Merge branch 'service-crowdsec' into temp-caddy-crowdsec

flake.nix

@@ -23,6 +23,8 @@
       url = "https://keys.openpgp.org/vks/v1/by-email/wekuz%40duck.com";
       flake = false;
     };
+
+    crowdsec-rewrite.url = "github:TornaxO7/nixpkgs/saltsprint";
   };
 
   outputs =
@@ -37,6 +39,7 @@
       nixosConfigurations = {
         plexy = nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
+          specialArgs = { inherit inputs; };
           modules = [
             ./hosts/plexy
             home-manager.nixosModules.home-manager

hosts/plexy/default.nix

@@ -1,13 +1,21 @@
 {
   config,
   pkgs,
+  inputs,
   ...
 }:
 
 {
+  disabledModules = [
+    "services/security/crowdsec.nix"
+    "services/security/crowdsec-firewall-bouncer.nix"
+  ];
+
   imports = [
     ./hardware-configuration.nix
     ./disko-config.nix
+    "${inputs.crowdsec-rewrite}/nixos/modules/services/security/crowdsec.nix"
+    "${inputs.crowdsec-rewrite}/nixos/modules/services/security/crowdsec-firewall-bouncer.nix"
   ];
 
   nix = {
@@ -97,6 +105,7 @@
       "vaultwarden.env" = { };
       "rsyncd.secrets" = { };
       "caddy.env" = { };
+      "crowdsec-console-token" = { };
     };
   };
 
@@ -247,6 +256,77 @@
         };
       };
     };
+    crowdsec = {
+      enable = true;
+      autoUpdateService = true;
+
+      settings = {
+        console.enrollKeyFile = config.sops.secrets."crowdsec-console-token".path;
+        config = {
+
+          api.server = {
+            enable = true;
+            online_client.credentials_path = "/var/lib/crowdsec/online_api_credentials.yaml";
+          };
+        };
+
+        acquisitions = [
+          {
+            source = "journalctl";
+            journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
+            labels.type = "syslog";
+          }
+          {
+            source = "journalctl";
+            journalctl_filter = [ "-k" ];
+            labels.type = "syslog";
+          }
+          {
+            source = "journalctl";
+            journalctl_filter = [
+              "_SYSTEMD_UNIT=caddy.service"
+              "-o"
+              "cat"
+            ];
+            labels.type = "caddy";
+          }
+          {
+            source = "journalctl";
+            journalctl_filter = [ "_SYSTEMD_UNIT=vaultwarden.service" ];
+            labels.type = "Vaultwarden";
+          }
+          {
+            source = "journalctl";
+            journalctl_filter = [ "_SYSTEMD_UNIT=jellyfin.service" ];
+            labels.type = "jellyfin";
+          }
+          {
+            source = "journalctl";
+            journalctl_filter = [ "_SYSTEMD_UNIT=seerr.service" ];
+            labels.type = "seerr";
+          }
+        ];
+      };
+
+      hub.collections = [
+        "crowdsecurity/linux"
+        "crowdsecurity/sshd"
+
+        "crowdsecurity/base-http-scenarios"
+        "crowdsecurity/caddy"
+
+        "Dominic-Wagner/vaultwarden"
+        "LePresidente/jellyfin"
+        "LePresidente/jellyseerr"
+
+        "crowdsecurity/whitelist-good-actors"
+      ];
+    };
+    crowdsec-firewall-bouncer = {
+      enable = true;
+      registerBouncer.enable = false;
+      secrets.apiKeyPath = "/var/lib/crowdsec/firewall-bouncer-key";
+    };
     vaultwarden = {
       enable = true;
       environmentFile = config.sops.secrets."vaultwarden.env".path;

