Wekuz/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'service-crowdsec' into temp-caddy-crowdsec

Browse source
This commit is contained in:
Wekuz 2026-08-14 19:55:56 +03:00
commit 599cf0d16e
Signed by: Wekuz
GPG key ID: 2E502F2AABD32DF9
3 changed files with 83 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
flake.nix
View file

@ -23,6 +23,8 @@
url = "https://keys.openpgp.org/vks/v1/by-email/wekuz%40duck.com";
flake = false;
};
crowdsec-rewrite.url = "github:TornaxO7/nixpkgs/saltsprint";
};
outputs =
@ -37,6 +39,7 @@
nixosConfigurations = {
plexy = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = { inherit inputs; };
modules = [
./hosts/plexy
home-manager.nixosModules.home-manager

76
hosts/plexy/default.nix
View file

@ -1,13 +1,21 @@
{
config,
pkgs,
inputs,
...
}:
{
disabledModules = [
"services/security/crowdsec.nix"
"services/security/crowdsec-firewall-bouncer.nix"
];
imports = [
./hardware-configuration.nix
./disko-config.nix
"${inputs.crowdsec-rewrite}/nixos/modules/services/security/crowdsec.nix"
"${inputs.crowdsec-rewrite}/nixos/modules/services/security/crowdsec-firewall-bouncer.nix"
];
nix = {
@ -97,6 +105,7 @@
"vaultwarden.env" = { };
"rsyncd.secrets" = { };
"caddy.env" = { };
"crowdsec-console-token" = { };
};
};
@ -247,6 +256,73 @@
};
};
};
crowdsec = {
enable = true;
autoUpdateService = true;
settings = {
console.enrollKeyFile = config.sops.secrets."crowdsec-console-token".path;
config = {
api.server = {
enable = true;
online_client.credentials_path = "/var/lib/crowdsec/online_api_credentials.yaml";
};
};
acquisitions = [
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
labels.type = "syslog";
}
{
source = "journalctl";
journalctl_filter = [ "-k" ];
labels.type = "syslog";
}
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=caddy.service" ];
labels.type = "caddy";
}
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=vaultwarden.service" ];
labels.type = "Vaultwarden";
}
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=jellyfin.service" ];
labels.type = "jellyfin";
}
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=seerr.service" ];
labels.type = "seerr";
}
];
};
hub.collections = [
"crowdsecurity/linux"
"crowdsecurity/sshd"
"crowdsecurity/base-http-scenarios"
"crowdsecurity/caddy"
"Dominic-Wagner/vaultwarden"
"LePresidente/jellyfin"
"LePresidente/jellyseerr"
"crowdsecurity/whitelist-good-actors"
];
};
crowdsec-firewall-bouncer = {
enable = true;
registerBouncer.enable = false;
secrets.apiKeyPath = "/var/lib/crowdsec/firewall-bouncer-key";
};
vaultwarden = {
enable = true;
environmentFile = config.sops.secrets."vaultwarden.env".path;

7
hosts/plexy/secrets.yaml
View file

@ -1,6 +1,7 @@
vaultwarden.env: ENC[AES256_GCM,data:PLNb5cFoJaOyUo5U/gpXH0RGVwwQxL3kCE/OLw7MaLWazuBGHIPUEhH+kDMP2cfF916D63w8Ddgb/oH+lHGCw235YwgoqZ9yjWYPG4VB2Jdw+17LeCbirdh3zv8nNzFnSZDJmhz5Pj82+iswju6sYO/H7UfZ3aeASWonKW9LGHVltKSY1rAVhZRu4SvhqPiAxNpEzN0/EDTl46RIxrgEoUraN+Ie8fh1wU9SKevExkPU3NXGO1gG2tWRxclMPgc=,iv:es40/5HpBAhOy2xmU/yCUD43fVVsAXk6qJ3OasKjK3U=,tag:bneErU9pPZkQ2VzbQ1NrJA==,type:str]
rsyncd.secrets: ENC[AES256_GCM,data:VjHRoZa6/lDtCheKSJyM,iv:kxygNaKOuK0iH/bFY/uKxcbMcYSR8nWDUx+4aDNqTMk=,tag:uYYPWAPCWtvLLGwmOWyH+A==,type:str]
caddy.env: ENC[AES256_GCM,data:xzYvGvtu1DDBWvcLmohHUAOTNQfUuLbOJ18UPgLokkWlzf7peNgN3Qt9A/ZCuEm5cg4PLtJy0LYbWk6ykm20vgDW+TmouJ8dxqwSDvJHdmnhoPYCfu0KA1d3iHPL5f8unqXxxhAbcfp0VSzxUo685on9Aw==,iv:E+o8dJ+t4BPuoiEfkTaOO6lVDAZnG9D1btNYN9oX3ek=,tag:oar1at1PkK4tgIDIXCyXrg==,type:str]
crowdsec-console-token: ENC[AES256_GCM,data:0K2kGXAf7uPhSRSRBIQ5cWjtp9l5oEcCSJg=,iv:O11ZhGU3bM+Ao5IUW0/sKT3L0CTeMsRpJTrCya6T674=,tag:R064lQrFBAIi33N4YVB/5Q==,type:str]
sops:
age:
- enc: |
@ -12,7 +13,7 @@ sops:
hkLDjoWK9dkGRX8kqRd028cuMCQRenLpULEECWp6oV+evUdMf7wRtg==
-----END AGE ENCRYPTED FILE-----
recipient: age1sqssntfzzlhcgp0wuf9wmeavg0hmwmq349npsq8vaxj9sxey5s9ssc82sw
lastmodified: "2026-06-26T20:44:20Z"
mac: ENC[AES256_GCM,data:GxcbV3hdk86tNZlzCcQTG0X206tpwxzkACO5KEF/T+ScvKIrbCYKVfQKmdEBR6/o1oSBP8R5kiNdsQu3ETpsVeb4GRtp3E/C41a7mOXtagvNo0id+kSmZFJNOgl1ki+8mPjZEO3m5IBnQgy1HtfGXe4Dbnk6iaDyyBl7ukJdXYY=,iv:djI/xYTI/WzQaihC2OZiry9swvkKB4LyrJglf2E71NE=,tag:d1Uzu7tVSQqkLMKZ3EZ/fA==,type:str]
lastmodified: "2026-08-14T15:56:25Z"
mac: ENC[AES256_GCM,data:Y0rf6PzXBXgV4J8Zjs73L3Fvl96o/AMFXAqe/FN3w68yIbKvClDegiF2V5SQwpYchcr7xN9Qxwcl+5/OnF6wIoyOa4b94xmwd1ZKMU4MM2omFaT5mUov0lW26PkAGbB8ioMiCjibdXHnFVJMKHYO2cuMfTo3YH1nOUMuQvCQGyg=,iv:aatrE+/Wa5VGHVswrkh6PBkoCi19FBttVJJXZ/JG2+Q=,tag:KAk6sk5NmdB6nwx493hUQw==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.1
version: 3.13.3