nico/dots
2
2
Fork 1
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

opensnitch: improve rules

Browse source
This commit is contained in:
Nico 2026-01-03 22:22:59 +11:00
parent 9814e3e6e3
commit f4a53155b2
Signed by: nico
SSH key fingerprint: SHA256:XuacYOrGqRxC3jVFjfLROn1CSvLz85Dec6N7O9Gwu/0
1 changed files with 155 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

157
modules/network/firewall/opensnitch.nix
View file

@ -10,6 +10,8 @@
};
rules = {
#
# system services
"systemd-timesyncd" = {
"name" = "systemd-timesyncd";
"enabled" = true;
@ -18,8 +20,8 @@
"operator" = {
"type" = "simple";
"sensitive" = false;
"operand" = "process.path";
"data" = "${pkgs.systemd}/lib/systemd/systemd-timesyncd";
"operand" = "lists.domains";
"data" = builtins.toFile "systemd-timesyncd-opensnitch-rules" (lib.strings.concatStringsSep "\n" config.networking.timeServers);
};
};
"nsncd" = {
@ -34,6 +36,157 @@
"data" = "${pkgs.nsncd}/bin/nsncd";
};
};
"tailscale" = {
"name" = "tailscale";
"enabled" = true;
"action" = "allow";
"duration" = "always";
"operator" = {
"operand" = "process.path";
"type" = "simple";
"sensitive" = false;
"data" = "${pkgs.tailscale}/bin/.tailscaled-wrapped";
};
};
"avahi-daemon" = {
"name" = "avahi-daemon";
"enabled" = true;
"action" = "allow";
"duration" = "always";
"operator" = {
"operand" = "process.path";
"type" = "simple";
"sensitive" = false;
"data" = "${pkgs.avahi}/bin/avahi-daemon";
};
};
#
# services
"prowlarr" = {
"name" = "prowlarr";
"enabled" = true;
"action" = "allow";
"duration" = "always";
"operator" = {
"type" = "list";
"operand" = "list";
"list" = [
{
"operand" = "process.path";
"type" = "simple";
"sensitive" = false;
"data" = "${pkgs.prowlarr}/lib/prowlarr/Prowlarr";
}
{
"operand" = "user.name";
"type" = "simple";
"sensitive" = false;
"data" = "prowlarr";
}
];
};
};
"sonarr" = {
"name" = "sonarr";
"enabled" = true;
"action" = "allow";
"duration" = "always";
"operator" = {
"type" = "list";
"operand" = "list";
"list" = [
{
"operand" = "process.path";
"type" = "simple";
"sensitive" = false;
"data" = "${pkgs.sonarr}/lib/sonarr/Sonarr";
}
{
"operand" = "user.name";
"type" = "simple";
"sensitive" = false;
"data" = "${config.services.sonarr.user}";
}
];
};
};
"radarr" = {
"name" = "radarr";
"enabled" = true;
"action" = "allow";
"duration" = "always";
"operator" = {
"type" = "list";
"operand" = "list";
"list" = [
{
"operand" = "process.path";
"type" = "simple";
"sensitive" = false;
"data" = "${pkgs.radarr}/lib/radarr/Radarr";
}
{
"operand" = "user.name";
"type" = "simple";
"sensitive" = false;
"data" = "${config.services.radarr.user}";
}
];
};
};
"forgejo" = {
"name" = "forgejo";
"enabled" = true;
"action" = "allow";
"duration" = "always";
"operator" = {
"type" = "list";
"operand" = "list";
"list" = [
{
"operand" = "process.path";
"type" = "simple";
"sensitive" = false;
"data" = "${pkgs.forgejo-lts}/bin/.forgejo-wrapped";
}
{
"operand" = "user.name";
"type" = "simple";
"sensitive" = false;
"data" = "${config.services.forgejo.user}";
}
];
};
};
"caddy" = {
"name" = "caddy";
"enabled" = true;
"action" = "allow";
"duration" = "always";
"operator" = {
"type" = "list";
"operand" = "list";
"list" = [
{
"operand" = "process.path";
"type" = "simple";
"sensitive" = false;
"data" = "${pkgs.caddy}/bin/caddy";
}
{
"operand" = "user.name";
"type" = "simple";
"sensitive" = false;
"data" = "${config.services.caddy.user}";
}
];
};
};
#
# desktop applications
"firefox" = {
"name" = "firefox";
"enabled" = true;