sourcehut: only enable Docker when needed
[sourcephile-nix.git] / shell.nix
index afb6ea50d0be4729b42114cb80124f1a3a66f7a4..7697c99049c48316360353ee22bdc00ec38eae10 100644 (file)
--- a/shell.nix
+++ b/shell.nix
@@ -1,57 +1,95 @@
+{ inputs, pkgs, ... }:
 let
-  nixpkgs = import .lib/nix/nixpkgs.nix;
-  pkgs = import nixpkgs {
-    config   = {}; # Make the config pure, ignoring user's config.
-    overlays = import .lib/nixpkgs-sourcephile/build/overlays.nix;
-  };
-  sourcephile-nix-build-modules =
-    (import .lib/nixpkgs-sourcephile/build/modules.nix {
-      inherit pkgs;
-      inherit (pkgs) lib;
-      modules = [ ( import build/modules.nix ) ];
-    }).config;
-  /*
-  sourcephile-nix-build =
-    pkgs.stdenv.mkDerivation {
-      name = "sourcephile-nix-build";
-      preferLocalBuild = true;
-      allowSubstitutes = false;
-      inherit (pkgs) coreutils;
-      builder = pkgs.writeText "builder.sh" sourcephile-nix-build-modules.init.builder;
+  # Configuration of shell/modules/
+  # to expand shellHook and buildInputs of this shell.nix
+  shellConfig = {config, ...}: {
+    imports = [
+      shell/gnupg.nix
+    ];
+    nix = {
+      nixConf = ''
+        auto-optimise-store = true
+        experimental-features nix-command flake
+      '';
+    };
+    gnupg = {
+      enable = true;
+      gnupgHome = "../sec/gnupg";
+      gpgExtraConf = ''
+        # julm@sourcephile.fr
+        trusted-key 0xB2450D97085B7B8C
+      '';
+      gpgAgentExtraConf = ''
+        #pretend-request-origin remote
+        #extra-socket ${toString ./.}/S.gpg-agent.extra
+        #log-file ${toString ./.}/gpg-agent.log
+        #no-grab
+        #debug-level expert
+        #allow-loopback-pinentry
+      '';
+    };
+    /*
+    openssl = {
+      enable = true;
+      opensslHome = "../sec/openssl";
+      certificates = import shell/x509.nix;
     };
-  */
-  sourcephile-nix-build =
-    pkgs.buildEnv {
-      name        = "sourcephile-nix-build";
-      pathsToLink = [ "/bin" ];
-      paths       = with sourcephile-nix-build-modules; [
-        gnupg.init
-        #gnupg.gpg-fingerprint
-        #nix-plugins.nix-with-extra-builtins
-      ];
+    */
+    openssh = {
+      enable = true;
+      sshConf = ''
+        Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
+        Compression no
+        #CompressionLevel 4
+        ControlMaster auto
+        ControlPath .ssh-%h-%p-%r.socket
+        HashKnownHosts no
+        #SSAPIAuthentication no
+        SendEnv LANG LC_*
+        StrictHostKeyChecking yes
+        UserKnownHostsFile ${inputs.secrets + "/ssh/known_hosts"}
+      '';
     };
-  nixos = pkgs.nixos {};
-  nixos-generate-config = nixos.nixos-generate-config;
-  nixos-install         = nixos.nixos-install;
-  nixos-enter           = nixos.nixos-enter;
+    virtualbox = {
+      enable = false;
+    };
+  };
+
+  # Using modules enables to separate specific configurations
+  # from reusable code in shell/modules.nix and shell/modules/
+  # which may find its way in another git repository one day.
+  shell = (pkgs.lib.evalModules {
+    modules = [ shellConfig ] ++ map import (pkgs.lib.findFiles ".*\\.nix" (inputs.shell + "/modules"));
+    args = { inherit inputs pkgs; };
+  }).config;
+
+  pwd = toString (./. + "");
+  sourcephile-shred-tmp = pkgs.writeShellScriptBin "sourcephile-shred-tmp" ''
+    # This is done when entering the nix-shell
+    # because direnv already hooks trap EXIT.
+    cd "${pwd}"
+    test ! -e sec/tmp || {
+    find sec/tmp -type f -exec shred -fu {} +
+    rm -rf sec/tmp
+    }
+  '';
 in
-pkgs.stdenv.mkDerivation {
+pkgs.mkShell {
   name = "sourcephile-nix";
   src = null;
   #preferLocalBuild = true;
   #allowSubstitutes = false;
-  buildInputs = [
-    sourcephile-nix-build
-    nixpkgs
-    nixos-generate-config
-    nixos-install
-    nixos-enter
+  buildInputs = shell.nix-shell.buildInputs ++ [
+    sourcephile-shred-tmp
+    (pkgs.nixos []).nixos-generate-config
+    (pkgs.nixos []).nixos-install
+    (pkgs.nixos []).nixos-enter
     #pkgs.binutils
     pkgs.coreutils
     pkgs.cryptsetup
     pkgs.curl
     #pkgs.direnv
-    #pkgs.dnsutils
+    pkgs.dnsutils
     #pkgs.dropbear
     pkgs.e2fsprogs
     pkgs.git
@@ -60,110 +98,71 @@ pkgs.stdenv.mkDerivation {
     pkgs.gnupg
     pkgs.htop
     #pkgs.inetutils
+    pkgs.ipcalc
+    #pkgs.iputils
     pkgs.less
     pkgs.libfaketime
+    pkgs.ldns
+    #pkgs.ldns.examples
     #pkgs.mailutils
     pkgs.man
     pkgs.mdadm
     pkgs.gptfdisk
     pkgs.ncdu
     pkgs.ncurses
-    pkgs.nixops
+    #pkgs.nixops
     #pkgs.openssl
     pkgs.pass
     pkgs.procps
+    pkgs.rsync
     #pkgs.rxvt_unicode.terminfo
     #pkgs.sqlite
     pkgs.sqlite
-    pkgs.sudo
+    #pkgs.sudo
     pkgs.tig
     pkgs.time
     #pkgs.tmux
     pkgs.tree
     pkgs.utillinux
-    pkgs.vim
+    #pkgs.vim
     #pkgs.virtualbox
     pkgs.which
     pkgs.xdg_utils
-    pkgs.zfs
     pkgs.fio
     pkgs.strace
+    pkgs.utillinux
     #pkgs.zfstools
+    pkgs.linuxPackages.perf
+    #pkgs.go2nix
+    pkgs.wireguard
+    pkgs.stun
+    pkgs.mkpasswd
+    #pkgs.hydra-unstable
   ];
   #enableParallelBuilding = true;
-  shellHook = ''
-    echo >&2 "nix: running shellHook"
-
-    # nix
-    export NIX_PATH="nixpkgs=${nixpkgs}:nixpkgs-sourcephile=$PWD/.lib/nixpkgs-sourcephile"
-    #NIX_PATH+=":nixpkgs-overlays="$PWD"/install/overlays.nix"
-    #NIX_PATH+=""
 
