commit 93403bdacd38d36f4a8f2c7397d6bf1a9faf6210 · pyrox.dev/nixpkgs

+77 -3

nixos/modules/services/security/paretosecurity.nix

···

       17
        
             default = true;

     

       18
        
             description = "Set to false to disable the tray icon and run as a CLI tool only.";

     

       19
        
           };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       20
        
         };

     

       21
        
       

     

       22
        
         config = lib.mkIf cfg.enable {

     
···

       38
        
           # if one is installed.

     

       39
        
           # The `paretosecurity-user` timer service that is configured lower has

     

       40
        
           # the same need.

     

       41
       -
           systemd.services.paretosecurity.serviceConfig.Environment = [

     

       42
       -
             "PATH=${config.system.path}/bin:${config.system.path}/sbin"

     

       43
       -
           ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       44
        
       

     

       45
        
           # Enable the tray icon and timer services if the trayIcon option is enabled

     

       46
        
           systemd.user = lib.mkIf cfg.trayIcon {

···

       17
        
             default = true;

     

       18
        
             description = "Set to false to disable the tray icon and run as a CLI tool only.";

     

       19
        
           };

     

       20
       +
           users = lib.mkOption {

     

       21
       +
             type = lib.types.attrsOf (

     

       22
       +
               lib.types.submodule {

     

       23
       +
                 options = {

     

       24
       +
                   inviteId = lib.mkOption {

     

       25
       +
                     type = lib.types.str;

     

       26
       +
                     description = ''

     

       27
       +
                       A unique ID that links the agent to Pareto Cloud.

     

       28
       +
                       Get it from the Join Team page on `https://cloud.paretosecurity.com/team/join/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`.

     

       29
       +
                       In Step 2, under Linux tab, enter your email then copy it from the generated command.

     

       30
       +
                     '';

     

       31
       +
                     example = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";

     

       32
       +
                   };

     

       33
       +
                 };

     

       34
       +
               }

     

       35
       +
             );

     

       36
       +
             default = { };

     

       37
       +
             description = "Per-user Pareto Security configuration.";

     

       38
       +
           };

     

       39
        
         };

     

       40
        
       

     

       41
        
         config = lib.mkIf cfg.enable {

     
···

       57
        
           # if one is installed.

     

       58
        
           # The `paretosecurity-user` timer service that is configured lower has

     

       59
        
           # the same need.

     

       60
       +
           systemd.services = {

     

       61
       +
             paretosecurity.serviceConfig.Environment = [

     

       62
       +
               "PATH=${config.system.path}/bin:${config.system.path}/sbin"

     

       63
       +
             ];

     

       64
       +
           }

     

       65
       +
           // (

     

       66
       +
       

     

       67
       +
             # Each user can set their inviteID, which creates a systemd service

     

       68
       +
             # that runs `paretosecurity link ...` to link their device to Pareto Cloud.

     

       69
       +
             lib.mapAttrs' (

     

       70
       +
               username: userConfig:

     

       71
       +
               lib.nameValuePair "paretosecurity-link-${username}" {

     

       72
       +
                 description = "Link Pareto Desktop to Pareto Cloud for user ${username}";

     

       73
       +
                 after = [ "network-online.target" ];

     

       74
       +
                 wants = [ "network-online.target" ];

     

       75
       +
       

     

       76
       +
                 serviceConfig = {

     

       77
       +
                   Type = "oneshot";

     

       78
       +
                   RemainAfterExit = true;

     

       79
       +
                   User = username;

     

       80
       +
                   StateDirectory = "paretosecurity/${username}";

     

       81
       +
       

     

       82
       +
                   ExecStart = pkgs.writeShellScript "paretosecurity-link-${username}" ''

     

       83
       +
                     set -euo pipefail

     

       84
       +
       

     

       85
       +
                     INVITE_ID="${userConfig.inviteId}"

     

       86
       +
                     STATE_FILE="/var/lib/paretosecurity/${username}/linked-$INVITE_ID"

     

       87
       +
                     CONFIG_FILE="$HOME/.config/pareto.toml"

     

       88
       +
       

     

       89
       +
                     # Check if already linked with this specific invite

     

       90
       +
                     if [ -f "$STATE_FILE" ]; then

     

       91
       +
                       echo "Device already linked with invite $INVITE_ID for user ${username}"

     

       92
       +
                       exit 0

     

       93
       +
                     fi

     

       94
       +
       

     

       95
       +
                     # Ensure config directory exists

     

       96
       +
                     mkdir -p "$(dirname "$CONFIG_FILE")"

     

       97
       +
       

     

       98
       +
                     # Perform linking

     

       99
       +
                     echo "Linking device to Pareto Cloud for user ${username}..."

