Setup crowdsec with ssh/firewall/traefik

nixos/viridian/services/crowdsec/acquis.d/appsec.yaml

@@ -0,0 +1,6 @@
+listen_addr: 127.0.0.1:7422
+appsec_config: crowdsecurity/appsec-default
+name: traefik
+source: appsec
+labels:
+  type: appsec

nixos/viridian/services/crowdsec/default.nix

@@ -0,0 +1,94 @@
+{ config, inputs, pkgs, ... }:
+let
+  port = "8080";
+in
+{
+  imports = [
+    inputs.crowdsec.nixosModules.crowdsec
+    inputs.crowdsec.nixosModules.crowdsec-firewall-bouncer
+  ];
+
+  nixpkgs.overlays = [
+    inputs.crowdsec.overlays.default
+  ];
+
+  age.secrets.enrollment-key = {
+    rekeyFile = ./enrollment_key.age;
+    owner = "crowdsec";
+    group = "crowdsec";
+  };
+
+  services.crowdsec = let
+    yaml = (pkgs.formats.yaml {}).generate;
+    acquisitions_file = yaml "acquisitions.yaml" {
+      source = "journalctl";
+      journalctl_filter = ["_SYSTEMD_UNIT=sshd.service"];
+      labels.type = "syslog";
+    };
+  in {
+    enable = true;
+    allowLocalJournalAccess = true;
+    enrollKeyFile = config.age.secrets.enrollment-key.path;
+    settings = {
+      api.server = {
+        listen_uri = "127.0.0.1:${port}";
+      };
+      crowdsec_service.acquisition_path = acquisitions_file;
+      crowdsec_service.acquisition_dir = ./acquis.d;
+    };
+  };
+
+  services.crowdsec-firewall-bouncer = {
+    enable = true;
+    settings = {
+      api_key = "2025f0be-35ca-406c-8737-810321c918c2";
+      api_url = "http://localhost:${port}";
+    };
+  };
+
+  systemd.services.crowdsec.serviceConfig = {
+    ExecStartPre = let
+      bouncer = pkgs.writeScriptBin "register-bouncer" ''
+        #!${pkgs.runtimeShell}
+        set -eu
+        set -o pipefail
+
+        if ! cscli bouncers list | grep -q "firewall-bouncer"; then
+          cscli bouncers add "firewall-bouncer" --key "2025f0be-35ca-406c-8737-810321c918c2"
+        fi
+
+        if ! cscli bouncers list | grep -q "traefik-bouncer"; then
+          cscli bouncers add "traefik-bouncer" --key "18c725d5-3a22-4331-a8e8-abfd3018a7c0"
+        fi
+      '';
+      scenario = pkgs.writeScriptBin "install-scenario" ''
+        #!${pkgs.runtimeShell}
+        set -eu
+        set -o pipefail
+
+        if ! cscli collections list | grep -q "crowdsecurity/linux"; then
+          cscli collections install "crowdsecurity/linux"
+        fi
+
+        if ! cscli collections list | grep -q "crowdsecurity/appsec-virtual-patching"; then
+          cscli collections install "crowdsecurity/appsec-virtual-patching"
+        fi
+
+        if ! cscli collections list | grep -q "crowdsecurity/appsec-generic-rules"; then
+          cscli collections install "crowdsecurity/appsec-generic-rules"
+        fi
+      '';
+    in [
+      "${bouncer}/bin/register-bouncer"
+      "${scenario}/bin/install-scenario"
+    ];
+  };
+
+  environment.persistence."/persist" = {
+    directories = [
+      { directory = "/var/lib/crowdsec"; user = "crowdsec"; group = "crowdsec"; }
+    ];
+    hideMounts = true;
+  };
+}
+

nixos/viridian/services/crowdsec/traefik-bouncer-key.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> piv-p256 hdSnGw A6O6zvEq05hpB3GxDsrj2rUxr0P031TKreOe3ZAfUpJs
+Ww8Qg1MV5dJoCYQEGSNLUnZdX7dO1cGu3XaQTyn97PA
+-> 0(D-grease b? xbW Qg ~cDE0j!
+s5z0LGzRiWS6lMMphO19nB7qmvXkto4RJrcTSrOtPHbY9Iam2aeYA0qN4faK40Zs
+XPc
+--- q1PoY78SatX6wOKNW549+ndCCrNhveA8dHcHQpF+slk
+l
<0A>¾ß`òŠæ¨=(¡¾è;>Y[)Pfwú.§…óQ²¹¸W5áòØØL©Ã—K£DˆTœY$’µŸ
+ý’Ù¿zñ¨Ã]