clamav: improvements

- Add new service for `clamd`, the ClamAV daemon.
- Replace the old upstart "jobs" section with systemd.services
- Remove unnecessary config options.
- Use `mkEnableOption`

nixos/modules/services/security/clamav.nix

@@ -3,22 +3,37 @@ with lib;
 let
   clamavUser = "clamav";
   stateDir = "/var/lib/clamav";
+  runDir = "/var/run/clamav";
+  logDir = "/var/log/clamav";
   clamavGroup = clamavUser;
   cfg = config.services.clamav;
+  clamdConfigFile = pkgs.writeText "clamd.conf" ''
+    DatabaseDirectory ${stateDir}
+    LocalSocket ${runDir}/clamd.ctl
+    LogFile ${logDir}/clamav.log
+    PidFile ${runDir}/clamd.pid
+    User clamav
+
+    ${cfg.daemon.extraConfig}
+  '';
 in
 {
-  ###### interface
-
   options = {
-
     services.clamav = {
-      updater = {
+      daemon = {
-        enable = mkOption {
+        enable = mkEnableOption "clamd daemon";
-        default = false;
+
-        description = ''
+        extraConfig = mkOption {
-            Whether to enable automatic ClamAV virus definitions database updates.
+          type = types.lines;
+          default = "";
+          description = ''
+            Extra configuration for clamd. Contents will be added verbatim to the
+            configuration file.
           '';
         };
+      };
+      updater = {
+        enable = mkEnableOption "freshclam updater";
 
         frequency = mkOption {
           default = 12;
@@ -38,43 +53,65 @@ in
     };
   };
 
-  ###### implementation
+  config = mkIf cfg.updater.enable or cfg.daemon.enable {
-
-  config = mkIf cfg.updater.enable {
     environment.systemPackages = [ pkgs.clamav ];
-    users.extraUsers = singleton
+    users.extraUsers = singleton {
-      { name = clamavUser;
+      name = clamavUser;
-        uid = config.ids.uids.clamav;
+      uid = config.ids.uids.clamav;
-        description = "ClamAV daemon user";
+      description = "ClamAV daemon user";
-        home = stateDir;
+      home = stateDir;
-      };
+    };
 
-    users.extraGroups = singleton
+    users.extraGroups = singleton {
-      { name = clamavGroup;
+      name = clamavGroup;
-        gid = config.ids.gids.clamav;
+      gid = config.ids.gids.clamav;
-      };
+    };
 
-    services.clamav.updater.config = ''
+    services.clamav.updater.config = mkIf cfg.updater.enable ''
       DatabaseDirectory ${stateDir}
       Foreground yes
       Checks ${toString cfg.updater.frequency}
       DatabaseMirror database.clamav.net
     '';
 
-    jobs = {
+    systemd.services.clamd = mkIf cfg.daemon.enable {
-      clamav_updater = {
+      description = "ClamAV daemon (clamd)";
-	      name = "clamav-updater";
+      path = [ pkgs.clamav ];
-        startOn = "started network-interfaces";
+      after = [ "network.target" "freshclam.service" ];
-        stopOn = "stopping network-interfaces";
+      requires = [ "freshclam.service" ];
-
+      wantedBy = [ "multi-user.target" ];
-        preStart = ''
+      preStart = ''
-          mkdir -m 0755 -p ${stateDir}
+        mkdir -m 0755 -p ${logDir}
-          chown ${clamavUser}:${clamavGroup} ${stateDir}
+        mkdir -m 0755 -p ${runDir}
-          '';
+        chown ${clamavUser}:${clamavGroup} ${logDir}
-        exec = "${pkgs.clamav}/bin/freshclam --daemon --config-file=${pkgs.writeText "freshclam.conf" cfg.updater.config}";
+        chown ${clamavUser}:${clamavGroup} ${runDir}
-      }; 
+      '';
+      serviceConfig = {
+        ExecStart = "${pkgs.clamav}/bin/clamd --config-file=${clamdConfigFile}";
+        Type = "forking";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        Restart = "on-failure";
+        RestartSec = "10s";
+        StartLimitInterval = "1min";
+      };
     };
 
+    systemd.services.freshclam = mkIf cfg.updater.enable {
+      description = "ClamAV updater (freshclam)";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      path = [ pkgs.clamav ];
+      preStart = ''
+        mkdir -m 0755 -p ${stateDir}
+        chown ${clamavUser}:${clamavGroup} ${stateDir}
+      '';
+      serviceConfig = {
+        ExecStart = "${pkgs.clamav}/bin/freshclam --daemon --config-file=${pkgs.writeText "freshclam.conf" cfg.updater.config}";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        Restart = "on-failure";
+        RestartSec = "10s";
+        StartLimitInterval = "1min";
+      };
+    };
   };
-
 }