https://github.com/hardenedlinux/zeek2nix

An operator which calls zeek to nix-ecosystem simply.
https://github.com/hardenedlinux/zeek2nix

ids network-monitoring nix zeek zeek-ids zeek-package

Last synced: 3 months ago
JSON representation

An operator which calls zeek to nix-ecosystem simply.

• Host: GitHub
• URL: https://github.com/hardenedlinux/zeek2nix
• Owner: hardenedlinux
• License: mit
• Created: 2020-10-02T09:48:36.000Z (over 4 years ago)
• Default Branch: main
• Last Pushed: 2023-03-06T15:58:37.000Z (almost 2 years ago)
• Last Synced: 2024-07-29T19:15:12.633Z (6 months ago)
• Topics: ids, network-monitoring, nix, zeek, zeek-ids, zeek-package
• Language: Nix
• Homepage:
• Size: 2.04 MB
• Stars: 9
• Watchers: 5
• Forks: 3
• Open Issues: 2
• Metadata Files:
  • Readme: README.org
  • License: LICENSE

Awesome Lists containing this project

README

        
#+TITLE: Zeek to Nix Flake's feature

* Building Zeek with nix-shell(shell mode)

#+begin_src sh :async t :exports both :results output

nix develop

# or

nix-shell

#+end_src

* Library

** Building zeek with plugins

#+begin_src nix :async :exports both :results output

mkZeekPlugins = inputs.zeek2nix.lib.zeekWithPlugins {

  package = inputs.zeek2nix.packages.${system}.zeek-latest;

  plugins = [

    {

      src = inputs.zeek2nix.lib.nixpkgs.zeek-sources.zeek-community-id;

    }

  ];

  };

#+end_src

** Testing your Zeek Plugin src with Nix-CI

#+begin_src nix :async :exports both :results output

mkZeekPluginCI = nixpkgs.zeekPluginCi {

    plugins = [

      {

        src = inputs.zeek2nix.lib.nixpkgs.zeek-sources.zeek-netmap;

      }

    ];

    buildInputs = [inputs.zeek2nix.lib.nixpkgs.netmap];

  };

#+end_src

* Deploying Zeek with NixOS (flakes feature)

#+begin_src nix :async t :exports both :results output

{

  inputs =

    {

      zeek-nix = {

        url = "github:hardenedlinux/zeek-nix/main";

        inputs.nixpkgs.follows = "nixos";

      };

      "..."

        };

        outputs = { self, zeek-nix, nixpkgs, ... }: {

        nixosConfigurations.myConfig = nixpkgs.lib.nixosSystem {

          system = "...";

          modules = [

            zeek-nix.nixosModules.zeek

            ({ ... }: {

              services.zeek = {

                enable = true;

                standalone = true;

                interface = "eno1";

                listenAddress = "localhost";

                package = pkgs.zeekWithPlugins {

                  package = pkgs.zeek-latest;

                  plugins = [

                    {

                      src = pkgs.zeek-sources.zeek-community-id;

                    }

                  ];

                };

                privateScript = ''

                  @load /home/gtrun/project/hardenedlinux-zeek-script/scripts/zeek-query.zeek

                  @load /home/gtrun/project/hardenedlinux-zeek-script/scripts/log-passwords.zeek

                '';

              };

            })

          ];

        };

      };

    }

#+end_src

* creating the zeek dynamic dir to ~/var/lib/zeek~

:BACKLINKS:

[2020-10-09 Fri 19:35] <- [[*Build Zeek with nix-build -> result/bin/zeek (Current version)][Build Zeek with nix-build -> result/bin/zeek (Current version)]]

:END:

#+begin_src sh :async t :exports both :results output

sudo bash ./pre-run-zeekctl.sh

#+end_src

* Optional: using cachix to speed up binary build

#+begin_src sh :async t :exports both :results output

nix-env -iA cachix -f https://cachix.org/api/v1/install

cachix use zeek

#+end_src