diff --git a/flake.nix b/flake.nix
index 2b414df..781865d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -29,7 +29,13 @@
     {
 
       nixosConfigurations.fw = nixpkgs.lib.nixosSystem {
-        specialArgs = { inherit inputs; };
+        specialArgs = {
+            inherit inputs;
+            user = {
+                username = "tsi";
+                description = "tsi";
+            };
+        };
         modules = [
           hosts/fw/configuration.nix
           home-manager.nixosModules.home-manager
diff --git a/modules/nixos/clamav.nix b/modules/nixos/clamav.nix
index 4487a33..5130462 100644
--- a/modules/nixos/clamav.nix
+++ b/modules/nixos/clamav.nix
@@ -1,10 +1,20 @@
 {
   lib,
   pkgs,
+  user,
   ...
 }:
-
+let
+  logGroup = "clamav-log";
+  logDirectory = "clamav";
+  logFile = "scan.log";
+  logPath = "/var/log/${logDirectory}/${logFile}";
+  scanRoot = "/";
+in
 {
+  users.groups.${logGroup} = { };
+  users.users.${user.username}.extraGroups = [ logGroup ]; # should be managed by home-manager
+
   services.clamav = {
     daemon = {
       enable = true;
@@ -16,15 +26,9 @@
         MaxScanSize = "300M";
         MaxDirectoryRecursion = 60;
 
-        ExcludePath = [
-          "^/sys(/|$)"
-          "^/proc(/|$)"
-          "^/dev(/|$)"
-          "^/run(/|$)"
-          "^/nix/store(/|$)"
-        ];
+        # AlertExceedsMax = true;
 
-        #CommandReadTimeout = 0;
+        # CommandReadTimeout = 0;
       };
     };
 
@@ -39,22 +43,47 @@
 
     scanner = {
       enable = true;
-      interval = "10:15:00";
+      interval = "*-*-* 10:15:00";
     };
   };
 
-  systemd.services.clamdscan.serviceConfig.ExecStart = lib.mkForce ''
-    ${pkgs.bash}/bin/bash -c ' \
-      echo "Scanning directory /"; \
-      exec "${pkgs.clamav}/bin/clamdscan" \
-        --log=/var/log/clamav/scan.log \
-        --multiscan \
-        --fdpass \
-        --infected \
-        --verbose \
-        --file-list=<(find / \\( -path /proc -o -path /sys -o -path /dev -o -path /run -o -path /nix/store \\) -prune -o -type f -print) \
-    '
-  '';
+  systemd.services.clamdscan = {
+    # restartIfchanged = false;
+
+    serviceConfig = {
+      Group = logGroup;
+      LogsDirectory = logDirectory;
+      LogsDirectoryMode = "0750";
+      Nice = 19;
+      IOSchedulingClass = "idle";
+      ExecStart = lib.mkForce ''
+        ${pkgs.bash}/bin/bash -c ' \
+          echo "Scanning directory ${scanRoot}"; \
+          exec "${pkgs.clamav}/bin/clamdscan" \
+            --log=${logPath} \
+            --multiscan \
+            --fdpass \
+            --infected \
+            --verbose \
+            --file-list=<(${pkgs.findutils}/bin/find "${scanRoot}" \\( -path /proc -o -path /sys -o -path /dev -o -path /run -o -path /nix/store \\) -prune -o -type f -print) \
+        '
+      '';
+    };
+  };
+
+  services.logrotate.settings.${logPath} = {
+    frequency = "weekly";
+    rotate = 8;
+
+    dateext = true;
+
+    compress = true;
+    delaycompress = true;
+
+    missingok = true;
+    notifempty = true;
+    create = "0640 root ${logGroup}";
+  };
 
   systemd.services.clamav-daemon.serviceConfig = {
     LimitNOFILE = 8192;
@@ -64,105 +93,4 @@
     Persistent = true;
     #RandomizedDelaySec = "2h";
   };
-
-  #### # ClamAV scan service
-  #### systemd.services.clamav-scan = {
-  ####   description = "ClamAV system scan";
-  ####   documentation = [ "man:clamscan(1)" ];
-
-  ####   after = [
-  ####     "clamav-freshclam.service"
-  ####     "local-fs.target"
-  ####   ];
-
-  ####   wants = [ "clamav-freshclam.service" ];
-
-  ####   script = ''
-  ####     exec ${pkgs.clamav}/bin/clamscan \
-  ####       --infected \
-  ####       --recursive \
-  ####       --log=/var/log/clamav/scan.log \
-  ####       --exclude-dir="^/sys(/|$)" \
-  ####       --exclude-dir="^/proc(/|$)" \
-  ####       --exclude-dir="^/dev(/|$)" \
-  ####       --exclude-dir="^/run(/|$)" \
-  ####       --exclude-dir="^/nix/store(/|$)" \
-  ####       --max-filesize=100M \
-  ####       --max-scansize=300M \
-  ####       /
-  ####   '';
-
-  ####   serviceConfig = {
-  ####     Type = "oneshot";
-  ####     Nice = 19;
-  ####     IOSchedulingClass = "idle";
-
-  ####     # clamscan returns:
-  ####     #   0 = no infection
-  ####     #   1 = infection found
-  ####     #   2 = error
-  ####     #
-  ####     # Finding malware should be recorded, but should not make systemd
-  ####     # describe the scanner itself as broken.
-  ####     SuccessExitStatus = [ 0 1 ];
-
-  ####     # Creates /var/log/clamav automatically.
-  ####     LogsDirectory = "clamav";
-  ####     LogsDirectoryMode = "0750";
-
-  ####     PrivateTmp = true;
-  ####     PrivateDevices = true;
-  ####     NoNewPrivileges = true;
-
-  ####     ProtectSystem = "strict";
-  ####     ProtectHome = "read-only";
-
-  ####     ReadWritePaths = [ "/var/log/clamav" ];
-
-  ####     ProtectKernelTunables = true;
-  ####     ProtectKernelModules = true;
-  ####     ProtectKernelLogs = true;
-  ####     ProtectControlGroups = true;
-
-  ####     RestrictRealtime = true;
-  ####     RestrictSUIDSGID = true;
-  ####     LockPersonality = true;
-  ####     MemoryDenyWriteExecute = true;
-
-  ####     SystemCallArchitectures = "native";
-  ####   };
-  #### };
-
-  #### # Daily ClamAV scan timer
-  #### systemd.timers.clamav-scan = {
-  ####   description = "Daily ClamAV scan at 10:00:00";
-  ####   wantedBy = [ "timers.target" ];
-  ####   timerConfig = {
-  ####     OnCalendar = "*-*-* 09:05:00";
-  ####     Persistent = true;
-  ####     Unit = "clamav-scan.service";
-  ####   };
-  #### };
-
-  #### # Systemd hardening for ClamAV daemon
-  #### systemd.services.clamav-daemon.serviceConfig = {
-  ####   PrivateTmp = lib.mkForce true;
-
-  ####   ProtectSystem = "strict";
-  ####   ProtectHome = "read-only";
-
-  ####   ReadWritePaths = [
-  ####     "/var/lib/clamav"
-  ####     "/run/clamav"
-  ####   ];
-
-  ####   NoNewPrivileges = true;
-  ####   ProtectKernelTunables = true;
-  ####   ProtectKernelModules = true;
-  ####   ProtectKernelLogs = true;
-  ####   ProtectControlGroups = true;
-  ####   RestrictRealtime = true;
-  ####   RestrictSUIDSGID = true;
-  ####   LockPersonality = true;
-  #### };
 }