rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2025-04-29 18:08:29 +02:00
Code Issues Projects Releases Packages Wiki Activity

configured crowdsec

Browse source
This commit is contained in:
Rouven Seifert 2023-07-27 23:25:08 +02:00
parent 5fa24530b1
commit 60e1f3c3d0
Signed by: rouven.seifert
GPG key ID: B95E8FE6B11C4D09
9 changed files with 196 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

52
hosts/falkenstein-1/modules/crowdsec/default.nix Normal file
View file

@ -0,0 +1,52 @@
{ pkgs, lib, ... }:
{
environment.systemPackages = with pkgs; [
crowdsec
crowdsec-firewall-bouncer
ipset
];
services.postgresql = {
enable = true;
ensureUsers = [
{
name = "crowdsec";
ensurePermissions = {
"DATABASE crowdsec" = "ALL PRIVILEGES";
};
}
];
ensureDatabases = [ "crowdsec" ];
};
systemd.services.crowdsec = {
after = [ "syslog.target" "network.target" "remote-fs.target" "nss-lookup.target" ];
description = "Crowdsec agent";
serviceConfig = {
Type = "notify";
ExecStartPre = "${lib.getExe pkgs.crowdsec} -t -error";
ExecStart = "${lib.getExe pkgs.crowdsec}";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
Restart = "always";
RestartSec = 60;
};
wantedBy = [ "multi-user.target" ];
};
systemd.services.crowdsec-firewall-bouncer = {
path = [ pkgs.ipset pkgs.iptables ];
after = [ "syslog.target" "network.target" "remote-fs.target" "nss-lookup.target" ];
before = [ "netfilter-persistent.service" ];
description = "Crowdsec firewall bouncer";
serviceConfig = {
# Type = "notify";
ExecStartPre = "${lib.getExe pkgs.crowdsec-firewall-bouncer} -c /etc/crowdsec/crowdsec-firewall-bouncer.yaml -t";
ExecStart = "${lib.getExe pkgs.crowdsec-firewall-bouncer} -c /etc/crowdsec/crowdsec-firewall-bouncer.yaml";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
Restart = "always";
RestartSec = 10;
LimitNOFILE = 65536;
};
wantedBy = [ "multi-user.target" ];
};
}