Grimmauld/grimm-nixos-laptop
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

spotify opensnitch rules

Browse Source
This commit is contained in:
Grimmauld 2024-10-05 13:15:32 +02:00
parent 722c6f8e86
commit 0b73857ec4
Signed by: Grimmauld
GPG Key ID: C2946668769F91FB
3 changed files with 103 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
common/tooling/default.nix
View File

@ -26,7 +26,7 @@ in
./wine.nix
./c.nix
./java.nix
./opensnitch.nix
./opensnitch
./ranger.nix
];

109
common/tooling/opensnitch.nix → common/tooling/opensnitch/default.nix
View File

@ -76,24 +76,120 @@ in
type = "simple";
operand = "dest.port";
data = "53";
list = null;
}
{
type = "lists";
operand = "lists.nets";
data = pkgs.writeTextDir "cidr_dns.list" (concatLines ((map (ip: "${ip}/32") config.networking.nameservers) ++ local_network));
list = null;
}
{
type = "simple";
operand = "user.id";
data = "998";
list = null;
}
];
};
};
spotify_deny = mkIf (config.grimmShared.spotify.enable && graphical) {
name = "spotify-deny";
enabled = true;
action = "deny";
precedence = false;
duration = "always";
operator = {
type ="simple";
sensitive = false;
operand = "process.path";
data = "${lib.getBin pkgs.spotify}/share/spotify/.spotify-wrapped";
};
};
ncspot = mkIf (config.grimmShared.spotify.enable) {
name = "ncspot";
enabled = true;
action = "allow";
duration = "always";
operator = {
type = "list";
operand = "list";
list = [
{
type = "regexp";
operand = "dest.port";
data = "443|4070";
}
{
type ="simple";
sensitive = false;
operand = "process.path";
data = lib.getExe pkgs.ncspot;
}
{
type = "lists";
operand = "lists.domains_regexp";
data = ./spotify_hosts;
}
];
};
};
spotify_allow = mkIf (config.grimmShared.spotify.enable && graphical) {
name = "spotify-allow";
enabled = true;
action = "allow";
duration = "always";
precedence = true;
operator = {
type = "list";
operand = "list";
list = [
{
type = "regexp";
operand = "dest.port";
data = "443|4070";
}
{
type ="simple";
sensitive = false;
operand = "process.path";
data = "${lib.getBin pkgs.spotify}/share/spotify/.spotify-wrapped";
}
{
type = "lists";
operand = "lists.domains_regexp";
data = ./spotify_hosts;
}
];
};
};
spotify_allow_local = mkIf (config.grimmShared.spotify.enable && graphical) {
name = "spotify-allow-local";
enabled = true;
action = "allow";
duration = "always";
precedence = true;
operator = {
type = "list";
operand = "list";
list = [
{
type ="simple";
sensitive = false;
operand = "process.path";
data = "${lib.getBin pkgs.spotify}/share/spotify/.spotify-wrapped";
}
{
type = "lists";
operand = "lists.nets";
data = local_ips;
}
];
};
};
avahi = mkIf (config.services.avahi.enable) {
name = "avahi";
enabled = true;
@ -113,13 +209,11 @@ in
type = "simple";
operand = "dest.port";
data = "5353";
list = null;
}
{
type = "simple";
operand = "user.id";
data = "996";
list = null;
}
];
};
@ -138,20 +232,17 @@ in
type ="simple";
sensitive = false;
operand = "process.path";
list = null;
data = lib.getExe' pkgs.cups-filters "cups-browsed";
}
{
type ="regexp";
operand = "dest.port";
data = "53";
list = null;
}
{
type = "lists";
operand = "lists.nets";
data = local_ips;
list = null;
}
];
};
@ -170,13 +261,11 @@ in
type ="simple";
sensitive = false;
operand = "process.path";
list = null;
data = "${lib.getBin pkgs.systemd}/lib/systemd/systemd-timesyncd"; }
{
type ="regexp";
operand = "dest.port";
data = "123|37";
list = null;
}
];
};

3
common/tooling/opensnitch/spotify_hosts/hosts.list Normal file
View File

@ -0,0 +1,3 @@
scdn.co
spotifycdn.com
spotify.com