Use Crowdsec rewrite

flake.nix

@@ -23,6 +23,8 @@
       url = "https://keys.openpgp.org/vks/v1/by-email/wekuz%40duck.com";
       flake = false;
     };
+
+    crowdsec-rewrite.url = "github:TornaxO7/nixpkgs/saltsprint";
   };
 
   outputs =
@@ -37,6 +39,7 @@
       nixosConfigurations = {
         plexy = nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
+          specialArgs = { inherit inputs; };
           modules = [
             ./hosts/plexy
             home-manager.nixosModules.home-manager

hosts/plexy/default.nix

@@ -1,13 +1,21 @@
 {
   config,
   pkgs,
+  inputs,
   ...
 }:
 
 {
+  disabledModules = [
+    "services/security/crowdsec.nix"
+    "services/security/crowdsec-firewall-bouncer.nix"
+  ];
+
   imports = [
     ./hardware-configuration.nix
     ./disko-config.nix
+    "${inputs.crowdsec-rewrite}/nixos/modules/services/security/crowdsec.nix"
+    "${inputs.crowdsec-rewrite}/nixos/modules/services/security/crowdsec-firewall-bouncer.nix"
   ];
 
   nix = {
@@ -149,15 +157,49 @@
       autoUpdateService = true;
 
       settings = {
-        lapi.credentialsFile = "/var/lib/crowdsec/local_api_credentials.yaml";
+        console.enrollKeyFile = config.sops.secrets."crowdsec-console-token".path;
-        console.tokenFile = config.sops.secrets."crowdsec-console-token".path;
+        config = {
-        general = {
+
           api.server = {
             enable = true;
+            online_client.credentials_path = "/var/lib/crowdsec/online_api_credentials.yaml";
           };
-          prometheus.enabled = false;
         };
+
+        acquisitions = [
+          {
+            source = "journalctl";
+            journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
+            labels.type = "syslog";
+          }
+          {
+            source = "journalctl";
+            journalctl_filter = [ "-k" ];
+            labels.type = "syslog";
+          }
+          {
+            source = "journalctl";
+            journalctl_filter = [ "_SYSTEMD_UNIT=caddy.service" ];
+            labels.type = "caddy";
+          }
+          {
+            source = "journalctl";
+            journalctl_filter = [ "_SYSTEMD_UNIT=vaultwarden.service" ];
+            labels.type = "Vaultwarden";
+          }
+          {
+            source = "journalctl";
+            journalctl_filter = [ "_SYSTEMD_UNIT=jellyfin.service" ];
+            labels.type = "jellyfin";
+          }
+          {
+            source = "journalctl";
+            journalctl_filter = [ "_SYSTEMD_UNIT=seerr.service" ];
+            labels.type = "seerr";
+          }
+        ];
       };
+
       hub.collections = [
         "crowdsecurity/linux"
         "crowdsecurity/sshd"
@@ -171,41 +213,11 @@
 
         "crowdsecurity/whitelist-good-actors"
       ];
-      localConfig.acquisitions = [
-        {
-          source = "journalctl";
-          journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
-          labels.type = "syslog";
-        }
-        {
-          source = "journalctl";
-          journalctl_filter = [ "-k" ];
-          labels.type = "syslog";
-        }
-        {
-          source = "journalctl";
-          journalctl_filter = [ "_SYSTEMD_UNIT=caddy.service" ];
-          labels.type = "caddy";
-        }
-        {
-          source = "journalctl";
-          journalctl_filter = [ "_SYSTEMD_UNIT=vaultwarden.service" ];
-          labels.type = "Vaultwarden";
-        }
-        {
-          source = "journalctl";
-          journalctl_filter = [ "_SYSTEMD_UNIT=jellyfin.service" ];
-          labels.type = "jellyfin";
-        }
-        {
-          source = "journalctl";
-          journalctl_filter = [ "_SYSTEMD_UNIT=seerr.service" ];
-          labels.type = "seerr";
-        }
-      ];
     };
     crowdsec-firewall-bouncer = {
       enable = true;
+      registerBouncer.enable = false;
+      secrets.apiKeyPath = "/var/lib/crowdsec/firewall-bouncer-key";
     };
     vaultwarden = {
       enable = true;