SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 16:21:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Move modules in programs/services subfolders

Browse source
This commit is contained in:
SebastianStork 2025-05-28 11:33:05 +02:00
parent 2ff87c8404
commit 211ca98e92
38 changed files with 0 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

74
modules/system/services/crowdsec/default.nix Normal file
View file

@ -0,0 +1,74 @@
{
config,
inputs,
pkgs,
lib,
...
}:
let
cfg = config.custom.services.crowdsec;
in
{
imports = [ inputs.crowdsec.nixosModules.crowdsec ];
options.custom.services.crowdsec = {
enable = lib.mkEnableOption "";
apiPort = lib.mkOption {
type = lib.types.port;
default = 8080;
};
sources = lib.mkOption {
type = lib.types.listOf (
lib.types.enum [
"iptables"
"caddy"
]
);
default = [ ];
};
};
config = lib.mkIf cfg.enable {
nixpkgs.overlays = [ inputs.crowdsec.overlays.default ];
sops.secrets."crowdsec/enrollment-key".owner = config.users.users.crowdsec.name;
services.crowdsec = {
enable = true;
package = inputs.crowdsec.packages.${pkgs.system}.crowdsec;
enrollKeyFile = config.sops.secrets."crowdsec/enrollment-key".path;
settings = {
api.server.listen_uri = "127.0.0.1:${toString cfg.apiPort}";
prometheus.enabled = false;
};
acquisitions = [
(lib.mkIf (lib.elem "iptables" cfg.sources) {
source = "journalctl";
journalctl_filter = [ "-k" ];
labels.type = "syslog";
})
(lib.mkIf (lib.elem "caddy" cfg.sources) {
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=caddy.service" ];
labels.type = "syslog";
})
];
};
systemd.services.crowdsec.preStart =
let
collections = lib.flatten [
"crowdsecurity/linux"
(lib.optional (lib.elem "iptables" cfg.sources) "crowdsecurity/iptables")
(lib.optional (lib.elem "caddy" cfg.sources) "crowdsecurity/caddy")
];
addCollection = collection: ''
if ! cscli collections list | grep -q "${collection}"; then
cscli collections install ${collection}
fi
'';
in
collections |> lib.map addCollection |> lib.concatLines;
};
}

32
modules/system/services/crowdsec/firewall-bouncer.nix Normal file
View file

@ -0,0 +1,32 @@
{
config,
inputs,
pkgs,
lib,
...
}:
let
cfg = config.custom.services.crowdsec;
in
{
imports = [ inputs.crowdsec.nixosModules.crowdsec-firewall-bouncer ];
options.custom.services.crowdsec.firewallBouncer.enable = lib.mkEnableOption "";
config = lib.mkIf cfg.firewallBouncer.enable {
services.crowdsec-firewall-bouncer = {
enable = true;
package = inputs.crowdsec.packages.${pkgs.system}.crowdsec-firewall-bouncer;
settings = {
api_key = "cs-firewall-bouncer";
api_url = "http://127.0.0.1:${toString cfg.apiPort}";
};
};
systemd.services.crowdsec.preStart = ''
if ! cscli bouncers list | grep -q "firewall-bouncer"; then
cscli bouncers add "firewall-bouncer" --key "cs-firewall-bouncer"
fi
'';
};
}