couple fixes

modules/nixos/services/crowdsec/default.nix

@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  pkgs,
   namespace,
   ...
 }:
@@ -142,6 +143,45 @@ let
       systemd.services.crowdsec-firewall-bouncer.serviceConfig.DynamicUser = lib.mkForce false;
       systemd.services.crowdsec-firewall-bouncer-register.serviceConfig.DynamicUser = lib.mkForce false;
 
+      # The upstream unit has Requires= but no After= for the register service, so
+      # the bouncer starts in parallel and hits LoadCredential before the key file
+      # exists. Adding After= enforces that the register service completes first.
+      systemd.services.crowdsec-firewall-bouncer.after = [ "crowdsec-firewall-bouncer-register.service" ];
+
+      # The upstream register script exits with an error when the bouncer is already
+      # registered in the LAPI but the local api-key.cred file is missing (e.g. after
+      # a system wipe or impermanence rotation). Override the script so that when the
+      # key file is absent it deletes the stale registration and re-registers, producing
+      # a fresh key file.
+      systemd.services.crowdsec-firewall-bouncer-register.script =
+        let
+          apiKeyFile = "/var/lib/crowdsec-firewall-bouncer-register/api-key.cred";
+          bouncerName = "nas-bouncer";
+          cscli = lib.getExe' config.services.crowdsec.package "cscli";
+          jq = lib.getExe pkgs.jq;
+        in
+        lib.mkForce ''
+          if ${cscli} bouncers list --output json | ${jq} -e -- 'any(.[]; .name == "${bouncerName}")' >/dev/null; then
+            # Bouncer already registered. Verify the API key is still present.
+            if [ ! -f ${apiKeyFile} ]; then
+              echo "Bouncer registered but API key file missing — deleting stale registration and re-registering"
+              ${cscli} bouncers delete -- ${bouncerName}
+              rm -f '${apiKeyFile}'
+              if ! ${cscli} bouncers add --output raw -- ${bouncerName} >${apiKeyFile}; then
+                rm -f '${apiKeyFile}'
+                exit 1
+              fi
+            fi
+          else
+            # Bouncer not registered — fresh registration.
+            rm -f '${apiKeyFile}'
+            if ! ${cscli} bouncers add --output raw -- ${bouncerName} >${apiKeyFile}; then
+              rm -f '${apiKeyFile}'
+              exit 1
+            fi
+          fi
+        '';
+
       # crowdsec-firewall-bouncer-register calls cscli without -c, so cscli
       # looks for /etc/crowdsec/config.yaml. The upstream crowdsec.service uses
       # a nix store path via -c and never creates that file. Expose the config