     

       100
       +
                     ${cfg.package}/bin/paretosecurity link \

     

       101
       +
                       "paretosecurity://linkDevice/?invite_id=$INVITE_ID"

     

       102
       +
       

     

       103
       +
                     # Verify linking succeeded

     

       104
       +
                     if [ -f "$CONFIG_FILE" ] && grep -q "TeamID" "$CONFIG_FILE"; then

     

       105
       +
                       echo "Successfully linked to Pareto Cloud for user ${username}"

     

       106
       +
                       touch "$STATE_FILE"

     

       107
       +
                     else

     

       108
       +
                       echo "Failed to link to Pareto Cloud for user ${username}"

     

       109
       +
                       exit 1

     

       110
       +
                     fi

     

       111
       +
                   '';

     

       112
       +
                 };

     

       113
       +
       

     

       114
       +
                 wantedBy = [ "multi-user.target" ];

     

       115
       +
               }

     

       116
       +
             ) cfg.users

     

       117
       +
           );

     

       118
        
       

     

       119
        
           # Enable the tray icon and timer services if the trayIcon option is enabled

     

       120
        
           systemd.user = lib.mkIf cfg.trayIcon {

+44 -38

nixos/tests/paretosecurity.nix

···

       9
        
             imports = [ ./common/user-account.nix ];

     

       10
        
       

     

       11
        
             services.paretosecurity.enable = true;

     

       12
       -
       

     

       13
        
           };

     

       14
        
       

     

       15
        
         nodes.xfce =

     
···

       46
        
           terminal.systemctl("start network-online.target")

     

       47
        
           terminal.wait_for_unit("network-online.target")

     

       48
        
       

     

       49
       -
           # Test 1: Test the systemd socket is installed & enabled

     

       50
       -
           terminal.succeed('systemctl is-enabled paretosecurity.socket')

     

       51
        
       

     

       52
       -
           # Test 2: Test running checks

     

       53
       -
           terminal.succeed(

     

       54
       -
             "su - alice -c 'paretosecurity check"

     

       55
       -
             # Disable some checks that need intricate test setup so that this test

     

       56
       -
             # remains simple and fast. Tests for all checks and edge cases available

     

       57
       -
             # at https://github.com/ParetoSecurity/agent/tree/main/test/integration

     

       58
       -
             + " --skip c96524f2-850b-4bb9-abc7-517051b6c14e"  # SecureBoot

     

       59
       -
             + " --skip 37dee029-605b-4aab-96b9-5438e5aa44d8"  # Screen lock

     

       60
       -
             + " --skip 21830a4e-84f1-48fe-9c5b-beab436b2cdb"  # Disk encryption

     

       61
       -
             + " --skip 44e4754a-0b42-4964-9cc2-b88b2023cb1e"  # Pareto Security is up to date

     

       62
       -
             + " --skip f962c423-fdf5-428a-a57a-827abc9b253e"  # Password manager installed

     

       63
       -
             + "'"

     

       64
       -
           )

     

       65
        
       

     

       66
       -
           # Test 3: Test the tray icon

     

       67
       -
           xfce.wait_for_x()

     

       68
       -
           for unit in [

     

       69
       -
               'paretosecurity-trayicon',

     

       70
       -
               'paretosecurity-user',

     

       71
       -
               'paretosecurity-user.timer'

     

       72
       -
           ]:

     

       73
       -
               status, out = xfce.systemctl("is-enabled " + unit, "alice")

     

       74
       -
               assert status == 0, f"Unit {unit} is not enabled (status: {status}): {out}"

