96 lines
2.1 KiB
Nix
96 lines
2.1 KiB
Nix
{
|
|
lib,
|
|
pkgs,
|
|
user,
|
|
...
|
|
}:
|
|
let
|
|
logGroup = "clamav-log";
|
|
logDirectory = "clamav";
|
|
logFile = "scan.log";
|
|
logPath = "/var/log/${logDirectory}/${logFile}";
|
|
scanRoot = "/";
|
|
in
|
|
{
|
|
users.groups.${logGroup} = { };
|
|
users.users.${user.username}.extraGroups = [ logGroup ]; # should be managed by home-manager
|
|
|
|
services.clamav = {
|
|
daemon = {
|
|
enable = true;
|
|
|
|
settings = {
|
|
MaxThreads = 24;
|
|
MaxQueue = 48;
|
|
MaxFileSize = "100M";
|
|
MaxScanSize = "300M";
|
|
MaxDirectoryRecursion = 60;
|
|
|
|
# AlertExceedsMax = true;
|
|
|
|
# CommandReadTimeout = 0;
|
|
};
|
|
};
|
|
|
|
updater = {
|
|
enable = true;
|
|
interval = "hourly";
|
|
|
|
# Number of database checks per day used by freshclam.
|
|
# Redundant if the updater is a one-shot service, though.
|
|
# frequency = 24;
|
|
};
|
|
|
|
scanner = {
|
|
enable = true;
|
|
interval = "*-*-* 10:15:00";
|
|
};
|
|
};
|
|
|
|
systemd.services.clamdscan = {
|
|
# restartIfchanged = false;
|
|
|
|
serviceConfig = {
|
|
Group = logGroup;
|
|
LogsDirectory = logDirectory;
|
|
LogsDirectoryMode = "0750";
|
|
Nice = 19;
|
|
IOSchedulingClass = "idle";
|
|
ExecStart = lib.mkForce ''
|
|
${pkgs.bash}/bin/bash -c ' \
|
|
echo "Scanning directory ${scanRoot}"; \
|
|
exec "${pkgs.clamav}/bin/clamdscan" \
|
|
--log=${logPath} \
|
|
--multiscan \
|
|
--fdpass \
|
|
--infected \
|
|
--verbose \
|
|
--file-list=<(${pkgs.findutils}/bin/find "${scanRoot}" \\( -path /proc -o -path /sys -o -path /dev -o -path /run -o -path /nix/store \\) -prune -o -type f -print) \
|
|
'
|
|
'';
|
|
};
|
|
};
|
|
|
|
services.logrotate.settings.${logPath} = {
|
|
frequency = "weekly";
|
|
rotate = 8;
|
|
|
|
dateext = true;
|
|
|
|
compress = true;
|
|
delaycompress = true;
|
|
|
|
missingok = true;
|
|
notifempty = true;
|
|
create = "0640 root ${logGroup}";
|
|
};
|
|
|
|
systemd.services.clamav-daemon.serviceConfig = {
|
|
LimitNOFILE = 8192;
|
|
};
|
|
|
|
systemd.timers.clamdscan.timerConfig = {
|
|
Persistent = true;
|
|
#RandomizedDelaySec = "2h";
|
|
};
|
|
}
|