crowdsec: Remove module

flake.lock

@@ -37,27 +37,6 @@
         "type": "github"
       }
     },
-    "crowdsec": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1752497357,
-        "narHash": "sha256-9epXn1+T6U4Kfyw8B9zMzbERxDB3VfaPXhVebtai6CE=",
-        "ref": "refs/heads/main",
-        "rev": "84db7dcea77f7f477d79e69e35fb0bb560232667",
-        "revCount": 42,
-        "type": "git",
-        "url": "https://codeberg.org/kampka/nix-flake-crowdsec.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://codeberg.org/kampka/nix-flake-crowdsec.git"
-      }
-    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -135,23 +114,6 @@
         "type": "github"
       }
     },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "id": "flake-utils",
-        "type": "indirect"
-      }
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -312,7 +274,6 @@
       "inputs": {
         "betterfox": "betterfox",
         "comin": "comin",
-        "crowdsec": "crowdsec",
         "disko": "disko",
         "firefox-addons": "firefox-addons",
         "flake-parts": "flake-parts",
@@ -347,21 +308,6 @@
         "type": "github"
       }
     },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "treefmt": {
       "inputs": {
         "nixpkgs": [

flake.nix

@@ -35,11 +35,6 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    crowdsec = {
-      url = "git+https://codeberg.org/kampka/nix-flake-crowdsec.git";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     vscode-extensions = {
       url = "github:nix-community/nix-vscode-extensions";
       inputs.nixpkgs.follows = "nixpkgs";

modules/system/services/alloy.nix

@@ -32,9 +32,6 @@ in
         caddy = lib.mkEnableOption "" // {
           default = config.services.caddy.enable;
         };
-        crowdsec = lib.mkEnableOption "" // {
-          default = config.services.crowdsec.enable;
-        };
       };
       logs.openssh = lib.mkEnableOption "" // {
         default = config.services.openssh.enable;
@@ -139,20 +136,6 @@ in
             }
           '';
         };
-        "alloy/crowdsec-metrics.alloy" = {
-          enable = cfg.collect.metrics.crowdsec;
-          text = ''
-            prometheus.scrape "crowdsec" {
-              targets = [{
-                __address__ = "localhost:${toString config.custom.services.crowdsec.prometheusPort}",
-                job         = "crowdsec",
-                instance    = constants.hostname,
-              }]
-              forward_to      = [prometheus.remote_write.default.receiver]
-              scrape_interval = "15s"
-            }
-          '';
-        };
         "alloy/sshd-logs.alloy" = {
           enable = cfg.collect.logs.openssh;
           text = ''

modules/system/services/crowdsec/bouncers.nix

@@ -1,40 +0,0 @@
-{
-  config,
-  inputs,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  cfg = config.custom.services.crowdsec;
-in
-{
-  imports = [ inputs.crowdsec.nixosModules.crowdsec-firewall-bouncer ];
-  disabledModules = [ "services/security/crowdsec-firewall-bouncer.nix" ];
-
-  options.custom.services.crowdsec.bouncers.firewall = lib.mkEnableOption "";
-
-  config = lib.mkIf cfg.bouncers.firewall {
-    services.crowdsec-firewall-bouncer = {
-      enable = true;
-      package = inputs.crowdsec.packages.${pkgs.stdenv.hostPlatform.system}.crowdsec-firewall-bouncer;
-      settings = {
-        api_key = "cs-firewall-bouncer";
-        api_url = "http://localhost:${toString cfg.apiPort}";
-      };
-    };
-
-    systemd.services.crowdsec.serviceConfig.ExecStartPre = lib.mkAfter (
-      lib.getExe (
-        pkgs.writeShellApplication {
-          name = "crowdsec-add-bouncer";
-          text = ''
-            if ! cscli bouncers list | grep -q "firewall"; then
-              cscli bouncers add "firewall" --key "cs-firewall-bouncer"
-            fi
-          '';
-        }
-      )
-    );
-  };
-}

