+{ inputs, pkgs, ... }:
let
- nixpkgs_channel = builtins.getEnv "nixpkgs_channel";
- # Bootstraping Nixpkgs to get tools to patch it.
- originNixpkgs = import (.config/nixpkgs-channel + ("/${nixpkgs_channel}.nix"));
- originPkgs = import originNixpkgs {
- config = {}; # Make the config pure, ignoring user's config.
- overlays = [];
- };
- remoteNixpkgsPatches = [
- { meta.description = "Dovecot plugin for Full Text Search (FTS) with Xapian";
- url = "https://github.com/NixOS/nixpkgs/pull/78780.diff";
- sha256 = "1h45qhbragp5ky6xix198qhadj1j7gd3qswa135mnmw1ijfczyry";
- }
- { meta.description = "dstat: fix pluginpath";
- url = "https://github.com/NixOS/nixpkgs/pull/80151.diff";
- sha256 = "0jjw2gvp7b7v2n2m2d6yj0gw711j6p9lyjf5ywp2y9ql6905qf4b";
- }
- { meta.description = "syncoid: fix PATH to let it use sudo";
- url = "https://github.com/NixOS/nixpkgs/pull/83901.diff";
- sha256 = "0q2dicmvl3h3hb9xdd870n5hf6lac489p000c7f1r6k70sh2id4l";
- }
- { meta.description = "sanoid: fix sanoid.conf generation";
- url = "https://github.com/NixOS/nixpkgs/pull/83904.diff";
- sha256 = "0lj4krmmbz82zpmbacw0qj2ywsx895bq4d1psjn753ymh7jjqj8k";
- }
- { meta.description = "nixos/public-inbox: init";
- url = "https://github.com/NixOS/nixpkgs/pull/77450.diff";
- sha256 = "13ikg7chpbf6rrg5sngbdb95q3awhdgl4g8vci42xmqyf208hzzd";
- }
- { meta.description = "stig: update to 0.11.0a";
- url = "https://github.com/NixOS/nixpkgs/pull/89557.diff";
- sha256 = "1gjx3kd2fh2l1pz1r0v2wgdyi7vfi0404aq80y2v89k6zinb7kpy";
- }
- ];
- localNixpkgsPatches = [
- ];
- # Build nixpkgs with some patches.
- nixpkgs = originPkgs.applyPatches {
- name = "nixpkgs-patched";
- src = originNixpkgs;
- patches = map originPkgs.fetchpatch remoteNixpkgsPatches ++ localNixpkgsPatches;
- postPatch = ''
- patch=$(printf '%s\n' ${builtins.concatStringsSep " "
- (map (p: p.sha256) remoteNixpkgsPatches ++ localNixpkgsPatches)} |
- sort | sha256sum | cut -c -7)
- echo "+patch-$patch" >.version-suffix
- '';
- };
- # Final pkgs with custom overlays.
- pkgs = import nixpkgs {
- config = {}; # Make the config pure, ignoring user's config.
