mirror of
https://github.com/SebastianStork/nixos-config.git
synced 2026-01-21 17:31:34 +01:00
crowdsec: Refactor module
This commit is contained in:
parent
74c584c1c4
commit
eff300b055
4 changed files with 134 additions and 145 deletions
|
|
@ -24,12 +24,12 @@
|
|||
|
||||
crowdsec = {
|
||||
enable = true;
|
||||
firewallBouncer.enable = true;
|
||||
sources = [
|
||||
"sshd"
|
||||
"iptables"
|
||||
"caddy"
|
||||
];
|
||||
sources = {
|
||||
iptables = true;
|
||||
sshd = true;
|
||||
caddy = true;
|
||||
};
|
||||
bouncer.firewall = true;
|
||||
};
|
||||
|
||||
forgejo = {
|
||||
|
|
|
|||
128
modules/system/services/crowdsec.nix
Normal file
128
modules/system/services/crowdsec.nix
Normal file
|
|
@ -0,0 +1,128 @@
|
|||
{
|
||||
config,
|
||||
inputs,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.custom.services.crowdsec;
|
||||
|
||||
user = config.users.users.crowdsec.name;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
inputs.crowdsec.nixosModules.crowdsec
|
||||
inputs.crowdsec.nixosModules.crowdsec-firewall-bouncer
|
||||
];
|
||||
|
||||
options.custom.services.crowdsec = {
|
||||
enable = lib.mkEnableOption "";
|
||||
apiPort = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 8080;
|
||||
};
|
||||
prometheusPort = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 6060;
|
||||
};
|
||||
sources = {
|
||||
iptables = lib.mkEnableOption "";
|
||||
caddy = lib.mkEnableOption "";
|
||||
sshd = lib.mkEnableOption "";
|
||||
};
|
||||
bouncer.firewall = lib.mkEnableOption "";
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
meta.ports.tcp.list = [
|
||||
cfg.apiPort
|
||||
cfg.prometheusPort
|
||||
];
|
||||
|
||||
sops.secrets."crowdsec/enrollment-key".owner = user;
|
||||
|
||||
users.groups.caddy.members = lib.mkIf cfg.sources.caddy [ user ];
|
||||
|
||||
services = {
|
||||
crowdsec = {
|
||||
enable = true;
|
||||
package = inputs.crowdsec.packages.${pkgs.system}.crowdsec;
|
||||
enrollKeyFile = config.sops.secrets."crowdsec/enrollment-key".path;
|
||||
settings = {
|
||||
api.server.listen_uri = "localhost:${builtins.toString cfg.apiPort}";
|
||||
cscli.prometheus_uri = "http://localhost:${builtins.toString cfg.prometheusPort}";
|
||||
};
|
||||
|
||||
allowLocalJournalAccess = true;
|
||||
acquisitions =
|
||||
let
|
||||
mkJournalAcquisition = unit: {
|
||||
source = "journalctl";
|
||||
journalctl_filter = [ "_SYSTEMD_UNIT=${unit}" ];
|
||||
labels.type = "syslog";
|
||||
};
|
||||
in
|
||||
[
|
||||
(lib.mkIf cfg.sources.iptables {
|
||||
source = "journalctl";
|
||||
journalctl_filter = [ "-k" ];
|
||||
labels.type = "syslog";
|
||||
})
|
||||
(lib.mkIf cfg.sources.caddy {
|
||||
filenames = [ "${config.services.caddy.logDir}/*.log" ];
|
||||
labels.type = "caddy";
|
||||
})
|
||||
(lib.mkIf cfg.sources.sshd (mkJournalAcquisition "sshd.service"))
|
||||
];
|
||||
};
|
||||
|
||||
crowdsec-firewall-bouncer = {
|
||||
enable = true;
|
||||
package = inputs.crowdsec.packages.${pkgs.system}.crowdsec-firewall-bouncer;
|
||||
settings = {
|
||||
api_key = "cs-firewall-bouncer";
|
||||
api_url = "http://localhost:${builtins.toString cfg.apiPort}";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.crowdsec.serviceConfig.ExecStartPre =
|
||||
let
|
||||
mkScript =
|
||||
name: text:
|
||||
lib.getExe (
|
||||
pkgs.writeShellApplication {
|
||||
inherit name text;
|
||||
}
|
||||
);
|
||||
|
||||
installCollection = collection: ''
|
||||
if ! cscli collections list | grep -q "${collection}"; then
|
||||
cscli collections install ${collection}
|
||||
fi
|
||||
'';
|
||||
collectionsScript =
|
||||
[
|
||||
(lib.singleton "crowdsecurity/linux")
|
||||
(lib.optional cfg.sources.iptables "crowdsecurity/iptables")
|
||||
(lib.optional cfg.sources.caddy "crowdsecurity/caddy")
|
||||
(lib.optional cfg.sources.sshd "crowdsecurity/sshd")
|
||||
]
|
||||
|> lib.concatLists
|
||||
|> lib.map installCollection
|
||||
|> lib.concatLines
|
||||
|> mkScript "crowdsec-install-collections";
|
||||
|
||||
bouncerScript = mkScript "crowdsec-add-bouncer" ''
|
||||
if ! cscli bouncers list | grep -q "firewall"; then
|
||||
cscli bouncers add "firewall" --key "cs-firewall-bouncer"
