From ba643a09b2da793815f59217c61031c3f5f3a5e9 Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Tue, 13 Jan 2026 18:05:03 +0200
Subject: [PATCH] podman and opensnitch

---
 modules/packages.nix |  2 +-
 modules/programs.nix |  8 ++++++--
 modules/security.nix | 13 ++++++-------
 modules/users.nix    |  2 +-
 4 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/modules/packages.nix b/modules/packages.nix
index a5d11a9..0f2fc47 100644
--- a/modules/packages.nix
+++ b/modules/packages.nix
@@ -88,7 +88,7 @@
     awscli2
     # azure-cli
     google-cloud-sdk
-    docker-compose
+    podman-compose
     argocd
     fluxcd
     kubectx         # switch between contexts/namespaces
diff --git a/modules/programs.nix b/modules/programs.nix
index dff0b34..5e59fe8 100644
--- a/modules/programs.nix
+++ b/modules/programs.nix
@@ -43,6 +43,10 @@
   virtualisation.libvirtd.enable = true;
   programs.virt-manager.enable = true;
 
-  # Docker
-  virtualisation.docker.enable = true;
+  # Container Runtimes
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    defaultNetwork.settings.dns_enabled = true;
+  };
 }
diff --git a/modules/security.nix b/modules/security.nix
index 31d2e11..2efd193 100644
--- a/modules/security.nix
+++ b/modules/security.nix
@@ -5,13 +5,10 @@
     ./usb-devices.nix
   ];
 
-  # Use the hardened kernel for better security
   boot.kernelPackages = lib.mkForce pkgs.linuxPackages_hardened;
 
-  # Only allow members of the wheel group to execute sudo
   security.sudo.execWheelOnly = true;
 
-  # Linux Audit Framework
   security.auditd.enable = true;
   security.audit.enable = true;
   security.audit.rules = [
@@ -20,10 +17,8 @@
     "-w /etc/shadow -p wa -k shadow_changes"
   ];
 
-  # Kernel Hardening
   security.protectKernelImage = true;
 
-  # Sysctl hardening
   boot.kernel.sysctl = {
     "kernel.dmesg_restrict" = 1;
     "kernel.kptr_restrict" = 2;
@@ -42,13 +37,15 @@
     "net.ipv6.conf.default.accept_redirects" = 0;
   };
 
-  # USBGuard configuration
   services.usbguard = {
     enable = true;
     dbus.enable = true;
     implicitPolicyTarget = "block";
   };
 
+  # OpenSnitch Application Firewall
+  services.opensnitch.enable = true;
+
   security.pam.loginLimits = [
     { domain = "*"; item = "core"; type = "-"; value = "0"; }
   ];
@@ -58,7 +55,7 @@
     RestrictAddressFamilies = "AF_UNIX AF_NETLINK";
   };
 
-  # Podman socket for all users
+  # Declaratively enable Podman socket for all users
   systemd.user.sockets.podman.wantedBy = [ "sockets.target" ];
 
   virtualisation = {
@@ -84,5 +81,7 @@
     lynis
     audit
     tcpdump
+    bandwhich
+    opensnitch-ui
   ];
 }
diff --git a/modules/users.nix b/modules/users.nix
index 46dd89c..4857982 100644
--- a/modules/users.nix
+++ b/modules/users.nix
@@ -8,7 +8,7 @@
   users.users.asxpi = {
     isNormalUser = true;
     description = "Sergei P";
-    extraGroups = [ "networkmanager" "wheel" "dialout" "libvirtd" "docker" ];
+    extraGroups = [ "networkmanager" "wheel" "dialout" "libvirtd" "podman" ];
     shell = pkgs.zsh;
     packages = with pkgs; [
       # Internet