     

       75
       -
           xfce.succeed("xdotool mousemove 460 10")

     

       76
       -
           xfce.wait_for_text("Pareto Security")

     

       77
       -
           xfce.succeed("xdotool click 1")

     

       78
       -
           xfce.wait_for_text("Run Checks")

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       79
        
       

     

       80
       -
           # Test 4: Desktop entry

     

       81
       -
           xfce.succeed("xdotool mousemove 10 10")

     

       82
       -
           xfce.succeed("xdotool click 1")  # hide the tray icon window

     

       83
       -
           xfce.succeed("xdotool click 1")  # show the Applications menu

     

       84
       -
           xfce.succeed("xdotool mousemove 10 200")

     

       85
       -
           xfce.succeed("xdotool click 1")

     

       86
       -
           xfce.wait_for_text("Pareto Security")

     

       87
        
       

     

       88
       -
           # Test 5: paretosecurity:// URL handler is registered

     

       89
       -
           xfce.succeed("su - alice -c 'xdg-open paretosecurity://foo'")

     

       90
        
         '';

     

       91
        
       }

···

       9
        
             imports = [ ./common/user-account.nix ];

     

       10
        
       

     

       11
        
             services.paretosecurity.enable = true;

     

       12
       +
             services.paretosecurity.users.alice.inviteId = "test-invite-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";

     

       13
        
           };

     

       14
        
       

     

       15
        
         nodes.xfce =

     
···

       46
        
           terminal.systemctl("start network-online.target")

     

       47
        
           terminal.wait_for_unit("network-online.target")

     

       48
        
       

     

       49
       +
           with subtest("Test the systemd socket is installed & enabled"):

     

       50
       +
             terminal.succeed('systemctl is-enabled paretosecurity.socket')

     

       51
        
       

     

       52
       +
           with subtest("Test running checks"):

     

       53
       +
             terminal.succeed(

     

       54
       +
               "su - alice -c 'paretosecurity check"

     

       55
       +
               # Disable some checks that need intricate test setup so that this test

     

       56
       +
               # remains simple and fast. Tests for all checks and edge cases available

     

       57
       +
               # at https://github.com/ParetoSecurity/agent/tree/main/test/integration

     

       58
       +
               + " --skip c96524f2-850b-4bb9-abc7-517051b6c14e"  # SecureBoot

     

       59
       +
               + " --skip 37dee029-605b-4aab-96b9-5438e5aa44d8"  # Screen lock

     

       60
       +
               + " --skip 21830a4e-84f1-48fe-9c5b-beab436b2cdb"  # Disk encryption

     

       61
       +
               + " --skip 44e4754a-0b42-4964-9cc2-b88b2023cb1e"  # Pareto Security is up to date

     

       62
       +
               + " --skip f962c423-fdf5-428a-a57a-827abc9b253e"  # Password manager installed

     

       63
       +
               + "'"

     

       64
       +
             )

     

       65
        
       

     

       66
       +
           with subtest("Test linking to Pareto Cloud"):

     

       67
       +
             # The linking service will fail because there is no Internet,

     

       68
       +
             # but we can check that it tried

     

       69
       +
             terminal.succeed('systemctl list-units --type=service | grep paretosecurity-link-alice')

     

       70
       +
             terminal.succeed('journalctl -u paretosecurity-link-alice.service | grep "Linking device to Pareto Cloud for user alice"')

     

       71
       +
       

     

       72
       +
           with subtest("Test 3: Test the tray icon"):

     

       73
       +
             xfce.wait_for_x()

     

       74
       +
             for unit in [

     

       75
       +
                 'paretosecurity-trayicon',

     

       76
       +
                 'paretosecurity-user',

     

       77
       +
                 'paretosecurity-user.timer'

     

       78
       +
             ]:

     

       79
       +
                 status, out = xfce.systemctl("is-enabled " + unit, "alice")

     

       80
       +
                 assert status == 0, f"Unit {unit} is not enabled (status: {status}): {out}"

     

       81
       +
             xfce.succeed("xdotool mousemove 460 10")

     

       82
       +
             xfce.wait_for_text("Pareto Security")

