diff options
Diffstat (limited to 'modules/secfix')
| -rw-r--r-- | modules/secfix/.gitignore | 1 | ||||
| -rw-r--r-- | modules/secfix/default.nix | 58 |
2 files changed, 59 insertions, 0 deletions
diff --git a/modules/secfix/.gitignore b/modules/secfix/.gitignore new file mode 100644 index 0000000..c00df13 --- /dev/null +++ b/modules/secfix/.gitignore @@ -0,0 +1 @@ +*.deb diff --git a/modules/secfix/default.nix b/modules/secfix/default.nix new file mode 100644 index 0000000..0fef70a --- /dev/null +++ b/modules/secfix/default.nix @@ -0,0 +1,58 @@ +{ config , lib , pkgs , ... }: +let + secfix-agent = pkgs.stdenv.mkDerivation { + pname = "secfix-agent"; + version = "1.0.0"; + + src = ./secfix.linux-systemd-deb.deb; + + nativeBuildInputs = with pkgs; [ autoPatchelfHook zlib dpkg ]; + + sourceRoot = "."; + unpackCmd = ''dpkg-deb -x "$src" .''; + + dontBuild = true; + installPhase = '' + mkdir -p $out/; + cp -r ./* $out/; + sed -i \ + -e "s|/var/|$out/var/|" \ + -e "s|/etc/|$out/etc/|" \ + -e "s|/usr/|$out/usr/|" \ + $out/etc/secfix/launcher.flags; + ''; + }; +in + +{ + options.services.secfix = { + enable = lib.mkOption { + type = lib.types.bool; + default = false; + description = ''Secfix agent''; + }; + }; + + config = let + cfg = config.services.secfix; + in + lib.mkIf cfg.enable { + environment.systemPackages = [ secfix-agent ]; + + systemd.services.secfix = { + unitConfig = { + Description = "The Kolide Launcher"; + After = "network.service syslog.service"; + }; + + serviceConfig = { + ExecStart = + "${secfix-agent}/usr/local/secfix/bin/launcher -config ${secfix-agent}/etc/secfix/launcher.flags --root_directory /var/run/secfix/"; + Restart = "on-failure"; + RestartSec = 3; + }; + + wantedBy = ["multi-user.target"]; + }; + }; +} |