|
||||
fi
|
||||
'';
|
||||
in
|
||||
lib.mkAfter [
|
||||
collectionsScript
|
||||
bouncerScript
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
@ -1,104 +0,0 @@
|
|||
{
|
||||
config,
|
||||
inputs,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.custom.services.crowdsec;
|
||||
|
||||
user = config.users.users.crowdsec.name;
|
||||
in
|
||||
{
|
||||
imports = [ inputs.crowdsec.nixosModules.crowdsec ];
|
||||
|
||||
options.custom.services.crowdsec = {
|
||||
enable = lib.mkEnableOption "";
|
||||
apiPort = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 8080;
|
||||
};
|
||||
prometheusPort = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 6060;
|
||||
};
|
||||
sources = lib.mkOption {
|
||||
type = lib.types.listOf (
|
||||
lib.types.enum [
|
||||
"sshd"
|
||||
"iptables"
|
||||
"caddy"
|
||||
]
|
||||
);
|
||||
default = [ ];
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
meta.ports.tcp.list = [
|
||||
cfg.apiPort
|
||||
cfg.prometheusPort
|
||||
];
|
||||
|
||||
nixpkgs.overlays = [ inputs.crowdsec.overlays.default ];
|
||||
|
||||
sops.secrets."crowdsec/enrollment-key".owner = user;
|
||||
|
||||
users.groups.caddy.members = lib.mkIf (lib.elem "caddy" cfg.sources) [ user ];
|
||||
|
||||
services.crowdsec = {
|
||||
enable = true;
|
||||
package = inputs.crowdsec.packages.${pkgs.system}.crowdsec;
|
||||
enrollKeyFile = config.sops.secrets."crowdsec/enrollment-key".path;
|
||||
settings = {
|
||||
api.server.listen_uri = "localhost:${builtins.toString cfg.apiPort}";
|
||||
cscli.prometheus_uri = "http://localhost:${builtins.toString cfg.prometheusPort}";
|
||||
};
|
||||
|
||||
allowLocalJournalAccess = true;
|
||||
acquisitions =
|
||||
let
|
||||
mkAcquisition =
|
||||
enable: unit:
|
||||
lib.optionalAttrs enable {
|
||||
source = "journalctl";
|
||||
journalctl_filter = [ "_SYSTEMD_UNIT=${unit}" ];
|
||||
labels.type = "syslog";
|
||||
};
|
||||
in
|
||||
[
|
||||
(mkAcquisition (lib.elem "sshd" cfg.sources) "sshd.service")
|
||||
(lib.mkIf (lib.elem "caddy" cfg.sources) {
|
||||
filenames = [ "${config.services.caddy.logDir}/*.log" ];
|
||||
labels.type = "caddy";
|
||||
})
|
||||
(lib.mkIf (lib.elem "iptables" cfg.sources) {
|
||||
source = "journalctl";
|
||||
journalctl_filter = [ "-k" ];
|
||||
labels.type = "syslog";
|
||||
})
|
||||
];
|
||||
};
|
||||
|
||||
systemd.services.crowdsec.serviceConfig.ExecStartPre =
|
||||
let
|
||||
installCollection = collection: ''
|
||||
if ! cscli collections list | grep -q "${collection}"; then
|
||||
cscli collections install ${collection}
|
||||
fi
|
||||
'';
|
||||
in
|
||||
[
|
||||
(lib.singleton "crowdsecurity/linux")
|
||||
(lib.optional (lib.elem "sshd" cfg.sources) "crowdsecurity/sshd")
|
||||
(lib.optional (lib.elem "caddy" cfg.sources) "crowdsecurity/caddy")
|
||||
(lib.optional (lib.elem "iptables" cfg.sources) "crowdsecurity/iptables")
|
||||
]
|
||||
|> lib.concatLists
|
||||
|> lib.map installCollection
|
||||
|> lib.concatLines
|
||||
|> (text: pkgs.writeShellScript "crowdsec-install-collections" "set -e\n${text}")
|
||||
|> lib.mkAfter;
|
||||
};
|
||||
}
|
||||
|
|
@ -1,35 +0,0 @@
|
|||
{
|
||||
config,
|
||||
inputs,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.custom.services.crowdsec;
|
||||
in
|
||||
{
|
||||
imports = [ inputs.crowdsec.nixosModules.crowdsec-firewall-bouncer ];
|
||||
|
||||
options.custom.services.crowdsec.firewallBouncer.enable = lib.mkEnableOption "";
|
||||
|
||||
config = lib.mkIf cfg.firewallBouncer.enable {
|
||||
services.crowdsec-firewall-bouncer = {
|
||||
enable = true;
|
||||
package = inputs.crowdsec.packages.${pkgs.system}.crowdsec-firewall-bouncer;
|
||||
settings = {
|
||||
api_key = "cs-firewall-bouncer";
|
||||
api_url = "http://localhost:${builtins.toString cfg.apiPort}";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.crowdsec.serviceConfig.ExecStartPre = lib.mkAfter (
|
||||
pkgs.writeShellScript "crowdsec-add-bouncer" ''
|
||||
set -e
|
||||
if ! cscli bouncers list | grep -q "firewall"; then
|
||||
cscli bouncers add "firewall" --key "cs-firewall-bouncer"
|
||||
fi
|
||||
''
|
||||
);
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue