+{ inputs, pkgs, shellHook ? "", ... }:
let
- originNixpkgs = import .config/nixpkgs-channel/nixos-19.09-small.nix;
- originPkgs = import originNixpkgs {
- config = {}; # Make the config pure, ignoring user's config.
- overlays = [];
- };
- nixpkgsPatches = [
- { meta.description = "nsd : use types.lines where appropriate";
- url = "https://github.com/NixOS/nixpkgs/pull/78968.diff";
- sha256 = "11bqq1g1ax6i7xghihyhklmqpsq3njalardp6nvzphkjgxrypb47";
- }
- { meta.description = "shorewall: init at 5.2.3.3";
- url = "https://github.com/NixOS/nixpkgs/pull/46131.diff";
- sha256 = "0mfzlcr23ni5spnwksmmls50sw10alqbr5j6hjrwp9i30z0419yx";
- }
- { meta.description = "Dovecot plugin for Full Text Search (FTS) with Xapian";
- url = "https://github.com/NixOS/nixpkgs/pull/78780.diff";
- sha256 = "053md69ryybj27cp0xdfrza48zyzpblk6wvb2m2dbs9hm0gmcwc4";
- }
- ];
- nixpkgs = originPkgs.stdenv.mkDerivation {
- name = "nixpkgs-patched";
- src = originNixpkgs;
- phases = [ "unpackPhase" "patchPhase" ];
- patches = map originPkgs.fetchpatch nixpkgsPatches;
- postPatch = ''
- patch=$(printf '%s\n' ${builtins.concatStringsSep " " (map (p: p.sha256) nixpkgsPatches)} |
- sort | sha256sum | cut -c -7)
- mv $PWD $out
- echo "+patch-$patch" >$out/.version-suffix
- '';
- };
- pkgs = import nixpkgs {
- config = {}; # Make the config pure, ignoring user's config.
- overlays = import ./overlays.nix;
- };
-
-
- lib = pkgs.lib;
- nixos = pkgs.nixos {};
# Configuration of shell/modules/
- configuration = {config, ...}: {
+ # to expand shellHook and buildInputs of this shell.nix
+ shellConfig = { ... }: {
imports = [
+ shell/gnupg.nix
];
- nix = {
- nixConf = ''
- auto-optimise-store = true
- '';
- };
- nix-plugins = {
- enable = true;
- };
gnupg = {
enable = true;
- gnupgHome = toString ../sec/gnupg;
- keys = import shell/openpgp.nix;
+ gnupgHome = "../sec/gnupg";
+ gpgExtraConf = ''
+ # julm@sourcephile.fr
+ trusted-key 0xB2450D97085B7B8C
+ default-key 0x4FE467034C11017B429BAC53A58CD81C3863926F
+ '';
+ gpgAgentExtraConf = ''
+ #pretend-request-origin remote
+ #extra-socket ${toString ./.}/S.gpg-agent.extra
+ #log-file ${toString ./.}/gpg-agent.log
+ #no-grab
+ #debug-level expert
+ #allow-loopback-pinentry
+ '';
};
- openssl = {
+ /*
+ openssl = {
enable = true;
- opensslHome = toString ../sec/openssl;
+ opensslHome = "../sec/openssl";
certificates = import shell/x509.nix;
- };
+ };
+ */
openssh = {
- # WARNING: nixops uses its own ssh, not this one.
enable = true;
sshConf = ''
Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
Compression no
#CompressionLevel 4
ControlMaster auto
- ControlPath ${builtins.toString ../sec/ssh}/ssh-%h-%p-%r.socket
+ ControlPath .ssh-%h-%p-%r.socket
HashKnownHosts no
#SSAPIAuthentication no
SendEnv LANG LC_*
StrictHostKeyChecking yes
- UserKnownHostsFile ${builtins.toString ../sec/ssh/known_hosts}
+ #UserKnownHostsFile ''${inputs.secrets + "/ssh/known_hosts"}
'';
};
virtualbox = {
- enable = true;
+ enable = false;
};
};
# Using modules enables to separate specific configurations
# from reusable code in shell/modules.nix and shell/modules/
# which may find its way in another git repository one day.
- modules =
- (import shell/modules.nix {
- inherit pkgs lib;
- modules = [ configuration ];
- }).config;
+ shell = (pkgs.lib.evalModules {
+ modules = [
+ shellConfig
+ { config._module.args = { inherit inputs pkgs; }; }
+ ] ++ map import (pkgs.lib.findFiles ".*\\.nix" shell/modules);
+ }).config;
in
pkgs.mkShell {
name = "sourcephile-nix";
src = null;
#preferLocalBuild = true;
#allowSubstitutes = false;
- buildInputs = modules.nix-shell.buildInputs ++ [
- nixpkgs
- nixos.nixos-generate-config
- nixos.nixos-install
- nixos.nixos-enter
+ buildInputs = shell.nix-shell.buildInputs ++ [
+ (pkgs.nixos [ ]).nixos-generate-config
+ (pkgs.nixos [ ]).nixos-install
+ (pkgs.nixos [ ]).nixos-enter
#pkgs.binutils
pkgs.coreutils
pkgs.cryptsetup
pkgs.gptfdisk
pkgs.ncdu
pkgs.ncurses
- pkgs.nixops
+ #pkgs.nixops
#pkgs.openssl
pkgs.pass
pkgs.procps
#pkgs.vim
#pkgs.virtualbox
pkgs.which
- pkgs.xdg_utils
- pkgs.zfs
+ pkgs.xdg-utils
pkgs.fio
pkgs.strace
pkgs.utillinux
#pkgs.zfstools
+ pkgs.linuxPackages.perf
+ #pkgs.go2nix
+ pkgs.wireguard-tools
+ pkgs.stun
+ pkgs.mkpasswd
+ #pkgs.ubootTools
+ #pkgs.hydra-unstable
];
#enableParallelBuilding = true;
- shellHook = ''
- echo >&2 "nix: running shellHook"
- # WARNING: beware that sudo may reset the environment,
- # and especially PATH, to some system's default.
-
- NIX_SHELL_PATH=$PATH
- unset __ETC_PROFILE_SOURCED
- unset __NIXOS_SET_ENVIRONMENT_DONE
- test ! -e /etc/profile || . /etc/profile
- test ! -e ~/.profile || . ~/.profile
-
- # nix
- test ! -e ~/.nix-profile/etc/profile.d/nix.sh ||
- . ~/.nix-profile/etc/profile.d/nix.sh
-
- # home-manager
- unset __HM_SESS_VARS_SOURCED
- test ! -e ~/.nix-profile/etc/profile.d/hm-session-vars.sh ||
- . ~/.nix-profile/etc/profile.d/hm-session-vars.sh
-
- PATH=$NIX_SHELL_PATH:$PATH
- export NIX_PATH="nixpkgs=${pkgs.path}:nixpkgs-overlays="$PWD"/overlays"
- # Cleanup "../sec/tmp/"
- # This is done when exiting the nix-shell
- # (or when… entering the directory with direnv
- # which spawns a nix-shell just to get the env).
- trap "cd '$PWD' && find ../sec/tmp -type f -exec shred -fu {} +" EXIT
-
- ${modules.nix-shell.shellHook}
+ NIX_PATH = pkgs.lib.concatStringsSep ":" [
+ "nixpkgs=${pkgs.path}"
+ ("nixpkgs-overlays=" + pkgs.writeText "overlays.nix" ''
+ import ${inputs.self + "/nixpkgs/overlays.nix"} ++
+ import ${inputs.julm-nix + "/nixpkgs/overlays.nix"}
+ '')
+ ];
- # locales
- export LANG=fr_FR.UTF-8
- export LC_CTYPE=fr_FR.UTF-8
+ shellHook = ''
+ echo >&2 "nix: running shellHook"
- # password-store
- export PASSWORD_STORE_DIR="$PWD"/../sec/pass
+ ${shell.nix-shell.shellHook}
# gpg
+ export GNUPGHOME=$(realpath -e ${shell.gnupg.gnupgHome});
export GPG_TTY=$(tty)
gpg-connect-agent updatestartuptty /bye >/dev/null
- # git
- gitdir="$PWD"/.git
- test ! -f "$gitdir" || while IFS=" :" read -r hdr gitdir; do [ "$hdr" != gitdir ] || break; done <"$gitdir"
- ln -fnsr \
- "$PWD"/.lib/git/hooks/prepare-commit-msg--longuest-common-prefix \
- "$gitdir"/hooks/prepare-commit-msg
-
- # nixops
- #export NIXOPS_DEPLOYMENT="staging"
- export NIXOPS_STATE="$PWD"/../sec/nixops/state.nixops
- NIXOPS_OPTS+=" --show-trace"
- export NIXOPS_OPTS
-
- # disnix
- #export DISNIXOS_USE_NIXOPS=1
- #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
- #export DISNIX_PROFILE=default
- #export DISNIX_TARGET_PROPERTY=hostname
- #export DYSNOMIA_STATEDIR="$PWD"/../sec/dysnomia
- '';
+ # pass
+ export PASSWORD_STORE_DIR="$PWD"
+ '' + shellHook;
}
sourcephile / git / sourcephile-nix.git / blobdiff