@@ -3,22 +3,123 @@
33with lib;
44
55let
6− name = "opensnitch";
76 cfg = config.services.opensnitch;
7+ format = pkgs.formats.json {};
88in {
99 options = {
1010 services.opensnitch = {
1111 enable = mkEnableOption "Opensnitch application firewall";
12+ settings = mkOption {
13+ type = types.submodule {
14+ freeformType = format.type;
15+
16+ options = {
17+ Server = {
18+
19+ Address = mkOption {
20+ type = types.str;
21+ description = ''
22+ Unix socket path (unix:///tmp/osui.sock, the "unix:///" part is
23+ mandatory) or TCP socket (192.168.1.100:50051).
24+ '';
25+ };
26+
27+ LogFile = mkOption {
28+ type = types.path;
29+ description = ''
30+ File to write logs to (use /dev/stdout to write logs to standard
31+ output).
32+ '';
33+ };
34+
35+ };
36+
37+ DefaultAction = mkOption {
38+ type = types.enum [ "allow" "deny" ];
39+ description = ''
40+ Default action whether to block or allow application internet
41+ access.
42+ '';
43+ };
44+
45+ DefaultDuration = mkOption {
46+ type = types.enum [
47+ "once" "always" "until restart" "30s" "5m" "15m" "30m" "1h"
48+ ];
49+ description = ''
50+ Default duration of firewall rule.
51+ '';
52+ };
53+
54+ InterceptUnknown = mkOption {
55+ type = types.bool;
56+ description = ''
57+ Wheter to intercept spare connections.
58+ '';
59+ };
60+
61+ ProcMonitorMethod = mkOption {
62+ type = types.enum [ "ebpf" "proc" "ftrace" "audit" ];
63+ description = ''
64+ Which process monitoring method to use.
65+ '';
66+ };
67+
68+ LogLevel = mkOption {
69+ type = types.enum [ 0 1 2 3 4 ];
70+ description = ''
71+ Default log level from 0 to 4 (debug, info, important, warning,
72+ error).
73+ '';
74+ };
75+
76+ Firewall = mkOption {
77+ type = types.enum [ "iptables" "nftables" ];
78+ description = ''
79+ Which firewall backend to use.
80+ '';
81+ };
82+
83+ Stats = {
84+
85+ MaxEvents = mkOption {
86+ type = types.int;
87+ description = ''
88+ Max events to send to the GUI.
89+ '';
90+ };
91+
92+ MaxStats = mkOption {
93+ type = types.int;
94+ description = ''
95+ Max stats per item to keep in backlog.
96+ '';
97+ };
98+
99+ };
100+ };
101+ };
102+ description = ''
103+ opensnitchd configuration. Refer to
104+ <link xlink:href="https://github.com/evilsocket/opensnitch/wiki/Configurations"/>
105+ for details on supported values.
106+ '';
107+ };
12108 };
13109 };
14110
15111 config = mkIf cfg.enable {
16112
113+ # pkg.opensnitch is referred to elsewhere in the module so we don't need to worry about it being garbage collected
114+ services.opensnitch.settings = mapAttrs (_: v: mkDefault v) (builtins.fromJSON (builtins.unsafeDiscardStringContext (builtins.readFile "${pkgs.opensnitch}/etc/default-config.json")));
115+
17116 systemd = {
18117 packages = [ pkgs.opensnitch ];
19118 services.opensnitchd.wantedBy = [ "multi-user.target" ];
20119 };
21120
121+ environment.etc."opensnitchd/default-config.json".source = format.generate "default-config.json" cfg.settings;
122+
22123 };
23124}
24125