From 2b949f04ce82bd271bba4a39469bb024815a8ea0 Mon Sep 17 00:00:00 2001 From: Wekuz Date: Sun, 5 Jul 2026 22:59:30 +0300 Subject: [PATCH 1/6] temp: Crowdsec --- hosts/plexy/default.nix | 65 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) diff --git a/hosts/plexy/default.nix b/hosts/plexy/default.nix index 47a72cc..cf51911 100644 --- a/hosts/plexy/default.nix +++ b/hosts/plexy/default.nix @@ -143,6 +143,71 @@ }; }; }; + crowdsec = { + enable = true; + autoUpdateService = true; + + settings = { + lapi.credentialsFile = "/var/lib/crowdsec/lapi.yaml"; + capi.credentialsFile = "/var/lib/crowdsec/capi.yaml"; + general = { + api.server = { + enable = true; + listen_uri = "http://127.0.0.1:8080"; + }; + prometheus.enabled = false; + }; + }; + hub.collections = [ + "crowdsecurity/linux" + "crowdsecurity/sshd" + + "crowdsecurity/base-http-scenarios" + "crowdsecurity/caddy" + + "Dominic-Wagner/vaultwarden" + "LePresidente/jellyfin" + "LePresidente/jellyseerr" + + "crowdsecurity/whitelists" + "crowdsecurity/whitelist-good-actors" + ]; + localConfig.acquisitions = [ + { + source = "journalctl"; + journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ]; + labels.type = "syslog"; + } + { + source = "journalctl"; + journalctl_filter = [ "-k" ]; + labels.type = "syslog"; + } + { + source = "journalctl"; + journalctl_filter = [ "_SYSTEMD_UNIT=caddy.service" ]; + labels.type = "caddy"; + } + { + source = "journalctl"; + journalctl_filter = [ "_SYSTEMD_UNIT=vaultwarden.service" ]; + labels.type = "Vaultwarden"; + } + { + source = "journalctl"; + journalctl_filter = [ "_SYSTEMD_UNIT=jellyfin.service" ]; + labels.type = "jellyfin"; + } + { + source = "journalctl"; + journalctl_filter = [ "_SYSTEMD_UNIT=seerr.service" ]; + labels.type = "seerr"; + } + ]; + }; + crowdsec-firewall-bouncer = { + enable = true; + }; vaultwarden = { enable = true; environmentFile = config.sops.secrets."vaultwarden.env".path; From 382e6e20a0419ddc26f90f90c0bf05974a51edf2 Mon Sep 17 00:00:00 2001 From: Wekuz Date: Mon, 6 Jul 2026 11:42:30 +0300 Subject: [PATCH 2/6] remove whitelist --- hosts/plexy/default.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/hosts/plexy/default.nix b/hosts/plexy/default.nix index cf51911..54e0cff 100644 --- a/hosts/plexy/default.nix +++ b/hosts/plexy/default.nix @@ -169,7 +169,6 @@ "LePresidente/jellyfin" "LePresidente/jellyseerr" - "crowdsecurity/whitelists" "crowdsecurity/whitelist-good-actors" ]; localConfig.acquisitions = [ From b432cac554d64982ce89098e8178f3aa47328b87 Mon Sep 17 00:00:00 2001 From: Wekuz Date: Mon, 6 Jul 2026 12:01:49 +0300 Subject: [PATCH 3/6] s --- hosts/plexy/default.nix | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/hosts/plexy/default.nix b/hosts/plexy/default.nix index 54e0cff..c7d6f70 100644 --- a/hosts/plexy/default.nix +++ b/hosts/plexy/default.nix @@ -148,8 +148,7 @@ autoUpdateService = true; settings = { - lapi.credentialsFile = "/var/lib/crowdsec/lapi.yaml"; - capi.credentialsFile = "/var/lib/crowdsec/capi.yaml"; + lapi.credentialsFile = "/var/lib/crowdsec/local_api_credentials.yaml"; general = { api.server = { enable = true; From 9e0412be5b96e624158b7fc16200b62e56358a72 Mon Sep 17 00:00:00 2001 From: Wekuz Date: Mon, 6 Jul 2026 17:15:48 +0300 Subject: [PATCH 4/6] token --- hosts/plexy/default.nix | 2 ++ hosts/plexy/secrets.yaml | 11 ++++++----- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/hosts/plexy/default.nix b/hosts/plexy/default.nix index c7d6f70..0b10fba 100644 --- a/hosts/plexy/default.nix +++ b/hosts/plexy/default.nix @@ -96,6 +96,7 @@ secrets = { "vaultwarden.env" = { }; "rsyncd.secrets" = { }; + "crowdsec-console-token" = { }; }; }; @@ -149,6 +150,7 @@ settings = { lapi.credentialsFile = "/var/lib/crowdsec/local_api_credentials.yaml"; + console.tokenFile = config.sops.secrets."crowdsec-console-token".path; general = { api.server = { enable = true; diff --git a/hosts/plexy/secrets.yaml b/hosts/plexy/secrets.yaml index 2390d9a..0369573 100644 --- a/hosts/plexy/secrets.yaml +++ b/hosts/plexy/secrets.yaml @@ -1,9 +1,9 @@ vaultwarden.env: ENC[AES256_GCM,data:PLNb5cFoJaOyUo5U/gpXH0RGVwwQxL3kCE/OLw7MaLWazuBGHIPUEhH+kDMP2cfF916D63w8Ddgb/oH+lHGCw235YwgoqZ9yjWYPG4VB2Jdw+17LeCbirdh3zv8nNzFnSZDJmhz5Pj82+iswju6sYO/H7UfZ3aeASWonKW9LGHVltKSY1rAVhZRu4SvhqPiAxNpEzN0/EDTl46RIxrgEoUraN+Ie8fh1wU9SKevExkPU3NXGO1gG2tWRxclMPgc=,iv:es40/5HpBAhOy2xmU/yCUD43fVVsAXk6qJ3OasKjK3U=,tag:bneErU9pPZkQ2VzbQ1NrJA==,type:str] rsyncd.secrets: ENC[AES256_GCM,data:VjHRoZa6/lDtCheKSJyM,iv:kxygNaKOuK0iH/bFY/uKxcbMcYSR8nWDUx+4aDNqTMk=,tag:uYYPWAPCWtvLLGwmOWyH+A==,type:str] +crowdsec-console-token: ENC[AES256_GCM,data:kW0ztvpScqEDYeD++0StmzWfKuHzPwXnDEk=,iv:jwNBiPdJb4pfQ4cpheNfum0b5U0udvokp919sS7S6T8=,tag:yvGumTuO54rxsWYekn3pqw==,type:str] sops: age: - - recipient: age1sqssntfzzlhcgp0wuf9wmeavg0hmwmq349npsq8vaxj9sxey5s9ssc82sw - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXSERvcGNXdDlUb3NBUm40 WW1mVlY5YlpxclBxT3htQ1orbHpxTnBUTEJNCkZaZnUzZUZNQmk0RmU2U2RkOUVI @@ -11,7 +11,8 @@ sops: eDUxR1V0ZEFSYnZTYnYzakFydEliaFUKoa/gHecAy01vTk7I02KMGGPHZBql5K48 hkLDjoWK9dkGRX8kqRd028cuMCQRenLpULEECWp6oV+evUdMf7wRtg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-03T15:46:07Z" - mac: ENC[AES256_GCM,data:gh9Voy28Lo4G1qwQ7/WVAt/L3SAXIY5bs5fdCE0Oywi0ZV4YTJI5VCAcfxuE0Fc3DXdHF0/LORGjKa2l0yp5msMdBVpzI46FBiwYvU+w7EfEoEmhu0yMLf0SZmXkVLEq8u2uVFHGVbR1dOKcdFef+qTIGTlz4cE9VQ01xg/nh7g=,iv:fasXOAm2hjB4ULKT4vPOFnFpAcEgSeNvNM7Zrnk6MvM=,tag:1hWtpuTVdC3H8flA1m0Z0A==,type:str] + recipient: age1sqssntfzzlhcgp0wuf9wmeavg0hmwmq349npsq8vaxj9sxey5s9ssc82sw + lastmodified: "2026-07-06T14:12:01Z" + mac: ENC[AES256_GCM,data:nIyEuWKDcwntAFREXz3Ye5WjRgizR+p/5akCvcF3aR5YSrcrx+BvsilB8bssSeD9IPcFT+MD12nkIlmLH93MtT6qskKkx4h2szmfQRDLnVooNYHa9ZDxm/gvB1wkmNLSM/18f3RsUtUM6VxyzK6PoWo0PdEp3Zt2hMq8g3Awjk4=,iv:I+w4HZxP9lHFDr+Z1nT2txAq32gYnEomymOV//2zQxU=,tag:uept/iFzDCHutrb0JtjWDA==,type:str] unencrypted_suffix: _unencrypted - version: 3.12.2 + version: 3.13.2 From 76f19a2ac9b994937a6183e97def37d8a66fd3e4 Mon Sep 17 00:00:00 2001 From: Wekuz Date: Mon, 6 Jul 2026 18:24:18 +0300 Subject: [PATCH 5/6] rm listen --- hosts/plexy/default.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/hosts/plexy/default.nix b/hosts/plexy/default.nix index 0b10fba..b361950 100644 --- a/hosts/plexy/default.nix +++ b/hosts/plexy/default.nix @@ -154,7 +154,6 @@ general = { api.server = { enable = true; - listen_uri = "http://127.0.0.1:8080"; }; prometheus.enabled = false; }; From 796a42e70ee1546a5bac2a96204d7eea79f97200 Mon Sep 17 00:00:00 2001 From: Wekuz Date: Thu, 23 Jul 2026 16:28:31 +0300 Subject: [PATCH 6/6] Use Crowdsec rewrite --- flake.nix | 3 ++ hosts/plexy/default.nix | 84 +++++++++++++++++++++++------------------ 2 files changed, 51 insertions(+), 36 deletions(-) diff --git a/flake.nix b/flake.nix index fcd890d..f298dc7 100644 --- a/flake.nix +++ b/flake.nix @@ -23,6 +23,8 @@ url = "https://keys.openpgp.org/vks/v1/by-email/wekuz%40duck.com"; flake = false; }; + + crowdsec-rewrite.url = "github:TornaxO7/nixpkgs/saltsprint"; }; outputs = @@ -37,6 +39,7 @@ nixosConfigurations = { plexy = nixpkgs.lib.nixosSystem { system = "x86_64-linux"; + specialArgs = { inherit inputs; }; modules = [ ./hosts/plexy home-manager.nixosModules.home-manager diff --git a/hosts/plexy/default.nix b/hosts/plexy/default.nix index b361950..606862b 100644 --- a/hosts/plexy/default.nix +++ b/hosts/plexy/default.nix @@ -1,13 +1,21 @@ { config, pkgs, + inputs, ... }: { + disabledModules = [ + "services/security/crowdsec.nix" + "services/security/crowdsec-firewall-bouncer.nix" + ]; + imports = [ ./hardware-configuration.nix ./disko-config.nix + "${inputs.crowdsec-rewrite}/nixos/modules/services/security/crowdsec.nix" + "${inputs.crowdsec-rewrite}/nixos/modules/services/security/crowdsec-firewall-bouncer.nix" ]; nix = { @@ -149,15 +157,49 @@ autoUpdateService = true; settings = { - lapi.credentialsFile = "/var/lib/crowdsec/local_api_credentials.yaml"; - console.tokenFile = config.sops.secrets."crowdsec-console-token".path; - general = { + console.enrollKeyFile = config.sops.secrets."crowdsec-console-token".path; + config = { + api.server = { enable = true; + online_client.credentials_path = "/var/lib/crowdsec/online_api_credentials.yaml"; }; - prometheus.enabled = false; }; + + acquisitions = [ + { + source = "journalctl"; + journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ]; + labels.type = "syslog"; + } + { + source = "journalctl"; + journalctl_filter = [ "-k" ]; + labels.type = "syslog"; + } + { + source = "journalctl"; + journalctl_filter = [ "_SYSTEMD_UNIT=caddy.service" ]; + labels.type = "caddy"; + } + { + source = "journalctl"; + journalctl_filter = [ "_SYSTEMD_UNIT=vaultwarden.service" ]; + labels.type = "Vaultwarden"; + } + { + source = "journalctl"; + journalctl_filter = [ "_SYSTEMD_UNIT=jellyfin.service" ]; + labels.type = "jellyfin"; + } + { + source = "journalctl"; + journalctl_filter = [ "_SYSTEMD_UNIT=seerr.service" ]; + labels.type = "seerr"; + } + ]; }; + hub.collections = [ "crowdsecurity/linux" "crowdsecurity/sshd" @@ -171,41 +213,11 @@ "crowdsecurity/whitelist-good-actors" ]; - localConfig.acquisitions = [ - { - source = "journalctl"; - journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ]; - labels.type = "syslog"; - } - { - source = "journalctl"; - journalctl_filter = [ "-k" ]; - labels.type = "syslog"; - } - { - source = "journalctl"; - journalctl_filter = [ "_SYSTEMD_UNIT=caddy.service" ]; - labels.type = "caddy"; - } - { - source = "journalctl"; - journalctl_filter = [ "_SYSTEMD_UNIT=vaultwarden.service" ]; - labels.type = "Vaultwarden"; - } - { - source = "journalctl"; - journalctl_filter = [ "_SYSTEMD_UNIT=jellyfin.service" ]; - labels.type = "jellyfin"; - } - { - source = "journalctl"; - journalctl_filter = [ "_SYSTEMD_UNIT=seerr.service" ]; - labels.type = "seerr"; - } - ]; }; crowdsec-firewall-bouncer = { enable = true; + registerBouncer.enable = false; + secrets.apiKeyPath = "/var/lib/crowdsec/firewall-bouncer-key"; }; vaultwarden = { enable = true;