4 files changed, 99 insertions, 0 deletions
diff --git a/modules/vanta-daemon/.gitignore b/modules/vanta-daemon/.gitignore
new file mode 100644
index 0000000..2aa9ffc
--- /dev/null
+++ b/modules/vanta-daemon/.gitignore
@@ -0,0 +1 @@
+credentials.nix
diff --git a/modules/vanta-daemon/credentials.example.nix b/modules/vanta-daemon/credentials.example.nix
new file mode 100644
index 0000000..da7deb3
--- /dev/null
+++ b/modules/vanta-daemon/credentials.example.nix
@@ -0,0 +1,4 @@
+{
+  VANTA_KEY = "";
+  VANTA_OWNER_EMAIL = "";
+}
diff --git a/modules/vanta-daemon/default.nix b/modules/vanta-daemon/default.nix
new file mode 100644
index 0000000..76055e8
--- /dev/null
+++ b/modules/vanta-daemon/default.nix
@@ -0,0 +1,38 @@
+{ stdenv
+, fetchurl
+, dpkg
+, autoPatchelfHook
+, zlib
+}:
+let
+  version = "2.0.0";
+in
+stdenv.mkDerivation {
+  name = "vanta-daemon-${version}";
+
+  src = fetchurl {
+    url = "https://vanta-agent-repo.s3.amazonaws.com/targets/versions/${version}/vanta-amd64.deb";
+    sha256 = "0255is8psx808x99zna58nr3kf7j5vmydffchm5lbfz21qz09sal";
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    zlib
+    dpkg
+  ];
+
+  sourceRoot = ".";
+  unpackCmd = ''dpkg-deb -x "$src" .'';
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out
+    cp -a etc var $out
+    cp -a usr/share/ $out/
+    cp usr/lib/systemd/system/vanta.service $out/share/doc/vanta/
+
+    mkdir -p $out/bin/;
+    cp var/vanta/* $out/bin/
+  '';
+}
diff --git a/modules/vanta-daemon/module.nix b/modules/vanta-daemon/module.nix
new file mode 100644
index 0000000..251ac0d
--- /dev/null
+++ b/modules/vanta-daemon/module.nix
@@ -0,0 +1,56 @@
+{ config, pkgs, lib, ... }:
+with lib;
+
+let
+  cfg = config.services.vanta;
+in
+{
+  options.services.vanta = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = '' Vanta daemon service  '';
+    };
+
+    agentKey = mkOption {
+      type = types.str;
+    };
+
+    email = mkOption {
+      type = types.str;
+    };
+  };
+
+  config = mkIf cfg.enable (
+    let
+      vanta = pkgs.callPackage ./default.nix {};
+    in
+      {
+        environment.systemPackages = [ vanta ];
+
+        systemd.services.vanta =
+          {
+            after = [ "network.service" "syslog.service" ];
+            description = "Vanta monitoring software";
+            wantedBy = [ "multi-user.target" ];
+            preStart = ''
+              cp -a ${vanta}/var/vanta /var
+              sed \
+                -e 's/\("AGENT_KEY": "\)"/\1${cfg.agentKey}"/1' \
+                -e 's/\("OWNER_EMAIL": "\)"/\1${cfg.email}"/' \
+                ${vanta}/etc/vanta.conf > /etc/vanta.conf
+            '';
+            script = ''
+              /var/vanta/metalauncher
+            '';
+
+            serviceConfig = {
+              TimeoutStartSec = 0;
+              Restart = "on-failure";
+              KillMode = "control-group";
+              KillSignal = "SIGTERM";
+            };
+          };
+      }
+  );
+}