48 lines
1.1 KiB
Nix
48 lines
1.1 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
inputs,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.custom.services.opensnitch;
|
|
in
|
|
{
|
|
options.custom.services.opensnitch = {
|
|
enable = lib.mkEnableOption "Enables opensnitch";
|
|
};
|
|
config = lib.mkIf cfg.enable {
|
|
environment.systemPackages = [ pkgs.opensnitch-ui ];
|
|
services.opensnitch = {
|
|
enable = true;
|
|
rules = {
|
|
systemd-timesyncd = {
|
|
name = "systemd-timesyncd";
|
|
enabled = true;
|
|
action = "allow";
|
|
duration = "always";
|
|
operator = {
|
|
type = "simple";
|
|
sensitive = false;
|
|
operand = "process.path";
|
|
data = "${lib.getBin pkgs.systemd}/lib/systemd/systemd-timesyncd";
|
|
};
|
|
};
|
|
systemd-resolved = {
|
|
name = "systemd-resolved";
|
|
enabled = true;
|
|
action = "allow";
|
|
duration = "always";
|
|
operator = {
|
|
type = "simple";
|
|
sensitive = false;
|
|
operand = "process.path";
|
|
data = "${lib.getBin pkgs.systemd}/lib/systemd/systemd-resolved";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|