1 files changed, 72 insertions, 0 deletions
diff --git a/modules/security.nix b/modules/security.nix
new file mode 100644
index 0000000..33aa919
--- /dev/null
+++ b/modules/security.nix
@@ -0,0 +1,72 @@
+{
+  config,
+  lib,
+  pkgs,
+  username,
+  ...
+}:
+let
+  cfg = config.os.core.security;
+in
+{
+  options.os.core.security = {
+    enable = lib.mkEnableOption "core security services";
+    antivirus.enable = lib.mkEnableOption "enables clamav antivirus";
+    sandboxing.enable = lib.mkEnableOption "enables sandboxing stuff";
+  };
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        security = {
+          polkit.enable = true;
+          rtkit.enable = true;
+          doas = {
+            enable = true;
+            extraRules = [
+              {
+                users = [ username ];
+                keepEnv = true;
+                persist = true;
+              }
+            ];
+          };
+          # sudo.enable = false;
+          pam.services = {
+            swaylock = { };
+            login.enableGnomeKeyring = true;
+          };
+        };
+        # environment.systemPackages = [ pkgs.doas-sudo-shim ];
+      }
+      (lib.mkIf cfg.sandboxing.enable {
+        security.apparmor = {
+          enable = true;
+          enableCache = true;
+          killUnconfinedConfinables = true;
+          packages = with pkgs; [
+            apparmor-profiles
+            roddhjav-apparmor-rules
+          ];
+        };
+        services.dbus.apparmor = "enabled";
+        specialisation.no-apparmor.configuration.security.apparmor.enable = lib.mkForce false;
+
+        programs.firejail.enable = true;
+        environment.systemPackages = with pkgs; [
+          apparmor-utils
+          apparmor-parser
+          apparmor-bin-utils
+        ];
+      })
+      {
+        services.gnome.gnome-keyring.enable = true;
+
+        environment.systemPackages = with pkgs; [
+          veracrypt
+          gocryptfs
+          keepassxc
+        ];
+      }
+    ]
+  );
+}