Raphaël Numbus
79 lines
2.3 KiB
Nix
79 lines
2.3 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
cfg = config.numbus.services.clamav;
|
|
onAccessPaths = lib.mapAttrsToList (n: v: v.dataDir) (lib.filterAttrs (n: v:
|
|
v ? enable && v.enable && v ? dataDir && v.dataDir != false
|
|
) config.numbus.services);
|
|
in
|
|
|
|
{
|
|
options.numbus.services.clamav = {
|
|
enable = mkEnableOption "ClamAV open-source anti-virus software";
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
environment.systemPackages = [ pkgs.clamav pkgs.curl ];
|
|
|
|
security.sudo.extraRules = [{
|
|
users = [ "clamav" ];
|
|
commands = [{
|
|
command = "/run/current-system/sw/bin/systemctl start clamav-virus-notify.service";
|
|
options = [ "NOPASSWD" ];
|
|
}];
|
|
}];
|
|
|
|
services.clamav = {
|
|
updater.enable = true;
|
|
clamonacc.enable = true;
|
|
|
|
scanner = {
|
|
enable = true;
|
|
interval = "*-*-* 04:00:00"; # Everyday at 4am
|
|
scanDirectories = [
|
|
"/etc"
|
|
"/home"
|
|
"/var/lib"
|
|
"/var/tmp"
|
|
"/tmp"
|
|
];
|
|
};
|
|
|
|
daemon = {
|
|
enable = true;
|
|
settings = {
|
|
OnAccessPrevention = true;
|
|
OnAccessIncludePath = onAccessPaths;
|
|
VirusEvent = "echo 'CLAM_VIRUSEVENT_VIRUSNAME=\"%v\"\nCLAM_VIRUSEVENT_FILENAME=\"%f\"' > /var/lib/clamav/virus_event.env && /run/wrappers/bin/sudo /run/current-system/sw/bin/systemctl start clamav-virus-notify.service";
|
|
};
|
|
};
|
|
};
|
|
|
|
systemd.services.clamav-periodic-scan = mkIf (onAccessPaths != []) {
|
|
description = "ClamAV periodic scan of service data directories";
|
|
after = [ "clamav-daemon.service" ];
|
|
requires = [ "clamav-daemon.service" ];
|
|
onFailure = [ "clamav-virus-notify.service" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = "${pkgs.clamav}/bin/clamdscan --fdpass --multiscan ${lib.escapeShellArgs onAccessPaths}";
|
|
User = "clamav";
|
|
Group = "clamav";
|
|
SupplementaryGroups = [ "users" ];
|
|
TimeoutStartSec = "infinity";
|
|
};
|
|
};
|
|
|
|
systemd.timers.clamav-periodic-scan = mkIf (onAccessPaths != []) {
|
|
description = "Timer for ClamAV periodic scan";
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnCalendar = "*-1/2-01 04:00:00";
|
|
Persistent = true;
|
|
Unit = "clamav-periodic-scan.service";
|
|
};
|
|
};
|
|
};
|
|
} |