1 files changed, 91 insertions, 29 deletions
diff --git a/os/core/security.nix b/os/core/security.nix
index f0eadab..34e2f1f 100644
--- a/os/core/security.nix
+++ b/os/core/security.nix
@@ -11,37 +11,99 @@ in
 {
   options.os.core.security = {
     enable = lib.mkEnableOption "core security services";
+    antivirus.enable = lib.mkEnableOption "enables clamav antivirus";
+    sandboxing.enable = lib.mkEnableOption "enables sandboxing stuff";
   };
-  config = lib.mkIf cfg.enable {
-    services.gnome.gnome-keyring.enable = true;
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        security = {
+          polkit.enable = true;
+          rtkit.enable = true;
+          doas = {
+            enable = true;
+            extraRules = [
+              {
+                users = [ username ];
+                keepEnv = true;
+                persist = true;
+              }
+            ];
+          };
+          sudo.enable = false;
+          pam.services = {
+            swaylock = { };
+            login.enableGnomeKeyring = true;
+          };
+        };
+        environment.systemPackages = [ pkgs.doas-sudo-shim ];
+      }
+      (lib.mkIf cfg.sandboxing.enable {
+        security.apparmor = {
+          enable = true;
+          enableCache = true;
+          killUnconfinedConfinables = true;
+          packages = with pkgs; [
+            apparmor-profiles
+            roddhjav-apparmor-rules
+          ];
+        };
+        programs.firejail.enable = true;
+        environment.etc = {
+          "firejail/games.profile".text = ''
+            include wine.profile
 
-    security = {
-      doas = {
-        enable = true;
-        extraRules = [
-          {
-            users = [ username ];
-            keepEnv = true;
-            persist = true;
-          }
-        ];
-      };
-      sudo.enable = false;
+            # --- Security stuff ---
+            apparmor
+            nonewprivs
+            net none
+            noinput
+            nogroups
+            novideo
+            dbus-user none
+            dbus-system none
 
-      pam.services = {
-        swaylock = { };
-        login.enableGnomeKeyring = true;
-      };
-      polkit.enable = true;
-      rtkit.enable = true;
-    };
+            # --- Filesystem Isolation ---
+            whitelist ~/games/repacks/firejail
+            private-tmp
+          '';
+        };
+        environment.systemPackages = with pkgs; [
+          landrun
+          apparmor-utils
+          apparmor-bin-utils
+        ];
+      })
+      (lib.mkIf cfg.antivirus.enable {
+        services.clamav = {
+          daemon = {
+            enable = true;
+            settings = {
+              OnAccessIncludePath = [ "/home/${username}" ];
+              OnAccessPrevention = true;
+              OnAccessExcludeUname = "clamav";
+              MaxThreads = 20;
+              MaxQueue = 100;
+            };
+          };
+          scanner.enable = true;
+          updater.enable = true;
+          fangfrisch.enable = true;
+          # massive performance hit
+          # clamonacc.enable = true;
+        };
+        boot.kernel.sysctl."fs.inotify.max_user_watches" = 524288;
+        users.users.${username}.extraGroups = [ "clamav" ];
+      })
+      {
+        services.gnome.gnome-keyring.enable = true;
 
-    environment.systemPackages = with pkgs; [
-      doas-sudo-shim
-      veracrypt
-      bitwarden-desktop
-      keepassxc
-      git-credential-keepassxc
-    ];
-  };
+        environment.systemPackages = with pkgs; [
+          veracrypt
+          bitwarden-desktop
+          keepassxc
+        ];
+      }
+    ]
+  );
 }