Wekuz/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use Crowdsec rewrite

Browse source
This commit is contained in:
Wekuz 2026-07-23 16:28:31 +03:00
parent 76f19a2ac9
commit 796a42e70e
Signed by: Wekuz
GPG key ID: 2E502F2AABD32DF9
2 changed files with 51 additions and 36 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
flake.nix
View file

@ -23,6 +23,8 @@
url = "https://keys.openpgp.org/vks/v1/by-email/wekuz%40duck.com";
flake = false;
};
crowdsec-rewrite.url = "github:TornaxO7/nixpkgs/saltsprint";
};
outputs =
@ -37,6 +39,7 @@
nixosConfigurations = {
plexy = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = { inherit inputs; };
modules = [
./hosts/plexy
home-manager.nixosModules.home-manager

84
hosts/plexy/default.nix
View file

@ -1,13 +1,21 @@
{
config,
pkgs,
inputs,
...
}:
{
disabledModules = [
"services/security/crowdsec.nix"
"services/security/crowdsec-firewall-bouncer.nix"
];
imports = [
./hardware-configuration.nix
./disko-config.nix
"${inputs.crowdsec-rewrite}/nixos/modules/services/security/crowdsec.nix"
"${inputs.crowdsec-rewrite}/nixos/modules/services/security/crowdsec-firewall-bouncer.nix"
];
nix = {
@ -149,15 +157,49 @@
autoUpdateService = true;
settings = {
lapi.credentialsFile = "/var/lib/crowdsec/local_api_credentials.yaml";
console.tokenFile = config.sops.secrets."crowdsec-console-token".path;
general = {
console.enrollKeyFile = config.sops.secrets."crowdsec-console-token".path;
config = {
api.server = {
enable = true;
online_client.credentials_path = "/var/lib/crowdsec/online_api_credentials.yaml";
};
prometheus.enabled = false;
};
acquisitions = [
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
labels.type = "syslog";
}
{
source = "journalctl";
journalctl_filter = [ "-k" ];
labels.type = "syslog";
}
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=caddy.service" ];
labels.type = "caddy";
}
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=vaultwarden.service" ];
labels.type = "Vaultwarden";
}
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=jellyfin.service" ];
labels.type = "jellyfin";
}
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=seerr.service" ];
labels.type = "seerr";
}
];
};
hub.collections = [
"crowdsecurity/linux"
"crowdsecurity/sshd"
@ -171,41 +213,11 @@
"crowdsecurity/whitelist-good-actors"
];
localConfig.acquisitions = [
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
labels.type = "syslog";
}
{
source = "journalctl";
journalctl_filter = [ "-k" ];
labels.type = "syslog";
}
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=caddy.service" ];
labels.type = "caddy";
}
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=vaultwarden.service" ];
labels.type = "Vaultwarden";
}
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=jellyfin.service" ];
labels.type = "jellyfin";
}
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=seerr.service" ];
labels.type = "seerr";
}
];
};
crowdsec-firewall-bouncer = {
enable = true;
registerBouncer.enable = false;
secrets.apiKeyPath = "/var/lib/crowdsec/firewall-bouncer-key";
};
vaultwarden = {
enable = true;