-    # executables
-    PATH_NIX=$(dirname $(readlink -e ~/.nix-profile/bin/nix))
-    PATH_NIXOS=/run/wrappers/bin
-    PATH_FHS="$PWD"/.lib/nix/fhs-bin
-    PATH_FHS_VBOX="$PWD"/.lib/fhs-vbox-bin
-    export PATH="$PATH_NIXOS:$PATH_FHS_VBOX:$PATH_FHS:$PATH:$PATH_NIX"
-    ln -sfn ${sourcephile-nix-build}/bin "$PWD"/.bin
+  PASSWORD_STORE_DIR = "pass";
+  NIX_PATH = pkgs.lib.concatStringsSep ":" [
+    "nixpkgs=${pkgs.path}"
+    ("nixpkgs-overlays=" + pkgs.writeText "overlays.nix" ''
+      import ${inputs.self + "/nixpkgs/overlays.nix"} ++
+      import ${inputs.julm-nix + "/nixpkgs/overlays.nix"}
+    '')
+  ];
 
-    # nix.conf
-    export NIX_CONF_DIR="$PWD"/.config/nix
-    install -D /dev/stdin "$PWD"/.config/nix/nix.conf <<-EOF
-    auto-optimise-store = true
-    plugin-files        = ${pkgs.nix-plugins}/lib/nix/plugins/libnix-extra-builtins.so
-    extra-builtins-file = ${sourcephile-nix-build-modules.nix-plugins.extra-builtins}
-    EOF
+  shellHook = ''
+    echo >&2 "nix: running shellHook"
 
-    # NOTE: sudo needs to be own by root with the setuid bit,
-    # but this won't be the case for the sudo provided by Nix outside NixOS,
-    # hence the addition of $PATH_FHS in shellHook
-    # to provide the host system's sudo.
-    # WARNING: beware that sudo may reset the environment,
-    # and especially PATH, to some system's default.
+    # Since the .envrc calls this shellHook
+    # the EXIT trap cannot be freely used
+    # because it's already used by direnv,
+    # hence shred at startup, which is not ideal.
+    sourcephile-shred-tmp
 
-    # locales
-    export LANG=fr_FR.UTF-8
-    export LC_CTYPE=fr_FR.UTF-8
+    ${shell.nix-shell.shellHook}
 
-    # gnupg
-    export GNUPGHOME="$PWD"/../sec/gnupg
-    install -dm700 "$GNUPGHOME"
+    # gpg
     export GPG_TTY=$(tty)
-    gpgconf --launch gpg-agent
-    export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)
-
-    # password-store
-    export PASSWORD_STORE_DIR="$PWD"/../sec/pass
-
-    # openssl
-    export NIX_SSL_CERT_FILE="${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
-    export SSL_CERT_FILE="${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
-
-    # git
-    gitdir="$PWD"/.git
-    test ! -f "$gitdir" || while IFS=" :" read -r hdr gitdir; do [ "$hdr" != gitdir ] || break; done <"$gitdir"
-    ln -fnsr \
-     "$PWD"/.lib/git/hooks/prepare-commit-msg--longuest-common-prefix \
-     "$gitdir"/hooks/prepare-commit-msg
-
-    # nixops
-    #export NIXOPS_DEPLOYMENT="staging"
-    export NIXOPS_STATE="$PWD"/.sec/nixops/state.nixops
-    # Extend the Nix interpreter
-    # to enable builtins.extraBuiltins,
-    # which provides an unsafe exec useful to get secrets
-    # from the local password-store.
-    NIXOPS_OPTS+=" --show-trace"
-    NIXOPS_OPTS+=" --option plugin-files ${pkgs.nix-plugins}/lib/nix/plugins/libnix-extra-builtins.so"
-    NIXOPS_OPTS+=" --option extra-builtins-file ${sourcephile-nix-build-modules.nix-plugins.extra-builtins}"
-    export NIXOPS_OPTS
-
-    # disnix
-    #export DISNIXOS_USE_NIXOPS=1
-    #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
-    #export DISNIX_PROFILE=default
-    #export DISNIX_TARGET_PROPERTY=hostname
-    #export DYSNOMIA_STATEDIR="$PWD"/.sec/dysnomia
+    gpg-connect-agent updatestartuptty /bye >/dev/null
   '';
 }