adds vanta daemon

6 files changed, 117 insertions, 2 deletions

diff --git a/login.nix b/modules/login.nix
index fa71428..b86c6bd 100644
--- a/login.nix
+++ b/modules/login.nix
@@ -42,7 +42,7 @@ in
 
   # Global
   environment.variables = let
-    apps = (import ./packages/sensible-apps/sensible-apps.nix).apps;
+    apps = (import ../packages/sensible-apps/sensible-apps.nix).apps;
   in
     {
       EDITOR = apps.EDITOR;
@@ -84,7 +84,7 @@ in
     getty = {
       autologinUser = "imsohexy";
       helpLine = "";
-      greetingLine = import ./modules/welcome-text.nix;
+      greetingLine = import ./welcome-text.nix;
     };
   };
 }
diff --git a/modules/vanta-daemon/.gitignore b/modules/vanta-daemon/.gitignore
new file mode 100644
index 0000000..2aa9ffc
--- /dev/null
+++ b/modules/vanta-daemon/.gitignore
@@ -0,0 +1 @@
+credentials.nix
diff --git a/modules/vanta-daemon/credentials.example.nix b/modules/vanta-daemon/credentials.example.nix
new file mode 100644
index 0000000..da7deb3
--- /dev/null
+++ b/modules/vanta-daemon/credentials.example.nix
@@ -0,0 +1,4 @@
+{
+  VANTA_KEY = "";
+  VANTA_OWNER_EMAIL = "";
+}
diff --git a/modules/vanta-daemon/default.nix b/modules/vanta-daemon/default.nix
new file mode 100644
index 0000000..76055e8
--- /dev/null
+++ b/modules/vanta-daemon/default.nix
@@ -0,0 +1,38 @@
+{ stdenv
+, fetchurl
+, dpkg
+, autoPatchelfHook
+, zlib
+}:
+let
+  version = "2.0.0";
+in
+stdenv.mkDerivation {
+  name = "vanta-daemon-${version}";
+
+  src = fetchurl {
+    url = "https://vanta-agent-repo.s3.amazonaws.com/targets/versions/${version}/vanta-amd64.deb";
+    sha256 = "0255is8psx808x99zna58nr3kf7j5vmydffchm5lbfz21qz09sal";
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    zlib
+    dpkg
+  ];
+
+  sourceRoot = ".";
+  unpackCmd = ''dpkg-deb -x "$src" .'';
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out
+    cp -a etc var $out
+    cp -a usr/share/ $out/
+    cp usr/lib/systemd/system/vanta.service $out/share/doc/vanta/
+
+    mkdir -p $out/bin/;
+    cp var/vanta/* $out/bin/
+  '';
+}
diff --git a/modules/vanta-daemon/module.nix b/modules/vanta-daemon/module.nix
new file mode 100644
index 0000000..251ac0d
--- /dev/null
+++ b/modules/vanta-daemon/module.nix
@@ -0,0 +1,56 @@
+{ config, pkgs, lib, ... }:
+with lib;
+
+let
+  cfg = config.services.vanta;
+in
+{
+  options.services.vanta = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = '' Vanta daemon service  '';
+    };
+
+    agentKey = mkOption {
+      type = types.str;
+    };
+
+    email = mkOption {
+      type = types.str;
+    };
+  };
+
+  config = mkIf cfg.enable (
+    let
+      vanta = pkgs.callPackage ./default.nix {};
+    in
+      {
+        environment.systemPackages = [ vanta ];
+
+        systemd.services.vanta =
+          {
+            after = [ "network.service" "syslog.service" ];
+            description = "Vanta monitoring software";
+            wantedBy = [ "multi-user.target" ];
+            preStart = ''
+              cp -a ${vanta}/var/vanta /var
+              sed \
+                -e 's/\("AGENT_KEY": "\)"/\1${cfg.agentKey}"/1' \
+                -e 's/\("OWNER_EMAIL": "\)"/\1${cfg.email}"/' \
+                ${vanta}/etc/vanta.conf > /etc/vanta.conf
+            '';
+            script = ''
+              /var/vanta/metalauncher
+            '';
+
+            serviceConfig = {
+              TimeoutStartSec = 0;
+              Restart = "on-failure";
+              KillMode = "control-group";
+              KillSignal = "SIGTERM";
+            };
+          };
+      }
+  );
+}
diff --git a/modules/work.nix b/modules/work.nix
new file mode 100644
index 0000000..383fc37
--- /dev/null
+++ b/modules/work.nix
@@ -0,0 +1,16 @@
+{ config, pkgs, ... }:
+let
+  vantaCreds = import ./vanta-daemon/credentials.nix;
+in
+{
+  imports = [
+    ./vanta-daemon/module.nix
+  ];
+
+  services.vanta =
+    {
+      enable = false;
+      agentKey = vantaCreds.VANTA_KEY;
+      email = vantaCreds.VANTA_OWNER_EMAIL;
+    };
+}