let nixpkgs_channel = builtins.getEnv "nixpkgs_channel"; originNixpkgs = import (.config/nixpkgs-channel + ("/" + nixpkgs_channel + ".nix")); originPkgs = import originNixpkgs { config = {}; # Make the config pure, ignoring user's config. overlays = []; }; remoteNixpkgsPatches = [ /* { meta.description = "nsd : use types.lines where appropriate"; url = "https://github.com/NixOS/nixpkgs/pull/78968.diff"; sha256 = "11bqq1g1ax6i7xghihyhklmqpsq3njalardp6nvzphkjgxrypb47"; } { meta.description = "shorewall: init at 5.2.3.3"; url = "https://github.com/NixOS/nixpkgs/pull/46131.diff"; sha256 = "0mfzlcr23ni5spnwksmmls50sw10alqbr5j6hjrwp9i30z0419yx"; } */ { meta.description = "Dovecot plugin for Full Text Search (FTS) with Xapian"; url = "https://github.com/NixOS/nixpkgs/pull/78780.diff"; sha256 = "15ix8kwisjcgf4n7x7vlh223rb3206lcd5b13wbcvld07rzinjkc"; } /* Disabled because it triggers the local build of too many reverse-dependencies { meta.description = "openldap: enable sha2 and pbkdf2 modules"; url = "https://github.com/NixOS/nixpkgs/pull/79286.diff"; sha256 = "0y255x74qksqy7fm4bdwlknhm3s55vgfgbv4dd7580p4lcavya0m"; } */ /* { meta.description = "Replace simp-le with lego and support DNS-01 challenge"; url = "https://github.com/NixOS/nixpkgs/pull/77578.diff"; sha256 = "15zs2146zh54jg1gywrcwyqxpx7izc35vlakk3cvrlqwwsvlr2rf"; } */ { meta.description = "dstat: fix pluginpath"; url = "https://github.com/NixOS/nixpkgs/pull/80151.diff"; sha256 = "0jjw2gvp7b7v2n2m2d6yj0gw711j6p9lyjf5ywp2y9ql6905qf4b"; } /* { meta.description = "shorewall: fix warnings due to types.loaOf being deprecated"; url = "https://github.com/NixOS/nixpkgs/pull/80154.diff"; sha256 = "0b216m1rib3jl6s3r5cbkd5h1bfhppikg4cz9ayr1fspsflr3bci"; } { meta.description = "shorewall: fix RestartTriggers"; url = "https://github.com/NixOS/nixpkgs/pull/81774.diff"; sha256 = "14drpym2mq9gq505psjzqq23gv0wkbwrrvh438h5jirzcym3467a"; } */ { meta.description = "syncoid: fix PATH to let it use sudo"; url = "https://github.com/NixOS/nixpkgs/pull/83901.diff"; sha256 = "0q2dicmvl3h3hb9xdd870n5hf6lac489p000c7f1r6k70sh2id4l"; } { meta.description = "sanoid: fix sanoid.conf generation"; url = "https://github.com/NixOS/nixpkgs/pull/83904.diff"; sha256 = "1prmlw7kxj076vn52hkhx3jzxrvz84kbhsc7z2z55p5nqhi6pi36"; } ]; localNixpkgsPatches = [ patches/direnv.diff ]; nixpkgs = originPkgs.applyPatches { name = "nixpkgs-patched"; src = originNixpkgs; patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches; postPatch = '' patch=$(printf '%s\n' ${builtins.concatStringsSep " " (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} | sort | sha256sum | cut -c -7) echo "+patch-$patch" >.version-suffix ''; }; pkgs = import nixpkgs { config = {}; # Make the config pure, ignoring user's config. overlays = import ./overlays.nix; }; lib = pkgs.lib; nixos = pkgs.nixos {}; # Configuration of shell/modules/ configuration = {config, ...