Many changes, see full commit

Add clamav pkg with new nixos module clamav.nix Add some extraHosts for testing Tweak xserver dpi Set environment vars for scaling, along with dpi Change protonvpn-gui to proton-vpn Add many new pkgs, bc, pstere, tmux, wget ,gnupg, mosh, openvpn, clamav, conntrack-tools, kdotool, trash-cli, bat, psmisc, mupdf, signal-cli, exfat, fprintd Enable power-profiles-daemon environment.localBinInPath = true Add full .bashrc
2026-07-27 15:12:02 +02:00 · 2026-07-27 15:12:02 +02:00 · 3fe1eacc75
commit 3fe1eacc75
parent bb6d3eb92d
5 changed files with 477 additions and 25 deletions
--- a/modules/nixos/clamav.nix
+++ b/modules/nixos/clamav.nix
@ -0,0 +1,168 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  services.clamav = {
+    daemon = {
+      enable = true;
+
+      settings = {
+        MaxThreads = 24;
+        MaxQueue = 48;
+        MaxFileSize = "100M";
+        MaxScanSize = "300M";
+        MaxDirectoryRecursion = 60;
+
+        ExcludePath = [
+          "^/sys(/|$)"
+          "^/proc(/|$)"
+          "^/dev(/|$)"
+          "^/run(/|$)"
+          "^/nix/store(/|$)"
+        ];
+
+        #CommandReadTimeout = 0;
+      };
+    };
+
+    updater = {
+      enable = true;
+      interval = "hourly";
+
+      # Number of database checks per day used by freshclam.
+      # Redundant if the updater is a one-shot service, though.
+      # frequency = 24;
+    };
+
+    scanner = {
+      enable = true;
+      interval = "17:15:00";
+    };
+  };
+
+  systemd.services.clamdscan.serviceConfig.ExecStart = lib.mkForce ''
+    ${pkgs.bash}/bin/bash -c ' \
+      echo "Scanning directory /"; \
+      exec "${pkgs.clamav}/bin/clamdscan" \
+        --log=/var/log/clamav/scan.log \
+        --multiscan \
+        --fdpass \
+        --infected \
+        --verbose \
+        --file-list=<(find / \\( -path /proc -o -path /sys -o -path /dev -o -path /run -o -path /nix/store \\) -prune -o -type f -print) \
+    '
+  '';
+
+  systemd.services.clamav-daemon.serviceConfig = {
+    LimitNOFILE = 8192;
+  };
+
+  systemd.timers.clamdscan.timerConfig = {
+    Persistent = true;
+    #RandomizedDelaySec = "2h";
+  };
+
+  #### # ClamAV scan service
+  #### systemd.services.clamav-scan = {
+  ####   description = "ClamAV system scan";
+  ####   documentation = [ "man:clamscan(1)" ];
+
+  ####   after = [
+  ####     "clamav-freshclam.service"
+  ####     "local-fs.target"
+  ####   ];
+
+  ####   wants = [ "clamav-freshclam.service" ];
+
+  ####   script = ''
+  ####     exec ${pkgs.clamav}/bin/clamscan \
+  ####       --infected \
+  ####       --recursive \
+  ####       --log=/var/log/clamav/scan.log \
+  ####       --exclude-dir="^/sys(/|$)" \
+  ####       --exclude-dir="^/proc(/|$)" \
+  ####       --exclude-dir="^/dev(/|$)" \
+  ####       --exclude-dir="^/run(/|$)" \
+  ####       --exclude-dir="^/nix/store(/|$)" \
+  ####       --max-filesize=100M \
+  ####       --max-scansize=300M \
+  ####       /
+  ####   '';
+
+  ####   serviceConfig = {
+  ####     Type = "oneshot";
+  ####     Nice = 19;
+  ####     IOSchedulingClass = "idle";
+
+  ####     # clamscan returns:
+  ####     #   0 = no infection
+  ####     #   1 = infection found
+  ####     #   2 = error
+  ####     #
+  ####     # Finding malware should be recorded, but should not make systemd
+  ####     # describe the scanner itself as broken.
+  ####     SuccessExitStatus = [ 0 1 ];
+
+  ####     # Creates /var/log/clamav automatically.
+  ####     LogsDirectory = "clamav";
+  ####     LogsDirectoryMode = "0750";
+
+  ####     PrivateTmp = true;
+  ####     PrivateDevices = true;
+  ####     NoNewPrivileges = true;
+
+  ####     ProtectSystem = "strict";
+  ####     ProtectHome = "read-only";
+
+  ####     ReadWritePaths = [ "/var/log/clamav" ];
+
+  ####     ProtectKernelTunables = true;
+  ####     ProtectKernelModules = true;
+  ####     ProtectKernelLogs = true;
+  ####     ProtectControlGroups = true;
+
+  ####     RestrictRealtime = true;
+  ####     RestrictSUIDSGID = true;
+  ####     LockPersonality = true;
+  ####     MemoryDenyWriteExecute = true;
+
+  ####     SystemCallArchitectures = "native";
+  ####   };
+  #### };
+
+  #### # Daily ClamAV scan timer
+  #### systemd.timers.clamav-scan = {
+  ####   description = "Daily ClamAV scan at 10:00:00";
+  ####   wantedBy = [ "timers.target" ];
+  ####   timerConfig = {
+  ####     OnCalendar = "*-*-* 09:05:00";
+  ####     Persistent = true;
+  ####     Unit = "clamav-scan.service";
+  ####   };
+  #### };
+
+  #### # Systemd hardening for ClamAV daemon
+  #### systemd.services.clamav-daemon.serviceConfig = {
+  ####   PrivateTmp = lib.mkForce true;
+
+  ####   ProtectSystem = "strict";
+  ####   ProtectHome = "read-only";
+
+  ####   ReadWritePaths = [
+  ####     "/var/lib/clamav"
+  ####     "/run/clamav"
+  ####   ];
+
+  ####   NoNewPrivileges = true;
+  ####   ProtectKernelTunables = true;
+  ####   ProtectKernelModules = true;
+  ####   ProtectKernelLogs = true;
+  ####   ProtectControlGroups = true;
+  ####   RestrictRealtime = true;
+  ####   RestrictSUIDSGID = true;
+  ####   LockPersonality = true;
+  #### };
+}