podman and opensnitch

modules/packages.nix

@@ -88,7 +88,7 @@
     awscli2
     # azure-cli
     google-cloud-sdk
-    docker-compose
+    podman-compose
     argocd
     fluxcd
     kubectx         # switch between contexts/namespaces

modules/programs.nix

@@ -42,7 +42,4 @@
   # Virtualization (KVM/QEMU)
   virtualisation.libvirtd.enable = true;
   programs.virt-manager.enable = true;
-
-  # Docker
-  virtualisation.docker.enable = true;
 }

modules/security.nix

@@ -49,6 +49,9 @@
     implicitPolicyTarget = "block";
   };
 
+  # OpenSnitch Application Firewall
+  services.opensnitch.enable = true;
+
   security.pam.loginLimits = [
     { domain = "*"; item = "core"; type = "-"; value = "0"; }
   ];
@@ -84,5 +87,7 @@
     lynis
     audit
     tcpdump
+    bandwhich
+    opensnitch-ui
   ];
 }

modules/users.nix

@@ -8,7 +8,7 @@
   users.users.asxpi = {
     isNormalUser = true;
     description = "Sergei P";
-    extraGroups = [ "networkmanager" "wheel" "dialout" "libvirtd" "docker" ];
+    extraGroups = [ "networkmanager" "wheel" "dialout" "libvirtd" "podman" ];
     shell = pkgs.zsh;
     packages = with pkgs; [
       # Internet