     

       83
       +
             xfce.succeed("xdotool click 1")

     

       84
       +
             xfce.wait_for_text("Run Checks")

     

       85
        
       

     

       86
       +
           with subtest("Test 4: Desktop entry"):

     

       87
       +
             xfce.succeed("xdotool mousemove 10 10")

     

       88
       +
             xfce.succeed("xdotool click 1")  # hide the tray icon window

     

       89
       +
             xfce.succeed("xdotool click 1")  # show the Applications menu

     

       90
       +
             xfce.succeed("xdotool mousemove 10 200")

     

       91
       +
             xfce.succeed("xdotool click 1")

     

       92
       +
             xfce.wait_for_text("Pareto Security")

     

       93
        
       

     

       94
       +
           with subtest("Test 5: paretosecurity:// URL handler is registered"):

     

       95
       +
             xfce.succeed("su - alice -c 'xdg-open paretosecurity://foo'")

     

       96
        
         '';

     

       97
        
       }

+12 -8

pkgs/by-name/pa/paretosecurity/package.nix

···

       78
        
         };

     

       79
        
       

     

       80
        
         meta = {

     

       81
       -
           description = "Agent that makes sure your laptop is correctly configured for security";

     

       82
        
           longDescription = ''

     

       83
       -
             The Pareto Security agent is a free and open source app to help you make

     

       84
       -
             sure that your laptop is configured for security.

     

       0
        
       
     

       0
        
       
     

       85
        
       

     

       86
       -
             By default, it's a CLI command that prints out a report on basic security

     

       87
       -
             settings such as if you have disk encryption and firewall enabled.

     

       88
        
       

     

       89
        
             If you use the `services.paretosecurity` NixOS module, you also get a

     

       90
        
             root helper that allows you to run the checker in userspace. Some checks

     
···

       96
        
             once per hour. If you want to use just the CLI mode, set

     

       97
        
             `services.paretosecurity.trayIcon` to `false`.

     

       98
        
       

     

       99
       -
             Finally, you can run `paretosecurity link` to configure the agent

     

       100
       -
             to send the status of checks to https://dash.paretosecurity.com to make

     

       101
       -
             compliance people happy. No sending happens until your device is linked.

     

       0
        
       
     

       0
        
       
     

       102
        
           '';

     

       103
        
           homepage = "https://github.com/ParetoSecurity/agent";

     

       104
        
           license = lib.licenses.gpl3Only;

···

       78
        
         };

     

       79
        
       

     

       80
        
         meta = {

     

       81
       +
           description = "A simple trayicon app that makes sure your laptop is correctly configured for security";

     

       82
        
           longDescription = ''

     

       83
       +
             [Pareto Desktop](https://paretosecurity.com/linux) is a free and open

     

       84
       +
             source trayicon app to help you configure your laptop for security. It

     

       85
       +
             nudges you to take care of 20% of security-related tasks that bring 80% of

     

       86
       +
             protection.

     

       87
        
       

     

       88
       +
             In it's simplest form, it's a CLI command that prints out a report on basic

     

       89
       +
             security settings such as if you have disk encryption and firewall enabled.

     

       90
        
       

     

       91
        
             If you use the `services.paretosecurity` NixOS module, you also get a

     

       92
        
             root helper that allows you to run the checker in userspace. Some checks

     
···

       98
        
             once per hour. If you want to use just the CLI mode, set

     

       99
        
             `services.paretosecurity.trayIcon` to `false`.

     

       100
        
       

     

       101
       +
             Finally, if you set `users.users.alice.paretosecurity.inviteId = "..."`

     

       102
       +
             to the `inviteId` you get on [Pareto Cloud](https://cloud.paretosecurity.com/),

     

       103
       +
             then Pareto Desktop acts as a read-only and push-only agent that sends the

     

       104
       +
             status of checks to https://cloud.paretosecurity.com which makes

     

       105
       +
             compliance people happy and your privacy intact.

     

       106
        
           '';

     

       107
        
           homepage = "https://github.com/ParetoSecurity/agent";

     

       108
        
           license = lib.licenses.gpl3Only;