+{ inputs, pkgs, shellHook ? "", ... }:
let
- nixpkgs = import .lib/nix/nixpkgs.nix;
- pkgs = import nixpkgs {
- config = {}; # Make the config pure, ignoring user's config.
- overlays = []; # Make the overlays pure, ignoring user's overlays.
+ # Configuration of shell/modules/
+ # to expand shellHook and buildInputs of this shell.nix
+ shellConfig = { ... }: {
+ imports = [
+ shell/gnupg.nix
+ ];
+ gnupg = {
+ enable = true;
+ gnupgHome = "../sec/gnupg";
+ gpgExtraConf = ''
+ # julm@sourcephile.fr
+ trusted-key 0xB2450D97085B7B8C
+ default-key 0x4FE467034C11017B429BAC53A58CD81C3863926F
+ '';
+ gpgAgentExtraConf = ''
+ #pretend-request-origin remote
+ #extra-socket ${toString ./.}/S.gpg-agent.extra
+ #log-file ${toString ./.}/gpg-agent.log
+ #no-grab
+ #debug-level expert
+ #allow-loopback-pinentry
+ '';
+ };
+ /*
+ openssl = {
+ enable = true;
+ opensslHome = "../sec/openssl";
+ certificates = import shell/x509.nix;
+ };
+ */
+ openssh = {
+ enable = true;
+ sshConf = ''
+ Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr
+ Compression no
+ #CompressionLevel 4
+ ControlMaster auto
+ ControlPath .ssh-%h-%p-%r.socket
+ HashKnownHosts no
+ #SSAPIAuthentication no
+ SendEnv LANG LC_*
+ StrictHostKeyChecking yes
+ #UserKnownHostsFile ''${inputs.secrets + "/ssh/known_hosts"}
+ '';
+ };
+ virtualbox = {
+ enable = false;
+ };
};
+
+ # Using modules enables to separate specific configurations
+ # from reusable code in shell/modules.nix and shell/modules/
+ # which may find its way in another git repository one day.
+ shell = (pkgs.lib.evalModules {
+ modules = [
+ shellConfig
+ { config._module.args = { inherit inputs pkgs; }; }
+ ] ++ map import (pkgs.lib.findFiles ".*\\.nix" shell/modules);
+ }).config;
in
-pkgs.stdenv.mkDerivation {
- name = "commonsoft-nix";
+pkgs.mkShell {
+ name = "sourcephile-nix";
src = null;
- buildInputs = [
- # Nix
- nixpkgs
-
- # Development
- pkgs.direnv
- pkgs.git
- pkgs.less
- pkgs.man
- pkgs.tig
- pkgs.vim
- #pkgs.tmux
- #pkgs.rxvt_unicode.terminfo
-
- # Building
- pkgs.coreutils
- pkgs.gnumake
+ #preferLocalBuild = true;
+ #allowSubstitutes = false;
+ buildInputs = shell.nix-shell.buildInputs ++ [
+ (pkgs.nixos [ ]).nixos-generate-config
+ (pkgs.nixos [ ]).nixos-install
+ (pkgs.nixos [ ]).nixos-enter
#pkgs.binutils
-
- # Adminsys
+ pkgs.coreutils
pkgs.cryptsetup
- pkgs.libfaketime
- pkgs.nixops
pkgs.curl
- (pkgs.glibcLocales.override {
- allLocales = false;
- locales = [
- "en_US.UTF-8/UTF-8"
- "fr_FR.UTF-8/UTF-8"
- ];
- })
+ #pkgs.direnv
+ pkgs.dnsutils
+ #pkgs.dropbear
+ pkgs.e2fsprogs
+ pkgs.git
+ pkgs.glibcLocales
+ pkgs.gnumake
pkgs.gnupg
- pkgs.pass
- #pkgs.sqlite
pkgs.htop
- pkgs.ncurses
+ #pkgs.inetutils
+ pkgs.ipcalc
+ #pkgs.iputils
+ pkgs.less
+ pkgs.libfaketime
+ pkgs.ldns
+ #pkgs.ldns.examples
+ #pkgs.mailutils
+ pkgs.man
+ pkgs.mdadm
+ pkgs.gptfdisk
pkgs.ncdu
+ pkgs.ncurses
+ #pkgs.nixops
+ #pkgs.openssl
+ pkgs.pass
pkgs.procps
- pkgs.sudo # NOTE: sudo needs to be own by root with the setuid bit,
- # but this won't be the case for the sudo provided by Nix outside NixOS,
- # hence the addition of $PATH_FHS in shellHook
- # to provide the host system's sudo.
