Add nessus-agent module

9 files changed, 165 insertions, 36 deletions

diff --git a/config/remind/.wyrdrc b/config/remind/.wyrdrc
index 18ccf10..4f14e4d 100644
--- a/config/remind/.wyrdrc
+++ b/config/remind/.wyrdrc
@@ -145,25 +145,25 @@ bind "<esc>"             entry_cancel
 
 
 # set up the colors
-color help               green magenta
+color help               black green
 color timed_default      white default
 color timed_current      white red
-color timed_reminder1    white magenta
+color timed_reminder1    black green
 color timed_reminder2    white red
 color timed_reminder3    white green
-color timed_reminder4    white magenta
+color timed_reminder4    black green
 color untimed_reminder   white default
 color timed_date         cyan default
-color selection_info     white magenta
+color selection_info     black green
 color description        white default
-color status             white magenta
+color status             black green
 
 color calendar_labels    white default
 color calendar_level1    white default
-color calendar_level2    magenta default
-color calendar_level3    magenta default
+color calendar_level2    green default
+color calendar_level3    green default
 color calendar_today     white red
 
-color left_divider       magenta default
-color right_divider      magenta default
+color left_divider       green default
+color right_divider      green default
 
diff --git a/modules/clamav.nix b/modules/clamav.nix
index 6640a83..fbfac11 100644
--- a/modules/clamav.nix
+++ b/modules/clamav.nix
@@ -1,17 +1,25 @@
-{ pkgs, ... }: {
+{ pkgs, ... }:
+let
+  enable = true;
+in {
   services.clamav = {
-    daemon.enable = true;
+    daemon = {
+      inherit enable;
+    };
     scanner = {
-      enable = true;
-      interval = "Sun *-*-* 12:00:00";
-      # scanDirectories = [
-      #   "/home"
-      #   "/var/lib"
-      #   "/tmp"
-      #   "/etc"
-      #   "/var/tmp"
-      # ];
+      inherit enable;
+      interval = "Sat *-*-* 11:00:00";
+      scanDirectories = [
+        "/home"
+        "/var/lib"
+        "/tmp"
+        "/etc"
+        "/var/tmp"
+      ];
+    };
+    updater = {
+      inherit enable;
+      frequency = 1;
     };
-    updater.enable = false;
   };
 }
diff --git a/modules/git.home.nix b/modules/git.home.nix
index e1ba8c9..602e745 100644
--- a/modules/git.home.nix
+++ b/modules/git.home.nix
@@ -52,6 +52,7 @@
       "ayak.sh"
       ".direnv"
       ".local.lua"
+      ".nvim.lua"
     ];
     aliases = {
       ignore = "!gi() { curl -sL https://www.toptal.com/developers/gitignore/api/$@ ;}; gi";
@@ -65,6 +66,8 @@
         navigate = true;
         side-by-side = true;
         line-numbers = true;
+        hyperlinks = true;
+        paging = "always";
       };
     };
     # difftastic = {
@@ -99,6 +102,10 @@
       # pager = {
       #   diff = "${pkgs.delta}/bin/delta --color-only";
       # };
+      diff.tool = "nvimdiff";
+      merge.tool = "nvimdiff";
+      difftool.prompt = false;
+      mergetool.prompt = false;
     };
     signing.key = "AAAB13AE8B82A5267C1A35D7E1B701723EA37849";
     signing.signByDefault = true;
diff --git a/modules/lockscreen.nix b/modules/lockscreen.nix
index 34214fa..df7588a 100644
--- a/modules/lockscreen.nix
+++ b/modules/lockscreen.nix
@@ -6,8 +6,8 @@ in {
 
   services.xserver.xautolock = {
     enable = true;
-    time = 15; # minutes
-    locker = "${localPkgs.bslock}/bin/bslock";
+    time = 30; # minutes
+    locker = "bslock";
 
     enableNotifier = true;
     notify = 30;
diff --git a/modules/login.nix b/modules/login.nix
index 13ca0a2..e4c24a0 100644
--- a/modules/login.nix
+++ b/modules/login.nix
@@ -53,17 +53,20 @@ in
   #'';
 
