diff options
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/clamav.nix | 32 | ||||
| -rw-r--r-- | modules/git.home.nix | 7 | ||||
| -rw-r--r-- | modules/lockscreen.nix | 4 | ||||
| -rw-r--r-- | modules/login.nix | 26 | ||||
| -rw-r--r-- | modules/nessus-daemon/default.nix | 7 | ||||
| -rw-r--r-- | modules/nessus-daemon/fhs.nix | 59 | ||||
| -rw-r--r-- | modules/nessus-daemon/module.nix | 38 | ||||
| -rw-r--r-- | modules/work.nix | 10 |
8 files changed, 156 insertions, 27 deletions
diff --git a/modules/clamav.nix b/modules/clamav.nix index 6640a83..fbfac11 100644 --- a/modules/clamav.nix +++ b/modules/clamav.nix @@ -1,17 +1,25 @@ -{ pkgs, ... }: { +{ pkgs, ... }: +let + enable = true; +in { services.clamav = { - daemon.enable = true; + daemon = { + inherit enable; + }; scanner = { - enable = true; - interval = "Sun *-*-* 12:00:00"; - # scanDirectories = [ - # "/home" - # "/var/lib" - # "/tmp" - # "/etc" - # "/var/tmp" - # ]; + inherit enable; + interval = "Sat *-*-* 11:00:00"; + scanDirectories = [ + "/home" + "/var/lib" + "/tmp" + "/etc" + "/var/tmp" + ]; + }; + updater = { + inherit enable; + frequency = 1; }; - updater.enable = false; }; } diff --git a/modules/git.home.nix b/modules/git.home.nix index e1ba8c9..602e745 100644 --- a/modules/git.home.nix +++ b/modules/git.home.nix @@ -52,6 +52,7 @@ "ayak.sh" ".direnv" ".local.lua" + ".nvim.lua" ]; aliases = { ignore = "!gi() { curl -sL https://www.toptal.com/developers/gitignore/api/$@ ;}; gi"; @@ -65,6 +66,8 @@ navigate = true; side-by-side = true; line-numbers = true; + hyperlinks = true; + paging = "always"; }; }; # difftastic = { @@ -99,6 +102,10 @@ # pager = { # diff = "${pkgs.delta}/bin/delta --color-only"; # }; + diff.tool = "nvimdiff"; + merge.tool = "nvimdiff"; + difftool.prompt = false; + mergetool.prompt = false; }; signing.key = "AAAB13AE8B82A5267C1A35D7E1B701723EA37849"; signing.signByDefault = true; diff --git a/modules/lockscreen.nix b/modules/lockscreen.nix index 34214fa..df7588a 100644 --- a/modules/lockscreen.nix +++ b/modules/lockscreen.nix @@ -6,8 +6,8 @@ in { services.xserver.xautolock = { enable = true; - time = 15; # minutes - locker = "${localPkgs.bslock}/bin/bslock"; + time = 30; # minutes + locker = "bslock"; enableNotifier = true; notify = 30; diff --git a/modules/login.nix b/modules/login.nix index 13ca0a2..e4c24a0 100644 --- a/modules/login.nix +++ b/modules/login.nix @@ -53,17 +53,20 @@ in #''; # Global - environment.variables = - let - apps = (import ../packages/sensible-apps/sensible-apps.nix).apps; - in - { - EDITOR = apps.EDITOR; - VISUAL = apps.EDITOR; - TERMINAL = apps.TERMINAL; - BROWSER = apps.BROWSER; - PRIVATE_BROWSER = apps.PRIVATE_BROWSER; - }; + environment.variables = let + apps = (import ../packages/sensible-apps/sensible-apps.nix).apps; + in { + EDITOR = apps.EDITOR; + VISUAL = apps.EDITOR; + TERMINAL = apps.TERMINAL; + BROWSER = apps.BROWSER; + PRIVATE_BROWSER = apps.PRIVATE_BROWSER; + }; + environment.sessionVariables = rec { + XDG_BIN_HOME = "$HOME/.local/bin"; + PATH = [ "$HOME/scripts/bin" XDG_BIN_HOME ]; + LS_COLORS = "di=96:ln=36:or=31:mi=31:ex=32"; + }; environment.shells = with pkgs; [ zsh bashInteractive ]; programs.zsh = { enable = true; @@ -91,7 +94,6 @@ in '' case "$(tty)" in ${toString cases} - *) echo "Only tty for you, $(tty)" ;; esac; ''; }; diff --git a/modules/nessus-daemon/default.nix b/modules/nessus-daemon/default.nix new file mode 100644 index 0000000..57ec584 --- /dev/null +++ b/modules/nessus-daemon/default.nix @@ -0,0 +1,7 @@ +{ pkgs, ... }: +{ + imports = [ ./module.nix ]; + environment.systemPackages = [ + (pkgs.callPackage ./fhs.nix {}) + ]; +} diff --git a/modules/nessus-daemon/fhs.nix b/modules/nessus-daemon/fhs.nix new file mode 100644 index 0000000..97f5016 --- /dev/null +++ b/modules/nessus-daemon/fhs.nix @@ -0,0 +1,59 @@ +{ pkgs ? import <nixpkgs> {}, ... }: +let + debUrl = "https://www.tenable.com/downloads/api/v1/public/pages/nessus-agents/downloads/26786/download?i_agree_to_tenable_license_agreement=true"; + + setupNessusAgentDir = pkgs.writeShellScriptBin "setup-nessus-agent-dir" '' + set -eu -o pipefail + outdir=/opt/nessus_agent + if ! [ -f "$outdir/.installed" ]; then + echo "First install setup" + mkdir -p "$outdir" + cp -rf ${nessus-files}/nessus/* "$outdir" + chmod -R 755 "$outdir" + touch "$outdir/.installed" + fi + ''; + + nessus-files = pkgs.stdenv.mkDerivation { + pname = "nessus-files"; + version = "11.0.2"; + nativeBuildInputs = [ pkgs.dpkg ]; + src = pkgs.fetchurl { + url = debUrl; + sha256 = "sha256-TlO7l50sqILcF/xga+RifvzptcSBk/PGqunhJYzUFYA="; + }; + dontConfigure = true; + dontBuild = true; + unpackPhase = ''dpkg-deb -x $src .''; + installPhase = '' + mkdir -p $out/nessus + mv opt/nessus_agent/* $out/nessus + ''; + }; +in +pkgs.buildFHSEnv { + name = "nessus-agent-fhs"; + + targetPkgs = pkgs: with pkgs; [ + coreutils + openssl_3 + nettools + iproute2 + procps + util-linux + glibc + zlib + sqlite + ]; + + profile = '' + export NESSUS_TZ_DIR=/etc/zoneinfo; + export PATH="$PATH:/opt/nessus_agent/bin:/opt/nessus_agent/sbin" + ''; + + runScript = ''bash -c ' + echo "Starting service with args: $@"; + ${setupNessusAgentDir}/bin/setup-nessus-agent-dir; + "$@"; + ' -- ''; +} diff --git a/modules/nessus-daemon/module.nix b/modules/nessus-daemon/module.nix new file mode 100644 index 0000000..f33cf0c --- /dev/null +++ b/modules/nessus-daemon/module.nix @@ -0,0 +1,38 @@ +{ config, lib, pkgs, ... }: +with lib; +let + cfg = config.services.nessus-agent; + nessus-agent-fhs = (pkgs.callPackage ./fhs.nix {}); +in { + options.services.nessus-agent = { + enable = mkEnableOption "nessus agent"; + openFirewall = mkEnableOption "open firewall for nessus"; + port = mkOption { type = types.int; default = 8834; }; + }; + + config = mkIf cfg.enable { + systemd.tmpfiles.rules = [ + "d /opt/nessus_agent 0755 root root -" + ]; + + networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ]; + + systemd.services.nessus-agent = { + description = "Tenable Nessus Agent Service"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + path = [ pkgs.coreutils ]; + serviceConfig = { + Type = "simple"; + Restart = "on-abort"; + User = "root"; + Group = "root"; + PIDFile = "/opt/nessus_agent/var/nessus/nessus-service.pid"; + ExecStart = "${nessus-agent-fhs}/bin/nessus-agent-fhs /opt/nessus_agent/sbin/nessus-service -q --port ${toString cfg.port}"; + ExecReload = "/usr/bin/pkill nessusd"; + EnvironmentFile = "-/etc/sysconfig/nessusagent"; + PrivateNetwork = false; + }; + }; + }; +} diff --git a/modules/work.nix b/modules/work.nix index 6e542df..e878e70 100644 --- a/modules/work.nix +++ b/modules/work.nix @@ -2,12 +2,20 @@ { imports = [ ./secfix/default.nix + ./nessus-daemon/default.nix ]; + services.nessus-agent = { + enable = true; + openFirewall = true; + }; + services.tailscale = { enable = true; openFirewall = true; }; - services.secfix.enable = true; + services.secfix = { + enable = true; + }; } |