95 lines
2.6 KiB
Nix
95 lines
2.6 KiB
Nix
|
{ config, inputs, pkgs, ... }:
|
||
|
|
let
|
||
|
|
port = "8080";
|
||
|
|
in
|
||
|
|
{
|
||
|
|
imports = [
|
||
|
|
inputs.crowdsec.nixosModules.crowdsec
|
||
|
|
inputs.crowdsec.nixosModules.crowdsec-firewall-bouncer
|
||
|
|
];
|
||
|
|
|
||
|
|
nixpkgs.overlays = [
|
||
|
|
inputs.crowdsec.overlays.default
|
||
|
|
];
|
||
|
|
|
||
|
|
age.secrets.enrollment-key = {
|
||
|
|
rekeyFile = ./enrollment_key.age;
|
||
|
|
owner = "crowdsec";
|
||
|
|
group = "crowdsec";
|
||
|
|
};
|
||
|
|
|
||
|
|
services.crowdsec = let
|
||
|
|
yaml = (pkgs.formats.yaml {}).generate;
|
||
|
|
acquisitions_file = yaml "acquisitions.yaml" {
|
||
|
|
source = "journalctl";
|
||
|
|
journalctl_filter = ["_SYSTEMD_UNIT=sshd.service"];
|
||
|
|
labels.type = "syslog";
|
||
|
|
};
|
||
|
|
in {
|
||
|
|
enable = true;
|
||
|
|
allowLocalJournalAccess = true;
|
||
|
|
enrollKeyFile = config.age.secrets.enrollment-key.path;
|
||
|
|
settings = {
|
||
|
|
api.server = {
|
||
|
|
listen_uri = "127.0.0.1:${port}";
|
||
|
|
};
|
||
|
|
crowdsec_service.acquisition_path = acquisitions_file;
|
||
|
|
crowdsec_service.acquisition_dir = ./acquis.d;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
services.crowdsec-firewall-bouncer = {
|
||
|
|
enable = true;
|
||
|
|
settings = {
|
||
|
|
api_key = "2025f0be-35ca-406c-8737-810321c918c2";
|
||
|
|
api_url = "http://localhost:${port}";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
systemd.services.crowdsec.serviceConfig = {
|
||
|
|
ExecStartPre = let
|
||
|
|
bouncer = pkgs.writeScriptBin "register-bouncer" ''
|
||
|
|
#!${pkgs.runtimeShell}
|
||
|
|
set -eu
|
||
|
|
set -o pipefail
|
||
|
|
|
||
|
|
if ! cscli bouncers list | grep -q "firewall-bouncer"; then
|
||
|
|
cscli bouncers add "firewall-bouncer" --key "2025f0be-35ca-406c-8737-810321c918c2"
|
||
|
|
fi
|
||
|
|
|
||
|
|
if ! cscli bouncers list | grep -q "traefik-bouncer"; then
|
||
|
|
cscli bouncers add "traefik-bouncer" --key "18c725d5-3a22-4331-a8e8-abfd3018a7c0"
|
||
|
|
fi
|
||
|
|
'';
|
||
|
|
scenario = pkgs.writeScriptBin "install-scenario" ''
|
||
|
|
#!${pkgs.runtimeShell}
|
||
|
|
set -eu
|
||
|
|
set -o pipefail
|
||
|
|
|
||
|
|
if ! cscli collections list | grep -q "crowdsecurity/linux"; then
|
||
|
|
cscli collections install "crowdsecurity/linux"
|
||
|
|
fi
|
||
|
|
|
||
|
|
if ! cscli collections list | grep -q "crowdsecurity/appsec-virtual-patching"; then
|
||
|
|
cscli collections install "crowdsecurity/appsec-virtual-patching"
|
||
|
|
fi
|
||
|
|
|
||
|
|
if ! cscli collections list | grep -q "crowdsecurity/appsec-generic-rules"; then
|
||
|
|
cscli collections install "crowdsecurity/appsec-generic-rules"
|
||
|
|
fi
|
||
|
|
'';
|
||
|
|
in [
|
||
|
|
"${bouncer}/bin/register-bouncer"
|
||
|
|
"${scenario}/bin/install-scenario"
|
||
|
|
];
|
||
|
|
};
|
||
|
|
|
||
|
|
environment.persistence."/persist" = {
|
||
|
|
directories = [
|
||
|
|
{ directory = "/var/lib/crowdsec"; user = "crowdsec"; group = "crowdsec"; }
|
||
|
|
];
|
||
|
|
hideMounts = true;
|
||
|
|
};
|
||
|
|
}
|
||
|
|
|