- # WARNING: beware that sudo may reset the environment,
- # and especially PATH, to some system's default.
+ pkgs.rsync
+ #pkgs.rxvt_unicode.terminfo
+ #pkgs.sqlite
+ pkgs.sqlite
+ #pkgs.sudo
+ pkgs.tig
+ pkgs.time
+ #pkgs.tmux
pkgs.tree
pkgs.utillinux
+ #pkgs.vim
+ #pkgs.virtualbox
pkgs.which
- pkgs.xdg_utils
- #pkgs.openssl
- #pkgs.inetutils
- #pkgs.mailutils
- #pkgs.dnsutils
+ pkgs.xdg-utils
+ pkgs.fio
+ pkgs.strace
+ pkgs.utillinux
+ #pkgs.zfstools
+ pkgs.linuxPackages.perf
+ #pkgs.go2nix
+ pkgs.wireguard-tools
+ pkgs.stun
+ pkgs.mkpasswd
+ #pkgs.ubootTools
+ #pkgs.hydra-unstable
];
#enableParallelBuilding = true;
- shellHook = ''
- export NIX_PATH="nixpkgs=${nixpkgs}:nixpkgs-commonsoft=$PWD/lib/nixpkgs-commonsoft"
- #NIX_PATH+=":nixpkgs-overlays="$PWD"/install/overlays.nix"
- #NIX_PATH+=""
- # executables
- PATH_NIX=$(dirname $(readlink ~/.nix-profile/bin/nix))
- PATH_NIXOS=/run/wrappers/bin
- PATH_NIX_BUILD="$PWD"/result/bin
- PATH_FHS="$PWD"/.lib/fhs-bin
- export PATH="$PATH_NIX_BUILD:$PWD/bin:$PATH_NIXOS:$PATH_FHS:$PATH:$PATH_NIX"
+ NIX_PATH = pkgs.lib.concatStringsSep ":" [
+ "nixpkgs=${pkgs.path}"
+ ("nixpkgs-overlays=" + pkgs.writeText "overlays.nix" ''
+ import ${inputs.self + "/nixpkgs/overlays.nix"} ++
+ import ${inputs.julm-nix + "/nixpkgs/overlays.nix"}
+ '')
+ ];
+
+ shellHook = ''
+ echo >&2 "nix: running shellHook"
- # locales
- export LANG=fr_FR.UTF-8
- export LC_CTYPE=fr_FR.UTF-8
+ ${shell.nix-shell.shellHook}
# gpg
- gpgconf --launch gpg-agent
- export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)
+ export GNUPGHOME=$(realpath -e ${shell.gnupg.gnupgHome});
export GPG_TTY=$(tty)
- export GNUPGHOME="$PWD"/../sec/gnupg
-
- # password-store
- export PASSWORD_STORE_DIR="$PWD"/../sec/pass
-
+ gpg-connect-agent updatestartuptty /bye >/dev/null
- # nixops
- export NIXOPS_DEPLOYMENT="virtualbox"
- export NIXOPS_STATE="$PWD"/.var/nixops/state.db
- # Extend the Nix interpreter
- # to enable builtins.extraBuiltins,
- # which provides an unsafe exec useful to get secrets
- # from the local password-store.
- NIXOPS_OPTS+=" --show-trace"
- NIXOPS_OPTS+=" --option plugin-files $PWD/result/nix/plugins/libnix-extra-builtins.so"
- NIXOPS_OPTS+=" --option extra-builtins-file $PWD/result/nix/extra-builtins.nix"
- export NIXOPS_OPTS
-
- # disnix
- #export DISNIXOS_USE_NIXOPS=1
- #export DISNIX_CLIENT_INTERFACE=disnix-nixops-client
- #export DISNIX_PROFILE=default
- #export DISNIX_TARGET_PROPERTY=hostname
- #export DYSNOMIA_STATEDIR=var/dysnomia
- '';
+ # pass
+ export PASSWORD_STORE_DIR="$PWD"
+ '' + shellHook;
}
-