some librewolf changes

4 files changed, 105 insertions, 42 deletions

diff --git a/os/core/security.nix b/os/core/security.nix
index f0eadab..34e2f1f 100644
--- a/os/core/security.nix
+++ b/os/core/security.nix
@@ -11,37 +11,99 @@ in
 {
   options.os.core.security = {
     enable = lib.mkEnableOption "core security services";
+    antivirus.enable = lib.mkEnableOption "enables clamav antivirus";
+    sandboxing.enable = lib.mkEnableOption "enables sandboxing stuff";
   };
-  config = lib.mkIf cfg.enable {
-    services.gnome.gnome-keyring.enable = true;
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        security = {
+          polkit.enable = true;
+          rtkit.enable = true;
+          doas = {
+            enable = true;
+            extraRules = [
+              {
+                users = [ username ];
+                keepEnv = true;
+                persist = true;
+              }
+            ];
+          };
+          sudo.enable = false;
+          pam.services = {
+            swaylock = { };
+            login.enableGnomeKeyring = true;
+          };
+        };
+        environment.systemPackages = [ pkgs.doas-sudo-shim ];
+      }
+      (lib.mkIf cfg.sandboxing.enable {
+        security.apparmor = {
+          enable = true;
+          enableCache = true;
+          killUnconfinedConfinables = true;
+          packages = with pkgs; [
+            apparmor-profiles
+            roddhjav-apparmor-rules
+          ];
+        };
+        programs.firejail.enable = true;
+        environment.etc = {
+          "firejail/games.profile".text = ''
+            include wine.profile
 
-    security = {
-      doas = {
-        enable = true;
-        extraRules = [
-          {
-            users = [ username ];
-            keepEnv = true;
-            persist = true;
-          }
-        ];
-      };
-      sudo.enable = false;
+            # --- Security stuff ---
+            apparmor
+            nonewprivs
+            net none
+            noinput
+            nogroups
+            novideo
+            dbus-user none
+            dbus-system none
 
-      pam.services = {
-        swaylock = { };
-        login.enableGnomeKeyring = true;
-      };
-      polkit.enable = true;
-      rtkit.enable = true;
-    };
+            # --- Filesystem Isolation ---
+            whitelist ~/games/repacks/firejail
+            private-tmp
+          '';
+        };
+        environment.systemPackages = with pkgs; [
+          landrun
+          apparmor-utils
+          apparmor-bin-utils
+        ];
+      })
+      (lib.mkIf cfg.antivirus.enable {
+        services.clamav = {
+          daemon = {
+            enable = true;
+            settings = {
+              OnAccessIncludePath = [ "/home/${username}" ];
+              OnAccessPrevention = true;
+              OnAccessExcludeUname = "clamav";
+              MaxThreads = 20;
+              MaxQueue = 100;
+            };
+          };
+          scanner.enable = true;
+          updater.enable = true;
+          fangfrisch.enable = true;
+          # massive performance hit
+          # clamonacc.enable = true;
+        };
+        boot.kernel.sysctl."fs.inotify.max_user_watches" = 524288;
+        users.users.${username}.extraGroups = [ "clamav" ];
+      })
+      {
+        services.gnome.gnome-keyring.enable = true;
 
-    environment.systemPackages = with pkgs; [
-      doas-sudo-shim
-      veracrypt
-      bitwarden-desktop
-      keepassxc
-      git-credential-keepassxc
-    ];
-  };
+        environment.systemPackages = with pkgs; [
+          veracrypt
+          bitwarden-desktop
+          keepassxc
+        ];
+      }
+    ]
+  );
 }
diff --git a/os/srv/files.nix b/os/srv/files.nix
index 22117d0..f5e4ebb 100644
--- a/os/srv/files.nix
+++ b/os/srv/files.nix
@@ -15,23 +15,24 @@ in
   };
   config = lib.mkMerge [
     (lib.mkIf cfg.enable {
-      programs.thunar = {
-        enable = true;
-        plugins = with pkgs; [
-          ffmpegthumbnailer
-          libgsf
-          poppler
-          freetype
-          webp-pixbuf-loader
-          thunar-volman
-          thunar-archive-plugin
-        ];
-      };
+      # programs.thunar = {
+      #   enable = true;
+      #   plugins = with pkgs; [
+      #     ffmpegthumbnailer
+      #     libgsf
+      #     poppler
+      #     freetype
+      #     webp-pixbuf-loader
+      #     thunar-volman
+      #     thunar-archive-plugin
+      #   ];
+      # };
       services = {
         tumbler.enable = true;
         gvfs.enable = true;
       };
       environment.systemPackages = with pkgs; [
+        pcmanfm
         file-roller
         dua
         pxz
diff --git a/os/srv/gaming.nix b/os/srv/gaming.nix
index 33f492a..28ebcc3 100644
--- a/os/srv/gaming.nix
+++ b/os/srv/gaming.nix
@@ -107,6 +107,7 @@ in
         openFirewall = true;
         highPriority = true;
         steam.importOXRRuntimes = true;
+        defaultRuntime = true;
       };
       environment.systemPackages = [ pkgs.android-tools ];
       users.users.${username}.extraGroups = [ "adbusers" ];
diff --git a/os/srv/omnisearch.nix b/os/srv/omnisearch.nix
index dea0490..756711f 100644
--- a/os/srv/omnisearch.nix
+++ b/os/srv/omnisearch.nix
@@ -13,6 +13,5 @@ in
 
   config = lib.mkIf cfg.enable {
     services.omnisearch.enable = true;
-    networking.hosts."127.0.0.1" = [ "omnisearch.local" ];
   };
 }