hosts/plexy/secrets.yaml

@@ -1,6 +1,7 @@
 vaultwarden.env: ENC[AES256_GCM,data:PLNb5cFoJaOyUo5U/gpXH0RGVwwQxL3kCE/OLw7MaLWazuBGHIPUEhH+kDMP2cfF916D63w8Ddgb/oH+lHGCw235YwgoqZ9yjWYPG4VB2Jdw+17LeCbirdh3zv8nNzFnSZDJmhz5Pj82+iswju6sYO/H7UfZ3aeASWonKW9LGHVltKSY1rAVhZRu4SvhqPiAxNpEzN0/EDTl46RIxrgEoUraN+Ie8fh1wU9SKevExkPU3NXGO1gG2tWRxclMPgc=,iv:es40/5HpBAhOy2xmU/yCUD43fVVsAXk6qJ3OasKjK3U=,tag:bneErU9pPZkQ2VzbQ1NrJA==,type:str]
 rsyncd.secrets: ENC[AES256_GCM,data:VjHRoZa6/lDtCheKSJyM,iv:kxygNaKOuK0iH/bFY/uKxcbMcYSR8nWDUx+4aDNqTMk=,tag:uYYPWAPCWtvLLGwmOWyH+A==,type:str]
 caddy.env: ENC[AES256_GCM,data:xzYvGvtu1DDBWvcLmohHUAOTNQfUuLbOJ18UPgLokkWlzf7peNgN3Qt9A/ZCuEm5cg4PLtJy0LYbWk6ykm20vgDW+TmouJ8dxqwSDvJHdmnhoPYCfu0KA1d3iHPL5f8unqXxxhAbcfp0VSzxUo685on9Aw==,iv:E+o8dJ+t4BPuoiEfkTaOO6lVDAZnG9D1btNYN9oX3ek=,tag:oar1at1PkK4tgIDIXCyXrg==,type:str]
+crowdsec-console-token: ENC[AES256_GCM,data:0K2kGXAf7uPhSRSRBIQ5cWjtp9l5oEcCSJg=,iv:O11ZhGU3bM+Ao5IUW0/sKT3L0CTeMsRpJTrCya6T674=,tag:R064lQrFBAIi33N4YVB/5Q==,type:str]
 sops:
     age:
         - enc: |
@@ -12,7 +13,7 @@ sops:
             hkLDjoWK9dkGRX8kqRd028cuMCQRenLpULEECWp6oV+evUdMf7wRtg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1sqssntfzzlhcgp0wuf9wmeavg0hmwmq349npsq8vaxj9sxey5s9ssc82sw
-    lastmodified: "2026-06-26T20:44:20Z"
-    mac: ENC[AES256_GCM,data:GxcbV3hdk86tNZlzCcQTG0X206tpwxzkACO5KEF/T+ScvKIrbCYKVfQKmdEBR6/o1oSBP8R5kiNdsQu3ETpsVeb4GRtp3E/C41a7mOXtagvNo0id+kSmZFJNOgl1ki+8mPjZEO3m5IBnQgy1HtfGXe4Dbnk6iaDyyBl7ukJdXYY=,iv:djI/xYTI/WzQaihC2OZiry9swvkKB4LyrJglf2E71NE=,tag:d1Uzu7tVSQqkLMKZ3EZ/fA==,type:str]
+    lastmodified: "2026-08-14T15:56:25Z"
+    mac: ENC[AES256_GCM,data:Y0rf6PzXBXgV4J8Zjs73L3Fvl96o/AMFXAqe/FN3w68yIbKvClDegiF2V5SQwpYchcr7xN9Qxwcl+5/OnF6wIoyOa4b94xmwd1ZKMU4MM2omFaT5mUov0lW26PkAGbB8ioMiCjibdXHnFVJMKHYO2cuMfTo3YH1nOUMuQvCQGyg=,iv:aatrE+/Wa5VGHVswrkh6PBkoCi19FBttVJJXZ/JG2+Q=,tag:KAk6sk5NmdB6nwx493hUQw==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.1
+    version: 3.13.3