rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2025-04-25 16:08:30 +02:00
Code Issues Projects Releases Packages Wiki Activity

configured crowdsec

Browse source
This commit is contained in:
Rouven Seifert 2023-07-27 23:25:08 +02:00
parent 5fa24530b1
commit 60e1f3c3d0
Signed by: rouven.seifert
GPG key ID: B95E8FE6B11C4D09
9 changed files with 196 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

5
hosts/falkenstein-1/default.nix
View file

@ -5,6 +5,7 @@
[
# Include the results of the hardware scan.
./hardware-configuration.nix
./modules/crowdsec
./modules/mail
./modules/networks
./modules/nginx
@ -39,8 +40,6 @@
helix
lsof
python3
crowdsec
crowdsec-firewall-bouncer
];
programs.git = {
enable = true;
@ -70,6 +69,4 @@
];
system.stateVersion = "22.11";
}

52
hosts/falkenstein-1/modules/crowdsec/default.nix Normal file
View file

@ -0,0 +1,52 @@
{ pkgs, lib, ... }:
{
environment.systemPackages = with pkgs; [
crowdsec
crowdsec-firewall-bouncer
ipset
];
services.postgresql = {
enable = true;
ensureUsers = [
{
name = "crowdsec";
ensurePermissions = {
"DATABASE crowdsec" = "ALL PRIVILEGES";
};
}
];
ensureDatabases = [ "crowdsec" ];
};
systemd.services.crowdsec = {
after = [ "syslog.target" "network.target" "remote-fs.target" "nss-lookup.target" ];
description = "Crowdsec agent";
serviceConfig = {
Type = "notify";
ExecStartPre = "${lib.getExe pkgs.crowdsec} -t -error";
ExecStart = "${lib.getExe pkgs.crowdsec}";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
Restart = "always";
RestartSec = 60;
};
wantedBy = [ "multi-user.target" ];
};
systemd.services.crowdsec-firewall-bouncer = {
path = [ pkgs.ipset pkgs.iptables ];
after = [ "syslog.target" "network.target" "remote-fs.target" "nss-lookup.target" ];
before = [ "netfilter-persistent.service" ];
description = "Crowdsec firewall bouncer";
serviceConfig = {
# Type = "notify";
ExecStartPre = "${lib.getExe pkgs.crowdsec-firewall-bouncer} -c /etc/crowdsec/crowdsec-firewall-bouncer.yaml -t";
ExecStart = "${lib.getExe pkgs.crowdsec-firewall-bouncer} -c /etc/crowdsec/crowdsec-firewall-bouncer.yaml";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
Restart = "always";
RestartSec = 10;
LimitNOFILE = 65536;
};
wantedBy = [ "multi-user.target" ];
};
}

2
hosts/thinkpad/default.nix
View file

@ -103,7 +103,7 @@
];
};
fonts.fonts = with pkgs; [
fonts.packages = with pkgs; [
nerdfonts
noto-fonts
noto-fonts-cjk