Wekuz/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use Crowdsec rewrite

Browse source
This commit is contained in:
Wekuz 2026-07-23 16:28:31 +03:00
parent 76f19a2ac9
commit 86d8781429
Signed by: Wekuz
GPG key ID: 2E502F2AABD32DF9
2 changed files with 17 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
flake.nix
View file

@ -23,6 +23,8 @@
url = "https://keys.openpgp.org/vks/v1/by-email/wekuz%40duck.com"; url = "https://keys.openpgp.org/vks/v1/by-email/wekuz%40duck.com";
flake = false; flake = false;
}; };
crowdsec-rewrite.url = "github:TornaxO7/nixpkgs/saltsprint";
}; };
outputs = outputs =
@ -37,6 +39,7 @@
nixosConfigurations = { nixosConfigurations = {
plexy = nixpkgs.lib.nixosSystem { plexy = nixpkgs.lib.nixosSystem {
system = "x86_64-linux"; system = "x86_64-linux";
specialArgs = { inherit inputs; };
modules = [ modules = [
./hosts/plexy ./hosts/plexy
home-manager.nixosModules.home-manager home-manager.nixosModules.home-manager

18
hosts/plexy/default.nix
View file

@ -1,13 +1,21 @@
{ {
config, config,
pkgs, pkgs,
inputs,
... ...
}: }:
{ {
disabledModules = [
"services/security/crowdsec.nix"
"services/security/crowdsec-firewall-bouncer.nix"
];
imports = [ imports = [
./hardware-configuration.nix ./hardware-configuration.nix
./disko-config.nix ./disko-config.nix
"${inputs.crowdsec-rewrite}/nixos/modules/services/security/crowdsec.nix"
"${inputs.crowdsec-rewrite}/nixos/modules/services/security/crowdsec-firewall-bouncer.nix"
]; ];
nix = { nix = {
@ -149,15 +157,17 @@
autoUpdateService = true; autoUpdateService = true;
settings = { settings = {
lapi.credentialsFile = "/var/lib/crowdsec/local_api_credentials.yaml"; config = {
console.tokenFile = config.sops.secrets."crowdsec-console-token".path; lapi.credentialsFile = "/var/lib/crowdsec/local_api_credentials.yaml";
general = { console.tokenFile = config.sops.secrets."crowdsec-console-token".path;
api.server = { api.server = {
enable = true; enable = true;
}; };
prometheus.enabled = false; prometheus.enabled = false;
}; };
}; };
hub.collections = [ hub.collections = [
"crowdsecurity/linux" "crowdsecurity/linux"
"crowdsecurity/sshd" "crowdsecurity/sshd"
@ -171,7 +181,7 @@
"crowdsecurity/whitelist-good-actors" "crowdsecurity/whitelist-good-actors"
]; ];
localConfig.acquisitions = [ acquisitions = [
{ {
source = "journalctl"; source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ]; journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];