nixos/suricata: update default rule sources; add rule updater timer (#396934) (e1e3e457) · Commits · nix / nixpkgs

nixos/modules/services/networking/suricata/default.nix

+15 −3

Original line number	Diff line number	Diff line
		@@ -117,15 +117,16 @@ in
		type = types.listOf types.str;
		# see: nix-shell -p suricata python3Packages.pyyaml --command 'suricata-update list-sources'
		default = [
		"abuse.ch/sslbl-blacklist"
		"abuse.ch/sslbl-c2"
		"abuse.ch/sslbl-ja3"
		"et/open"
		"etnetera/aggressive"
		"stamus/lateral"
		"oisf/trafficid"
		"tgreen/hunting"
		"sslbl/ja3-fingerprints"
		"sslbl/ssl-fp-blacklist"
		"malsilo/win-malware"
		"pawpatrules"
		"ptrules/open"
		];
		description = ''
		List of sources that should be enabled.
		@@ -197,6 +198,17 @@ in
		"d ${cfg.settings."default-rule-path"} 755 ${cfg.settings.run-as.user} ${cfg.settings.run-as.group}"
		];

		systemd.timers = {
		suricata-update = {
		timerConfig = {
		OnBootSec = lib.mkDefault "30s";
		OnUnitActiveSec = lib.mkDefault "24h";
		Persistent = true;
		Unit = config.systemd.services.suricata-update.name;
		};
		};
		};

		systemd.services = {
		suricata-update = {
		description = "Update Suricata Rules";