}: { imports = [ ]; nix = { nixConf = '' auto-optimise-store = true ''; }; nix-plugins = { enable = true; }; gnupg = { enable = true; gnupgHome = toString ../sec/gnupg; keys = import shell/openpgp.nix; gpgExtraConf = '' # julm@sourcephile.fr trusted-key 0xB2450D97085B7B8C ''; }; openssl = { enable = true; opensslHome = toString ../sec/openssl; certificates = import shell/x509.nix; }; openssh = { # WARNING: nixops uses its own ssh, not this one. enable = true; sshConf = '' Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr Compression no #CompressionLevel 4 ControlMaster auto ControlPath ${builtins.toString ../sec/ssh}/ssh-%h-%p-%r.socket HashKnownHosts no #SSAPIAuthentication no SendEnv LANG LC_* StrictHostKeyChecking yes UserKnownHostsFile ${builtins.toString ../sec/ssh/known_hosts} ''; }; virtualbox = { enable = true; }; }; # Using modules enables to separate specific configurations # from reusable code in shell/modules.nix and shell/modules/ # which may find its way in another git repository one day. modules = (import shell/modules.nix { inherit pkgs lib; modules = [ configuration ]; }).config; # Utility to query the Nix files like nixops show-option # but without requiring a nixops database, and not limited to config entries. pwd = toString (./. + ""); sourcephile-nix-get = pkgs.writeShellScriptBin "sourcephile-nix-get" '' nix-instantiate --read-write-mode \ --arg networkExprs "[${pwd}/servers.nix ${pwd}/servers/production.nix]" \ --arg args '{}' --argstr "uuid" whatever \ --argstr deploymentName production "" \ --eval-only --strict --arg checkConfigurationOptions false -A "$@" ''; sourcephile-shred-tmp = pkgs.writeShellScriptBin "sourcephile-shred-tmp" '' # Cleanup "../sec/tmp/" # This is done when entering the nix-shell # because direnv already hooks trap EXIT. cd "${pwd}" test ! -e sec/tmp || { find sec/tmp -type f -exec shred -fu {} + rm -rf sec/tmp } ''; in pkgs.mkShell { name = "sourcephile-nix"; src = null; #preferLocalBuild = true; #allowSubstitutes = false; buildInputs = modules.nix-shell.buildInputs ++ [ sourcephile-nix-get sourcephile-shred-tmp nixos.nixos-generate-config nixos.nixos-install nixos.nixos-enter #pkgs.binutils pkgs.coreutils pkgs.cryptsetup pkgs.curl #pkgs.direnv pkgs.dnsutils #pkgs.dropbear pkgs.e2fsprogs pkgs.git pkgs.glibcLocales pkgs.gnumake pkgs.gnupg pkgs.htop #pkgs.inetutils pkgs.ipcalc #pkgs.iputils pkgs.less pkgs.libfaketime pkgs.ldns #pkgs.ldns.examples #pkgs.mailutils pkgs.man pkgs.mdadm pkgs.gptfdisk pkgs.ncdu pkgs.ncurses pkgs.nixops #pkgs.openssl pkgs.pass pkgs.procps pkgs.rsync #pkgs.rxvt_unicode.terminfo #pkgs.sqlite pkgs.sqlite #pkgs.sudo pkgs.tig pkgs.time #pkgs.tmux pkgs.tree pkgs.utillinux #pkgs.vim #pkgs.virtualbox pkgs.which pkgs.xdg_utils pkgs.zfs pkgs.fio pkgs.strace pkgs.utillinux #pkgs.zfstools ]; #enableParallelBuilding = true; shellHook = '' echo >&2 "nix: running shellHook" # Nix PATH=$NIX_SHELL_PATH:$PATH export NIX_PATH="nixpkgs=${toString pkgs.path}:nixpkgs-overlays="$PWD"/overlays:nixops=${toString pkgs.nixops}/share/nix/nixops" # Since the .envrc calls this shellHook # the EXIT trap cannot be freely used # because it's already used by direnv, # hence shred at startup, which is not ideal. sourcephile-shred-tmp ${modules.nix-shell.shellHook} # password-store export PASSWORD_STORE_DIR="$PWD"/../sec/pass # gpg export GPG_TTY=$(tty) gpg-connect-agent updatestartuptty /bye >/dev/null # nixops #export NIXOPS_DEPLOYMENT="staging" export MERMET_DEPLOYMENT=production export LOSURDO_DEPLOYMENT=production export NIXOPS_STATE="$PWD"/../sec/nixops/state.nixops NIXOPS_OPTS+=" --show-trace" export NIXOPS_OPTS # disnix #export DISNIXOS_USE_NIXOPS=1 #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client #export DISNIX_PROFILE=default #export DISNIX_TARGET_PROPERTY=hostname #export DYSNOMIA_STATEDIR="$PWD"/../sec/dysnomia ''; }