feat(nix): Update tooling

.envrc

@@ -0,0 +1 @@
+use nix

.gitignore

@@ -16,3 +16,4 @@ pyrightconfig.json
 *.sqlite3
 
 .vscode
+.direnv

01-authens.patch

@@ -0,0 +1,11 @@
+diff --git a/authens/utils.py b/authens/utils.py
+index 7306506..36063b6 100644
+--- a/authens/utils.py
++++ b/authens/utils.py
+@@ -16,7 +16,7 @@ def get_cas_client(request):
+         service_url=urlunparse(
+             (request.scheme, request.get_host(), request.path, "", "", "")
+         ),
+-        server_url="https://cas.eleves.ens.fr/",
++        server_url="https://cas-eleves.dgnum.eu/",
+     )

default.nix

@@ -0,0 +1,64 @@
+{
+  sources ? import ./npins,
+  pkgs ? import sources.nixpkgs { },
+}:
+
+let
+  nix-pkgs = import sources.nix-pkgs { inherit pkgs; };
+
+  python3 = pkgs.python3.override {
+    packageOverrides = _: _: {
+      inherit (nix-pkgs)
+        django-background-tasks
+        django-browser-reload
+        django-bulma-forms
+        django-translated-fields
+        loadcredential
+        ;
+
+      authens = nix-pkgs.authens.overridePythonAttrs (old: {
+        patches = [ ./01-authens.patch ];
+      });
+    };
+  };
+in
+
+{
+  devShell = pkgs.mkShell {
+    name = "cas-eleves.dev";
+
+    packages = [
+      (python3.withPackages (ps: [
+        ps.django
+        ps.ipython
+
+        ps.markdown
+        ps.numpy
+        ps.networkx
+
+        ps.authens
+        ps.django-background-tasks
+        ps.django-browser-reload
+        ps.django-bulma-forms
+        ps.django-debug-toolbar
+        ps.django-translated-fields
+        ps.loadcredential
+      ]))
+
+      pkgs.gettext
+      pkgs.gtranslator
+    ];
+
+    env = {
+      CREDENTIALS_DIRECTORY = builtins.toString ./.credentials;
+      CE_DEBUG = true;
+      CE_STATIC_ROOT = builtins.toString ./.static;
+    };
+
+    shellHook = ''
+      if [ ! -d .static ]; then
+        mkdir .static
+      fi
+    '';
+  };
+}

npins/default.nix

@@ -0,0 +1,80 @@
+# Generated by npins. Do not modify; will be overwritten regularly
+let
+  data = builtins.fromJSON (builtins.readFile ./sources.json);
+  version = data.version;
+
+  mkSource =
+    spec:
+    assert spec ? type;
+    let
+      path =
+        if spec.type == "Git" then
+          mkGitSource spec
+        else if spec.type == "GitRelease" then
+          mkGitSource spec
+        else if spec.type == "PyPi" then
+          mkPyPiSource spec
+        else if spec.type == "Channel" then
+          mkChannelSource spec
+        else
+          builtins.throw "Unknown source type ${spec.type}";
+    in
+    spec // { outPath = path; };
+
+  mkGitSource =
+    {
+      repository,
+      revision,
+      url ? null,
+      hash,
+      branch ? null,
+      ...
+    }:
+    assert repository ? type;
+    # At the moment, either it is a plain git repository (which has an url), or it is a GitHub/GitLab repository
+    # In the latter case, there we will always be an url to the tarball
+    if url != null then
+      (builtins.fetchTarball {
+        inherit url;
+        sha256 = hash;
+      })
+    else
+      assert repository.type == "Git";
+      let
+        urlToName =
+          url: rev:
+          let
+            matched = builtins.match "^.*/([^/]*)(\\.git)?$" repository.url;
+
+            short = builtins.substring 0 7 rev;
+
+            appendShort = if (builtins.match "[a-f0-9]*" rev) != null then "-${short}" else "";
+          in
+          "${if matched == null then "source" else builtins.head matched}${appendShort}";
+        name = urlToName repository.url revision;
+      in
+      builtins.fetchGit {
+        url = repository.url;
+        rev = revision;
+        inherit name;
+        narHash = hash;
+      };
+
+  mkPyPiSource =
+    { url, hash, ... }:
+    builtins.fetchurl {
+      inherit url;
+      sha256 = hash;
+    };
+
+  mkChannelSource =
+    { url, hash, ... }:
+    builtins.fetchTarball {
+      inherit url;
+      sha256 = hash;
+    };
+in
+if version == 4 then
+  builtins.mapAttrs (_: mkSource) data.pins
+else
+  throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`"

npins/sources.json

@@ -0,0 +1,22 @@
+{
+  "pins": {
+    "nix-pkgs": {
+      "type": "Git",
+      "repository": {
+        "type": "Git",
+        "url": "https://git.hubrecht.ovh/hubrecht/nix-pkgs.git"
+      },
+      "branch": "main",
+      "revision": "46879d052e4a694ceb3027dbcff641c44e0ae1bd",
+      "url": null,
+      "hash": "sha256-/Yn3NDYA76bv8x06jahLAJ2z54L0vFeAtQKzyW3MfGA="
+    },
+    "nixpkgs": {
+      "type": "Channel",
+      "name": "nixpkgs-unstable",
+      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-24.11pre646460.0aeab749216e/nixexprs.tar.xz",
+      "hash": "0xa73bs0n28x731hf6ipqrlji0p3qf2a42vfm6g8snnhaab9mfwj"
+    }
+  },
+  "version": 4
+}

shell.nix

@@ -1,22 +1 @@
-let
+(import ./. { }).devShell
-  mach-nix = import
-    (builtins.fetchGit {
-      url = "https://github.com/DavHau/mach-nix";
-      ref = "refs/tags/3.5.0";
-    })
-    { };
-
-  requirements = builtins.readFile ./requirements.txt;
-
-  requirements-dev = ''
-    django-debug-toolbar
-    ipython
-    black
-    isort
-    flake8
-  '';
-in
-
-mach-nix.mkPythonShell {
-  requirements = requirements + requirements-dev;
-}