nix/shell.nix

# shell.nix
let
  lock = (builtins.fromJSON (builtins.readFile ./flake.lock)).nodes.nixpkgs.locked;
  sops-nix = builtins.fetchTarball {
    url = "https://github.com/Mic92/sops-nix/archive/master.tar.gz";
    sha256 = "";
  };
in
# A nixpkgs instance that is grabbed from the pinned nixpkgs commit in the lock file
# Useful to avoid using channels when using legacy nix commands
{ pkgs ? (import ./lib/nixpkgs.nix) { } }: {
  default = pkgs.mkShell {
    NIX_CONFIG = "experimental-features = nix-command flakes";
    # imports all files ending in .asc/.gpg
    sopsPGPKeyDirs = [ 
      "${toString ./.}/keys/hosts"
      "${toString ./.}/keys/users"
    ];
    nativeBuildInputs = [
      pkgs.nix
      pkgs.home-manager
      pkgs.git
      (pkgs.callPackage sops-nix {}).sops-import-keys-hook
    ];
  };
}