@ -3,26 +3,37 @@ with lib;
let
clamavUser = " c l a m a v " ;
stateDir = " / v a r / l i b / c l a m a v " ;
runDir = " / v a r / r u n / c l a m a v " ;
logDir = " / v a r / l o g / c l a m a v " ;
runDir = " / r u n / c l a m a v " ;
clamavGroup = clamavUser ;
cfg = config . services . clamav ;
pkg = pkgs . clamav ;
clamdConfigFile = pkgs . writeText " c l a m d . c o n f " ''
DatabaseDirectory $ { stateDir }
LocalSocket $ { runDir } /clamd.ctl
LogFile $ { logDir } /clamav.log
PidFile $ { runDir } /clamd.pid
TemporaryDirectory /tmp
User clamav
Foreground yes
$ { cfg . daemon . extraConfig }
'' ;
pkg = pkgs . clamav ;
freshclamConfigFile = pkgs . writeText " f r e s h c l a m . c o n f " ''
DatabaseDirectory $ { stateDir }
Foreground yes
Checks $ { toString cfg . updater . frequency }
$ { cfg . updater . extraConfig }
DatabaseMirror database . clamav . net
'' ;
in
{
options = {
services . clamav = {
daemon = {
enable = mkEnableOption " c l a m d d a e m o n " ;
enable = mkEnableOption " C l a m A V cl a m d d a e m o n " ;
extraConfig = mkOption {
type = types . lines ;
@ -34,16 +45,27 @@ in
} ;
} ;
updater = {
enable = mkEnableOption " f r e s h c l a m u p d a t e r " ;
enable = mkEnableOption " C l a m A V fr e s h c l a m u p d a t e r " ;
frequency = mkOption {
type = types . int ;
default = 12 ;
description = ''
Number of database checks per day .
'' ;
} ;
config = mkOption {
interval = mkOption {
type = types . str ;
default = " h o u r l y " ;
description = ''
How often freshclam is invoked . See systemd . time ( 7 ) for more
information about the format .
'' ;
} ;
extraConfig = mkOption {
type = types . lines ;
default = " " ;
description = ''
Extra configuration for freshclam . Contents will be added verbatim to the
@ -68,50 +90,53 @@ in
gid = config . ids . gids . clamav ;
} ;
services . clamav . updater . config = mkIf cfg . updater . enable ''
DatabaseDirectory $ { stateDir }
Foreground yes
Checks $ { toString cfg . updater . frequency }
DatabaseMirror database . clamav . net
'' ;
environment . etc . " c l a m a v / f r e s h c l a m . c o n f " . source = freshclamConfigFile ;
environment . etc . " c l a m a v / c l a m d . c o n f " . source = clamdConfigFile ;
systemd . services . clamd = mkIf cfg . daemon . enable {
systemd . services . clamav-daemon = mkIf cfg . daemon . enable {
description = " C l a m A V d a e m o n ( c l a m d ) " ;
path = [ pkg ] ;
after = [ " n e t w o r k . t a r g e t " " f r e s h c l a m . s e r v i c e " ] ;
requires = [ " f r e s h c l a m . s e r v i c e " ] ;
after = mkIf cfg . updater . enable [ " c l a m a v - f r e s h c l a m . s e r v i c e " ] ;
requires = mkIf cfg . updater . enable [ " c l a m a v - f r e s h c l a m . s e r v i c e " ] ;
wantedBy = [ " m u l t i - u s e r . t a r g e t " ] ;
restartTriggers = [ clamdConfigFile ] ;
preStart = ''
mkdir - m 0755 - p $ { logDir }
mkdir - m 0755 - p $ { runDir }
chown $ { clamavUser }: $ { clamavGroup } $ { logDir }
chown $ { clamavUser }: $ { clamavGroup } $ { runDir }
'' ;
serviceConfig = {
ExecStart = " ${ pkg } / b i n / c l a m d - - c o n f i g - f i l e = ${ clamdConfigFile } " ;
Type = " f o r k i n g " ;
ExecReload = " ${ pkgs . coreutils } / b i n / k i l l - H U P $ M A I N P I D " ;
Restart = " o n - f a i l u r e " ;
RestartSec = " 1 0 s " ;
StartLimitInterval = " 1 m i n " ;
ExecStart = " ${ pkg } / b i n / c l a m d " ;
ExecReload = " ${ pkgs . coreutils } / b i n / k i l l - U S R 2 $ M A I N P I D " ;
PrivateTmp = " y e s " ;
PrivateDevices = " y e s " ;
PrivateNetwork = " y e s " ;
} ;
} ;
systemd . services . freshclam = mkIf cfg . updater . enable {
description = " C l a m A V u p d a t e r ( f r e s h c l a m ) " ;
after = [ " n e t w o r k . t a r g e t " ] ;
wantedBy = [ " m u l t i - u s e r . t a r g e t " ] ;
path = [ pkg ] ;
systemd . timers . clamav-freshclam = mkIf cfg . updater . enable {
description = " T i m e r f o r C l a m A V v i r u s d a t a b a s e u p d a t e r ( f r e s h c l a m ) " ;
wantedBy = [ " t i m e r s . t a r g e t " ] ;
timerConfig = {
OnCalendar = cfg . updater . interval ;
Unit = " c l a m a v - f r e s h c l a m . s e r v i c e " ;
} ;
} ;
systemd . services . clamav-freshclam = mkIf cfg . updater . enable {
description = " C l a m A V v i r u s d a t a b a s e u p d a t e r ( f r e s h c l a m ) " ;
restartTriggers = [ freshclamConfigFile ] ;
preStart = ''
mkdir - m 0755 - p $ { stateDir }
chown $ { clamavUser }: $ { clamavGroup } $ { stateDir }
'' ;
serviceConfig = {
ExecStart = " ${ pkg } / b i n / f r e s h c l a m - - d a e m o n - - c o n f i g - f i l e = ${ pkgs . writeText " f r e s h c l a m . c o n f " cfg . updater . config } " ;
ExecReload = " ${ pkgs . coreutils } / b i n / k i l l - H U P $ M A I N P I D " ;
Restart = " o n - f a i l u r e " ;
RestartSec = " 1 0 s " ;
StartLimitInterval = " 1 m i n " ;
Type = " o n e s h o t " ;
ExecStart = " ${ pkg } / b i n / f r e s h c l a m " ;
PrivateTmp = " y e s " ;
PrivateDevices = " y e s " ;
} ;
} ;
} ;