5e90b62996
Adds Home Manager module for Tirith, a shell security monitor. The module supports: - Shell integration for Bash, Fish, and Zsh - Allowlist configuration for bypassing Tirith analysis - Policy configuration for customizing security behavior
84 lines
2.3 KiB
Nix
84 lines
2.3 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.programs.tirith;
|
|
yamlFormat = pkgs.formats.yaml { };
|
|
in
|
|
{
|
|
meta.maintainers = with lib.maintainers; [ malik ];
|
|
|
|
options.programs.tirith = {
|
|
enable = lib.mkEnableOption "Tirith, a shell security monitor";
|
|
|
|
package = lib.mkPackageOption pkgs "tirith" { };
|
|
|
|
allowlist = lib.mkOption {
|
|
type = lib.types.listOf lib.types.str;
|
|
default = [ ];
|
|
apply = builtins.filter (s: s != "");
|
|
example = [
|
|
"localhost"
|
|
];
|
|
description = ''
|
|
List of allowed domains that bypass Tirith analysis.
|
|
Written to `$XDG_CONFIG_HOME/tirith/allowlist`.
|
|
'';
|
|
};
|
|
|
|
policy = lib.mkOption {
|
|
type = yamlFormat.type;
|
|
default = { };
|
|
example = lib.literalExpression ''
|
|
{
|
|
version = 1;
|
|
fail_mode = "open";
|
|
allow_bypass = true;
|
|
severity_overrides = {
|
|
docker_untrusted_registry = "critical";
|
|
};
|
|
}
|
|
'';
|
|
description = ''
|
|
Tirith policy configuration.
|
|
Written to `$XDG_CONFIG_HOME/tirith/policy.yaml`.
|
|
|
|
See <https://github.com/sheeki03/tirith/blob/main/docs/cookbook.md>
|
|
for policy examples.
|
|
'';
|
|
};
|
|
|
|
enableBashIntegration = lib.hm.shell.mkBashIntegrationOption { inherit config; };
|
|
enableFishIntegration = lib.hm.shell.mkFishIntegrationOption { inherit config; };
|
|
enableZshIntegration = lib.hm.shell.mkZshIntegrationOption { inherit config; };
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
home.packages = [ cfg.package ];
|
|
|
|
xdg.configFile = {
|
|
"tirith/allowlist" = lib.mkIf (cfg.allowlist != [ ]) {
|
|
text = (lib.concatStringsSep "\n" cfg.allowlist) + "\n";
|
|
};
|
|
|
|
"tirith/policy.yaml" = lib.mkIf (cfg.policy != { }) {
|
|
source = yamlFormat.generate "tirith-policy.yaml" cfg.policy;
|
|
};
|
|
};
|
|
|
|
programs.bash.initExtra = lib.mkIf cfg.enableBashIntegration ''
|
|
eval "$(${lib.getExe cfg.package} init --shell bash)"
|
|
'';
|
|
|
|
programs.fish.interactiveShellInit = lib.mkIf cfg.enableFishIntegration ''
|
|
${lib.getExe cfg.package} init --shell fish | source
|
|
'';
|
|
|
|
programs.zsh.initExtra = lib.mkIf cfg.enableZshIntegration ''
|
|
eval "$(${lib.getExe cfg.package} init --shell zsh)"
|
|
'';
|
|
};
|
|
}
|