From 86d87814292411684a41c905c84440493f9d8249 Mon Sep 17 00:00:00 2001
From: Wekuz <wekuz@duck.com>
Date: Thu, 23 Jul 2026 16:28:31 +0300
Subject: [PATCH] Use Crowdsec rewrite

---
 flake.nix               |  3 +++
 hosts/plexy/default.nix | 18 ++++++++++++++----
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/flake.nix b/flake.nix
index fcd890d..f298dc7 100644
--- a/flake.nix
+++ b/flake.nix
@@ -23,6 +23,8 @@
       url = "https://keys.openpgp.org/vks/v1/by-email/wekuz%40duck.com";
       flake = false;
     };
+
+    crowdsec-rewrite.url = "github:TornaxO7/nixpkgs/saltsprint";
   };
 
   outputs =
@@ -37,6 +39,7 @@
       nixosConfigurations = {
         plexy = nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
+          specialArgs = { inherit inputs; };
           modules = [
             ./hosts/plexy
             home-manager.nixosModules.home-manager
diff --git a/hosts/plexy/default.nix b/hosts/plexy/default.nix
index b361950..2d7abce 100644
--- a/hosts/plexy/default.nix
+++ b/hosts/plexy/default.nix
@@ -1,13 +1,21 @@
 {
   config,
   pkgs,
+  inputs,
   ...
 }:
 
 {
+  disabledModules = [
+    "services/security/crowdsec.nix"
+    "services/security/crowdsec-firewall-bouncer.nix"
+  ];
+
   imports = [
     ./hardware-configuration.nix
     ./disko-config.nix
+    "${inputs.crowdsec-rewrite}/nixos/modules/services/security/crowdsec.nix"
+    "${inputs.crowdsec-rewrite}/nixos/modules/services/security/crowdsec-firewall-bouncer.nix"
   ];
 
   nix = {
@@ -149,15 +157,17 @@
       autoUpdateService = true;
 
       settings = {
-        lapi.credentialsFile = "/var/lib/crowdsec/local_api_credentials.yaml";
-        console.tokenFile = config.sops.secrets."crowdsec-console-token".path;
-        general = {
+        config = {
+          lapi.credentialsFile = "/var/lib/crowdsec/local_api_credentials.yaml";
+          console.tokenFile = config.sops.secrets."crowdsec-console-token".path;
+
           api.server = {
             enable = true;
           };
           prometheus.enabled = false;
         };
       };
+
       hub.collections = [
         "crowdsecurity/linux"
         "crowdsecurity/sshd"
@@ -171,7 +181,7 @@
 
         "crowdsecurity/whitelist-good-actors"
       ];
-      localConfig.acquisitions = [
+      acquisitions = [
         {
           source = "journalctl";
           journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];