- overlays = import nixpkgs/overlays.nix;
- };
-
- lib = pkgs.lib;
- nixos = pkgs.nixos {};
# Configuration of shell/modules/
# to expand shellHook and buildInputs of this shell.nix
- configuration = {config, ...}: {
+ shellConfig = {config, ...}: {
imports = [
+ shell/gnupg.nix
];
nix = {
nixConf = ''
auto-optimise-store = true
+ experimental-features nix-command flake
'';
};
- nix-plugins = {
- enable = true;
- };
gnupg = {
enable = true;
- gnupgHome = toString ../sec/gnupg;
- keys = import shell/openpgp.nix;
+ gnupgHome = "../sec/gnupg";
gpgExtraConf = ''
# julm@sourcephile.fr
trusted-key 0xB2450D97085B7B8C
'';
+ gpgAgentExtraConf = ''
+ #pretend-request-origin remote
+ #extra-socket ${toString ./.}/S.gpg-agent.extra
+ #log-file ${toString ./.}/gpg-agent.log
+ #no-grab
+ #debug-level expert
+ #allow-loopback-pinentry
+ '';
};
+ /*
openssl = {
enable = true;
- opensslHome = toString ../sec/openssl;
+ opensslHome = "../sec/openssl";
certificates = import shell/x509.nix;
};
+ */
openssh = {
enable = true;
sshConf = ''
Compression no
#CompressionLevel 4
ControlMaster auto
- ControlPath ${toString ../sec/ssh}/ssh-%h-%p-%r.socket
+ ControlPath .ssh-%h-%p-%r.socket
HashKnownHosts no
#SSAPIAuthentication no
SendEnv LANG LC_*
StrictHostKeyChecking yes
- UserKnownHostsFile ${toString ../sec/ssh/known_hosts}
+ UserKnownHostsFile ${inputs.secrets + "/ssh/known_hosts"}
'';
};
virtualbox = {
# Using modules enables to separate specific configurations
# from reusable code in shell/modules.nix and shell/modules/
# which may find its way in another git repository one day.
- modules =
- (import shell/modules.nix {
- inherit pkgs lib;
- modules = [ configuration ];
- }).config;
+ shell = (pkgs.lib.evalModules {
+ modules = [ shellConfig ] ++ map import (pkgs.lib.findFiles ".*\\.nix" (inputs.shell + "/modules"));
+ args = { inherit inputs pkgs; };
+ }).config;
pwd = toString (./. + "");
sourcephile-shred-tmp = pkgs.writeShellScriptBin "sourcephile-shred-tmp" ''
src = null;
#preferLocalBuild = true;
#allowSubstitutes = false;
- buildInputs = modules.nix-shell.buildInputs ++ [
+ buildInputs = shell.nix-shell.buildInputs ++ [
sourcephile-shred-tmp
- nixos.nixos-generate-config
- nixos.nixos-install
- nixos.nixos-enter
+ (pkgs.nixos []).nixos-generate-config
+ (pkgs.nixos []).nixos-install
+ (pkgs.nixos []).nixos-enter
#pkgs.binutils
pkgs.coreutils
pkgs.cryptsetup
#pkgs.virtualbox
pkgs.which
pkgs.xdg_utils
- pkgs.zfs
pkgs.fio
pkgs.strace
pkgs.utillinux
#pkgs.zfstools
+ pkgs.linuxPackages.perf
+ #pkgs.go2nix
+ pkgs.wireguard
+ pkgs.stun
+ pkgs.mkpasswd
+ #pkgs.hydra-unstable
];
#enableParallelBuilding = true;
+
+ PASSWORD_STORE_DIR = "pass";
+ NIX_PATH = pkgs.lib.concatStringsSep ":" [
+ "nixpkgs=${pkgs.path}"
+ ("nixpkgs-overlays=" + pkgs.writeText "overlays.nix" ''
+ import ${inputs.self + "/nixpkgs/overlays.nix"} ++
+ import ${inputs.julm-nix + "/nixpkgs/overlays.nix"}
+ '')
+ ];
+
shellHook = ''
echo >&2 "nix: running shellHook"
- # Nix
- PATH=$NIX_SHELL_PATH:$PATH
- export NIX_PATH="servers=$PWD/servers.nix:nixpkgs=${toString pkgs.path}:nixpkgs-overlays=$PWD/nixpkgs/overlays.nix"
-
# Since the .envrc calls this shellHook
# the EXIT trap cannot be freely used
# because it's already used by direnv,
# hence shred at startup, which is not ideal.
sourcephile-shred-tmp
- ${modules.nix-shell.shellHook}
-
- # password-store
- export PASSWORD_STORE_DIR="$PWD"/../sec/pass
+ ${shell.nix-shell.shellHook}
# gpg
export GPG_TTY=$(tty)