dotfiles.nix/nixos/viridian/services/crowdsec/default.nix
2024-08-08 09:02:42 +08:00

101 lines
2.6 KiB
Nix

{
config,
inputs,
pkgs,
...
}: let
port = "8080";
in {
imports = [
inputs.crowdsec.nixosModules.crowdsec
inputs.crowdsec.nixosModules.crowdsec-firewall-bouncer
];
nixpkgs.overlays = [
inputs.crowdsec.overlays.default
];
age.secrets.enrollment-key = {
rekeyFile = ./enrollment_key.age;
owner = "crowdsec";
group = "crowdsec";
};
services.crowdsec = let
yaml = (pkgs.formats.yaml {}).generate;
acquisitions_file = yaml "acquisitions.yaml" {
source = "journalctl";
journalctl_filter = ["_SYSTEMD_UNIT=sshd.service"];
labels.type = "syslog";
};
in {
enable = true;
allowLocalJournalAccess = true;
enrollKeyFile = config.age.secrets.enrollment-key.path;
settings = {
api.server = {
listen_uri = "127.0.0.1:${port}";
};
crowdsec_service.acquisition_path = acquisitions_file;
crowdsec_service.acquisition_dir = ./acquis.d;
};
};
services.crowdsec-firewall-bouncer = {
enable = true;
settings = {
api_key = "2025f0be-35ca-406c-8737-810321c918c2";
api_url = "http://localhost:${port}";
};
};
systemd.services.crowdsec.serviceConfig = {
ExecStartPre = let
bouncer = pkgs.writeScriptBin "register-bouncer" ''
#!${pkgs.runtimeShell}
set -eu
set -o pipefail
if ! cscli bouncers list | grep -q "firewall-bouncer"; then
cscli bouncers add "firewall-bouncer" --key "2025f0be-35ca-406c-8737-810321c918c2"
fi
if ! cscli bouncers list | grep -q "traefik-bouncer"; then
cscli bouncers add "traefik-bouncer" --key "18c725d5-3a22-4331-a8e8-abfd3018a7c0"
fi
'';
scenario = pkgs.writeScriptBin "install-scenario" ''
#!${pkgs.runtimeShell}
set -eu
set -o pipefail
if ! cscli collections list | grep -q "crowdsecurity/linux"; then
cscli collections install "crowdsecurity/linux"
fi
if ! cscli collections list | grep -q "crowdsecurity/appsec-virtual-patching"; then
cscli collections install "crowdsecurity/appsec-virtual-patching"
fi
if ! cscli collections list | grep -q "crowdsecurity/appsec-generic-rules"; then
cscli collections install "crowdsecurity/appsec-generic-rules"
fi
'';
in [
"${bouncer}/bin/register-bouncer"
"${scenario}/bin/install-scenario"
];
};
environment.persistence."/persist" = {
directories = [
{
directory = "/var/lib/crowdsec";
user = "crowdsec";
group = "crowdsec";
}
];
hideMounts = true;
};
}