modules/system/services/crowdsec/default.nix

@@ -1,115 +0,0 @@
-{
-  config,
-  inputs,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  cfg = config.custom.services.crowdsec;
-
-  user = config.users.users.crowdsec.name;
-in
-{
-  disabledModules = [ "services/security/crowdsec.nix" ];
-  imports = [ inputs.crowdsec.nixosModules.crowdsec ];
-
-  options.custom.services.crowdsec = {
-    enable = lib.mkEnableOption "";
-    apiPort = lib.mkOption {
-      type = lib.types.port;
-      default = 8080;
-    };
-    prometheusPort = lib.mkOption {
-      type = lib.types.port;
-      default = 6060;
-    };
-    sources = {
-      iptables = lib.mkEnableOption "" // {
-        default = true;
-      };
-      caddy = lib.mkEnableOption "" // {
-        default = config.services.caddy.enable;
-      };
-      sshd = lib.mkEnableOption "" // {
-        default = config.services.openssh.enable;
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    sops.secrets."crowdsec/enrollment-key" = {
-      owner = user;
-      restartUnits = [ "crowdsec.service" ];
-    };
-
-    users.groups.caddy.members = lib.mkIf cfg.sources.caddy [ user ];
-
-    services.crowdsec = {
-      enable = true;
-      package = inputs.crowdsec.packages.${pkgs.stdenv.hostPlatform.system}.crowdsec;
-      enrollKeyFile = config.sops.secrets."crowdsec/enrollment-key".path;
-      settings = {
-        api.server.listen_uri = "localhost:${toString cfg.apiPort}";
-        cscli.prometheus_uri = "http://localhost:${toString cfg.prometheusPort}";
-        prometheus = {
-          listen_addr = "localhost";
-          listen_port = cfg.prometheusPort;
-        };
-      };
-
-      allowLocalJournalAccess = true;
-      acquisitions = [
-        (lib.mkIf cfg.sources.iptables {
-          source = "journalctl";
-          journalctl_filter = [ "-k" ];
-          labels.type = "syslog";
-        })
-        (lib.mkIf cfg.sources.caddy {
-          filenames = [ "${config.services.caddy.logDir}/*.log" ];
-          labels.type = "caddy";
-        })
-        (lib.mkIf cfg.sources.sshd {
-          source = "journalctl";
-          journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
-          labels.type = "syslog";
-        })
-      ];
-    };
-
-    systemd.services.crowdsec.serviceConfig = {
-      # Fix journalctl acquisitions
-      PrivateUsers = false;
-
-      ExecStartPre =
-        let
-          installCollection = collection: ''
-            if ! cscli collections list | grep -q "${collection}"; then
-              cscli collections install ${collection}
-            fi
-          '';
-          mkScript =
-            name: text:
-            lib.getExe (
-              pkgs.writeShellApplication {
-                inherit name text;
-              }
-            );
-          collectionsScript =
-            [
-              (lib.singleton "crowdsecurity/linux")
-              (lib.optional cfg.sources.iptables "crowdsecurity/iptables")
-              (lib.optional cfg.sources.caddy "crowdsecurity/caddy")
-              (lib.optional cfg.sources.sshd "crowdsecurity/sshd")
-            ]
-            |> lib.concatLists
-            |> lib.map installCollection
-            |> lib.concatLines
-            |> mkScript "crowdsec-install-collections";
-        in
-        lib.mkAfter collectionsScript;
-    };
-
-    custom.persistence.directories = [ "/var/lib/crowdsec" ];
-  };
-}

modules/system/web-services/grafana.nix

@@ -57,9 +57,6 @@ in
       victorialogs.enable = lib.mkEnableOption "" // {
         default = config.custom.web-services.victorialogs.enable;
       };
-      crowdsec.enable = lib.mkEnableOption "" // {
-        default = config.custom.services.crowdsec.enable;
-      };
     };
   };
 
@@ -176,22 +173,6 @@ in
             ''
           );
       };
-      # https://grafana.com/grafana/dashboards/19012-crowdsec-details-per-instance/
-      "grafana-dashboards/crowdsec-details-per-instance-patched.json" = {
-        enable = cfg.dashboards.crowdsec.enable;
-        source =
-          pkgs.fetchurl {
-            name = "crowdsec-details-per-instance.json";
-            url = "https://grafana.com/api/dashboards/19012/revisions/1/download";
-            hash = "sha256-VRPWAbPRgp+2pqfmey53wMqaOhLBzXVKUZs/pJ28Ikk=";
-          }
-          |> (
-            src:
-            pkgs.runCommand "crowdsec-details-per-instance-patched.json" { buildInputs = [ pkgs.gnused ]; } ''
-              sed 's/''${DS_PROMETHEUS}/Prometheus/g' ${src} > $out
-            ''
-          );
-      };
     };
 
     custom.services.caddy.virtualHosts.${cfg.domain}.port = cfg.port;