soarca: init at unstable-2024-12-19

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -44,6 +44,8 @@
 
 - [Whoogle Search](https://github.com/benbusby/whoogle-search), a self-hosted, ad-free, privacy-respecting metasearch engine. Available as [services.whoogle-search](options.html#opt-services.whoogle-search.enable).
 
+- [SOARCA](https://github.com/COSSAS/SOARCA), an open source CACAO-based security orchestrator. Available as [services.soarca](options.html#opt-services.soarca.enable).
+
 - [agorakit](https://github.com/agorakit/agorakit), an organization tool for citizens' collectives. Available with [services.agorakit](options.html#opt-services.agorakit.enable).
 
 - [waagent](https://github.com/Azure/WALinuxAgent), the Microsoft Azure Linux Agent (waagent) manages Linux provisioning and VM interaction with the Azure Fabric Controller. Available with [services.waagent](options.html#opt-services.waagent.enable).

nixos/modules/module-list.nix

@@ -1365,6 +1365,7 @@
   ./services/security/physlock.nix
   ./services/security/shibboleth-sp.nix
   ./services/security/sks.nix
+  ./services/security/soarca.nix
   ./services/security/sshguard.nix
   ./services/security/sslmate-agent.nix
   ./services/security/step-ca.nix

nixos/modules/services/security/soarca.nix

@@ -0,0 +1,73 @@
+{ config, lib, pkgs, ... }:
+
+let cfg = config.services.soarca;
+in {
+  options.services.soarca = {
+    enable = lib.mkEnableOption "SOARCA";
+    package = lib.mkPackageOption pkgs "soarca" { };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = with lib.types;
+          attrsOf (nullOr (oneOf [ bool int str ]));
+        options = { };
+      };
+      default = { };
+      example = {
+        PORT = 9000;
+        GIN_MODE = "release";
+        DATABASE = false;
+      };
+      description = ''
+        See [the wiki](https://cossas.github.io/SOARCA/docs/installation-configuration/) for available settings.
+      '';
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "soarca";
+      description = "User under which SOARCA will run.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "soarca";
+      description = "Group under which SOARCA will run.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.packages = [ cfg.package ];
+
+    systemd.services.soarca = {
+      description = "SOARCA Service";
+      wantedBy = [ "multi-user.target" ];
+      restartIfChanged = true;
+
+      environment = lib.mapAttrs
+        (_: v: if lib.isBool v then lib.boolToString v else toString v)
+        cfg.settings;
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart = "${lib.getExe cfg.package}";
+        Restart = "on-failure";
+        RestartSec = "5";
+      };
+    };
+
+    users.users = lib.optionalAttrs (cfg.user == "soarca") {
+      soarca = {
+        group = cfg.group;
+        isNormalUser = true;
+      };
+    };
+
+    users.groups = lib.optionalAttrs (cfg.group == "soarca") {
+      soarca = { };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ _13621 ];
+}

nixos/tests/all-tests.nix

@@ -949,6 +949,7 @@ in {
   snapper = handleTest ./snapper.nix {};
   snipe-it = runTest ./web-apps/snipe-it.nix;
   soapui = handleTest ./soapui.nix {};
+  soarca = handleTest ./soarca.nix {};
   soft-serve = handleTest ./soft-serve.nix {};
   sogo = handleTest ./sogo.nix {};
   soju = handleTest ./soju.nix {};

nixos/tests/soarca.nix

@@ -0,0 +1,22 @@
+import ./make-test-python.nix(
+  { lib, pkgs, ... }:
+  {
+    name = "soarca";
+    meta.maintainers = with lib.maintainers; [ _13621 ];
+
+    nodes.machine = {
+      services.soarca = {
+        package = pkgs.soarca;
+        enable = true;
+        settings.PORT = 8475;
+      };
+    };
+
+    testScript = ''
+      machine.wait_for_unit("soarca.service")
+      machine.wait_for_open_port(8475)
+
+      machine.succeed("curl --fail http://localhost:8475/status/ping | grep 'pong'")
+    '';
+  }
+)

pkgs/by-name/so/soarca/package.nix

@@ -0,0 +1,59 @@
+{ lib, buildGoModule, fetchFromGitHub, go-swag, nixosTests, nix-update-script, }:
+
+buildGoModule {
+  pname = "soarca";
+  version = "unstable-2024-12-19";
+
+  src = fetchFromGitHub {
+    owner = "COSSAS";
+    repo = "SOARCA";
+    rev = "fe560ac6d5c7b372c81cec16937782758a089f26";
+    hash = "sha256-4QN6zx2TajUIERH+YqmuNUb/ZbJHUWKrHdrOiyHXsWc=";
+  };
+
+  vendorHash = "sha256-pATXKcPbAvh8Hsa3v2TkQq8AqN+RVNirT1OegdShWwQ=";
+
+  ldflags = [ "-s" "-w" ];
+
+  preBuild = ''
+    mkdir -p api
+    ${go-swag}/bin/swag init -g cmd/soarca/main.go -o api
+  '';
+
+  checkFlags = let
+    skippedTests = [
+      # require internet access
+      "TestHttpConnection"
+      "TestHttpOAuth2"
+      "TestHttpBasicAuth"
+      "TestHttpBearerToken"
+      "TestHttpPostWithContentConnection"
+      "TestHttpPostWithBase64ContentConnection"
+      "TestHttpPostConnection"
+      "TestHttpPutConnection"
+      "TestHttpDeleteConnection"
+      "TestHttpStatus200"
+      "TestHttpGetConnection"
+      "TestInsecureHTTPConnection"
+      "TestSshConnection"
+      "TestConnect" # times out
+      # integrations
+      "TestPowershellConnection"
+      "TestTheHiveConnection"
+      "TestTheHiveReporting"
+    ];
+  in [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
+  passthru = {
+    tests.soarca = nixosTests.soarca;
+    updateScript = nix-update-script {};
+  };
+
+  meta = {
+    description = "SOARCA - The Open Source CACAO-based Security Orchestrator";
+    homepage = "https://github.com/COSSAS/SOARCA";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ _13621 ];
+    mainProgram = "soarca";
+  };
+}