   # Global
-  environment.variables =
-    let
-      apps = (import ../packages/sensible-apps/sensible-apps.nix).apps;
-    in
-    {
-      EDITOR = apps.EDITOR;
-      VISUAL = apps.EDITOR;
-      TERMINAL = apps.TERMINAL;
-      BROWSER = apps.BROWSER;
-      PRIVATE_BROWSER = apps.PRIVATE_BROWSER;
-    };
+  environment.variables = let
+    apps = (import ../packages/sensible-apps/sensible-apps.nix).apps;
+  in {
+    EDITOR = apps.EDITOR;
+    VISUAL = apps.EDITOR;
+    TERMINAL = apps.TERMINAL;
+    BROWSER = apps.BROWSER;
+    PRIVATE_BROWSER = apps.PRIVATE_BROWSER;
+  };
+  environment.sessionVariables = rec {
+    XDG_BIN_HOME = "$HOME/.local/bin";
+    PATH = [ "$HOME/scripts/bin" XDG_BIN_HOME ];
+    LS_COLORS = "di=96:ln=36:or=31:mi=31:ex=32";
+  };
   environment.shells = with pkgs; [ zsh bashInteractive ];
   programs.zsh = {
     enable = true;
@@ -91,7 +94,6 @@ in
     ''
       case "$(tty)" in
         ${toString cases}
-        *) echo "Only tty for you, $(tty)" ;;
       esac;
     '';
   };
diff --git a/modules/nessus-daemon/default.nix b/modules/nessus-daemon/default.nix
new file mode 100644
index 0000000..57ec584
--- /dev/null
+++ b/modules/nessus-daemon/default.nix
@@ -0,0 +1,7 @@
+{ pkgs, ... }:
+{
+  imports = [ ./module.nix ];
+  environment.systemPackages = [
+    (pkgs.callPackage ./fhs.nix {})
+  ];
+}
diff --git a/modules/nessus-daemon/fhs.nix b/modules/nessus-daemon/fhs.nix
new file mode 100644
index 0000000..97f5016
--- /dev/null
+++ b/modules/nessus-daemon/fhs.nix
@@ -0,0 +1,59 @@
+{ pkgs ? import <nixpkgs> {}, ... }:
+let
+  debUrl = "https://www.tenable.com/downloads/api/v1/public/pages/nessus-agents/downloads/26786/download?i_agree_to_tenable_license_agreement=true";
+
+  setupNessusAgentDir = pkgs.writeShellScriptBin "setup-nessus-agent-dir" ''
+    set -eu -o pipefail
+    outdir=/opt/nessus_agent
+    if ! [ -f "$outdir/.installed" ]; then
+      echo "First install setup"
+      mkdir -p "$outdir"
+      cp -rf ${nessus-files}/nessus/* "$outdir"
+      chmod -R 755 "$outdir"
+      touch "$outdir/.installed"
+    fi
+  '';
+
+  nessus-files = pkgs.stdenv.mkDerivation {
+    pname = "nessus-files";
+    version = "11.0.2";
+    nativeBuildInputs = [ pkgs.dpkg ];
+    src = pkgs.fetchurl {
+      url = debUrl;
+      sha256 = "sha256-TlO7l50sqILcF/xga+RifvzptcSBk/PGqunhJYzUFYA=";
+    };
+    dontConfigure = true;
+    dontBuild = true;
+    unpackPhase = ''dpkg-deb -x $src .'';
+    installPhase = ''
+      mkdir -p $out/nessus
+      mv opt/nessus_agent/* $out/nessus
+    '';
+  };
+in
+pkgs.buildFHSEnv {
+  name = "nessus-agent-fhs";
+
+  targetPkgs = pkgs: with pkgs; [
+    coreutils
+    openssl_3
+    nettools
+    iproute2
+    procps
+    util-linux
+    glibc
+    zlib
+    sqlite
+  ];
+
+  profile = ''
+    export NESSUS_TZ_DIR=/etc/zoneinfo;
+    export PATH="$PATH:/opt/nessus_agent/bin:/opt/nessus_agent/sbin"
+  '';
+
+  runScript = ''bash -c '
+    echo "Starting service with args: $@";
+    ${setupNessusAgentDir}/bin/setup-nessus-agent-dir;
+    "$@";
+  ' -- '';
+}
diff --git a/modules/nessus-daemon/module.nix b/modules/nessus-daemon/module.nix
new file mode 100644
index 0000000..f33cf0c
--- /dev/null
+++ b/modules/nessus-daemon/module.nix
@@ -0,0 +1,38 @@
+{ config, lib, pkgs, ... }:
+with lib;
+let
+  cfg = config.services.nessus-agent;
+  nessus-agent-fhs = (pkgs.callPackage ./fhs.nix {});
+in {
+  options.services.nessus-agent = {
+    enable = mkEnableOption "nessus agent";
+    openFirewall = mkEnableOption "open firewall for nessus";
+    port = mkOption { type = types.int; default = 8834; };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.tmpfiles.rules = [
+      "d /opt/nessus_agent 0755 root root -"
+    ];
+
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+
+    systemd.services.nessus-agent = {
+      description = "Tenable Nessus Agent Service";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      path = [ pkgs.coreutils ];
+      serviceConfig = {
+        Type = "simple";
+        Restart = "on-abort";
+        User = "root";
+        Group = "root";
+        PIDFile = "/opt/nessus_agent/var/nessus/nessus-service.pid";
+        ExecStart = "${nessus-agent-fhs}/bin/nessus-agent-fhs /opt/nessus_agent/sbin/nessus-service -q --port ${toString cfg.port}";
+        ExecReload = "/usr/bin/pkill nessusd";
+        EnvironmentFile = "-/etc/sysconfig/nessusagent";
+        PrivateNetwork = false;
+      };
+    };
+  };
+}
diff --git a/modules/work.nix b/modules/work.nix
index 6e542df..e878e70 100644
--- a/modules/work.nix
+++ b/modules/work.nix
@@ -2,12 +2,20 @@
 {
   imports = [
     ./secfix/default.nix
+    ./nessus-daemon/default.nix
   ];
 
+  services.nessus-agent = {
+    enable = true;
+    openFirewall = true;
+  };
+
   services.tailscale = {
     enable = true;
     openFirewall = true;
   };
 
-  services.secfix.enable = true;
+  services.secfix = {
+    enable = true;
+  };
 }