SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 14:01:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

crowdsec: Fix journalctl acquisitions

Browse source 
After spending an hour figuring this out on my own, I found this https://codeberg.org/kampka/nix-flake-crowdsec/issues/20 :(
This commit is contained in:
SebastianStork 2025-10-15 20:44:41 +02:00
parent 1fc98070f1
commit 344baa5f46
1 changed files with 48 additions and 47 deletions
Download patch file Download diff file Expand all files Collapse all files

95
modules/system/services/crowdsec/default.nix
View file

@ -57,55 +57,56 @@ in
};
allowLocalJournalAccess = true;
acquisitions =
let
mkJournalAcquisition = unit: {
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=${unit}" ];
labels.type = "syslog";
};
in
[
(lib.mkIf cfg.sources.iptables {
source = "journalctl";
journalctl_filter = [ "-k" ];
labels.type = "syslog";
})
(lib.mkIf cfg.sources.caddy {
filenames = [ "${config.services.caddy.logDir}/*.log" ];
labels.type = "caddy";
})
(lib.mkIf cfg.sources.sshd (mkJournalAcquisition "sshd.service"))
];
acquisitions = [
(lib.mkIf cfg.sources.iptables {
source = "journalctl";
journalctl_filter = [ "-k" ];
labels.type = "syslog";
})
(lib.mkIf cfg.sources.caddy {
filenames = [ "${config.services.caddy.logDir}/*.log" ];
labels.type = "caddy";
})
(lib.mkIf cfg.sources.sshd {
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
labels.type = "syslog";
})
];
};
systemd.services.crowdsec.serviceConfig.ExecStartPre =
let
installCollection = collection: ''
if ! cscli collections list | grep -q "${collection}"; then
cscli collections install ${collection}
fi
'';
mkScript =
name: text:
lib.getExe (
pkgs.writeShellApplication {
inherit name text;
}
);
collectionsScript =
[
(lib.singleton "crowdsecurity/linux")
(lib.optional cfg.sources.iptables "crowdsecurity/iptables")
(lib.optional cfg.sources.caddy "crowdsecurity/caddy")
(lib.optional cfg.sources.sshd "crowdsecurity/sshd")
]
|> lib.concatLists
|> lib.map installCollection
|> lib.concatLines
|> mkScript "crowdsec-install-collections";
in
lib.mkAfter collectionsScript;
systemd.services.crowdsec.serviceConfig = {
# Fix journalctl acquisitions
PrivateUsers = false;
ExecStartPre =
let
installCollection = collection: ''
if ! cscli collections list | grep -q "${collection}"; then
cscli collections install ${collection}
fi
'';
mkScript =
name: text:
lib.getExe (
pkgs.writeShellApplication {
inherit name text;
}
);
collectionsScript =
[
(lib.singleton "crowdsecurity/linux")
(lib.optional cfg.sources.iptables "crowdsecurity/iptables")
(lib.optional cfg.sources.caddy "crowdsecurity/caddy")
(lib.optional cfg.sources.sshd "crowdsecurity/sshd")
]
|> lib.concatLists
|> lib.map installCollection
|> lib.concatLines
|> mkScript "crowdsec-install-collections";
in
lib.mkAfter collectionsScript;
};
custom.persist.directories = [ "/var/lib/crowdsec" ];
};