixos = pkgs.nixos {};
  # Configuration of shell/modules/
  configuration = {config, ...}: {
    imports = [
    ];
    nix = {
      nixConf = ''
        auto-optimise-store = true
      '';
    };
    nix-plugins = {
      enable = true;
    };
    gnupg = {
      enable = true;
      gnupgHome = toString ../sec/gnupg;
      keys = import shell/openpgp.nix;
      gpgExtraConf = ''
        # julm@sourcephile.fr
        trusted-key 0xB2450D97085B7B8C
      '';
    };
    openssl = {
      enable = true;
      opensslHome = toString ../sec/openssl;
      certificates = import shell/x509.nix;
    };
    openssh = {
      # WARNING: nixops uses its own ssh, not this one.
      enable = true;
      sshConf = ''
        Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
        Compression no
        #CompressionLevel 4
        ControlMaster auto
        ControlPath ${builtins.toString ../sec/ssh}/ssh-%h-%p-%r.socket
        HashKnownHosts no
        #SSAPIAuthentication no
        SendEnv LANG LC_*
        StrictHostKeyChecking yes
        UserKnownHostsFile ${builtins.toString ../sec/ssh/known_hosts}
      '';
    };
    virtualbox = {
      enable = true;
    };
  };

  # Using modules enables to separate specific configurations
  # from reusable code in shell/modules.nix and shell/modules/
  # which may find its way in another git repository one day.
  modules =
    (import shell/modules.nix {
      inherit pkgs lib;
      modules = [ configuration ];
    }).config;

  # Utility to query the Nix files like nixops show-option
  # but without requiring a nixops database, and not limited to config entries.
  pwd = toString (./. + "");
  sourcephile-nix-get = pkgs.writeShellScriptBin "sourcephile-nix-get" ''
    nix-instantiate --read-write-mode \
     --arg networkExprs "[${pwd}/servers.nix ${pwd}/servers/production.nix]" \
     --arg args '{}' --argstr "uuid" whatever \
     --argstr deploymentName production "<nixops/eval-machine-info.nix>" \
     --eval-only --strict --arg checkConfigurationOptions false -A "$@"
  '';
  sourcephile-shred-tmp = pkgs.writeShellScriptBin "sourcephile-shred-tmp" ''
    # Cleanup "../sec/tmp/"
    # This is done when entering the nix-shell
    # because direnv already hooks trap EXIT.
    cd "${pwd}"
    test ! -e sec/tmp || {
    find sec/tmp -type f -exec shred -fu {} +
    rm -rf sec/tmp
    }
  '';
in
pkgs.mkShell {
  name = "sourcephile-nix";
  src = null;
  #preferLocalBuild = true;
  #allowSubstitutes = false;
  buildInputs = modules.nix-shell.buildInputs ++ [
    sourcephile-nix-get
    sourcephile-shred-tmp
    nixos.nixos-generate-config
    nixos.nixos-install
    nixos.nixos-enter
    #pkgs.binutils
    pkgs.coreutils
    pkgs.cryptsetup
    pkgs.curl
    #pkgs.direnv
    pkgs.dnsutils
    #pkgs.dropbear
    pkgs.e2fsprogs
    pkgs.git
    pkgs.glibcLocales
    pkgs.gnumake
    pkgs.gnupg
    pkgs.htop
    #pkgs.inetutils
    pkgs.ipcalc
    #pkgs.iputils
    pkgs.less
    pkgs.libfaketime
    pkgs.ldns
    #pkgs.ldns.examples
    #pkgs.mailutils
    pkgs.man
    pkgs.mdadm
    pkgs.gptfdisk
    pkgs.ncdu
    pkgs.ncurses
    pkgs.nixops
    #pkgs.openssl
    pkgs.pass
    pkgs.procps
    pkgs.rsync
    #pkgs.rxvt_unicode.terminfo
    #pkgs.sqlite
    pkgs.sqlite
    #pkgs.sudo
    pkgs.tig
    pkgs.time
    #pkgs.tmux
    pkgs.tree
    pkgs.utillinux
    #pkgs.vim
    #pkgs.virtualbox
    pkgs.which
    pkgs.xdg_utils
    pkgs.zfs
    pkgs.fio
    pkgs.strace
    pkgs.utillinux
    #pkgs.zfstools
  ];
  #enableParallelBuilding = true;
  shellHook = ''
    echo >&2 "nix: running shellHook"

    # Nix
    PATH=$NIX_SHELL_PATH:$PATH
    export NIX_PATH="nixpkgs=${toString pkgs.path}:nixpkgs-overlays="$PWD"/overlays:nixops=${toString pkgs.nixops}/share/nix/nixops"

    # Since the .envrc calls this shellHook
    # the EXIT trap cannot be freely used
    # because it's already used by direnv,
    # hence shred at startup, which is not ideal.
    sourcephile-shred-tmp

    ${modules.nix-shell.shellHook}

    # password-store
    export PASSWORD_STORE_DIR="$PWD"/../sec/pass

    # gpg
    export GPG_TTY=$(tty)
    gpg-connect-agent updatestartuptty /bye >/dev/null

    # nixops
    #export NIXOPS_DEPLOYMENT="staging"
    export MERMET_DEPLOYMENT=production
    export LOSURDO_DEPLOYMENT=production
    export NIXOPS_STATE="$PWD"/../sec/nixops/state.nixops
    NIXOPS_OPTS+=" --show-trace"
    export NIXOPS_OPTS

    # disnix
    #export DISNIXOS_USE_NIXOPS=1
    #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
    #export DISNIX_PROFILE=default
    #export DISNIX_TARGET_PROPERTY=hostname
    #export DYSNOMIA_STATEDIR="$PWD"/../sec/dysnomia
  '';
}