mjallen/nix-config
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

crowdsec

Browse Source
This commit is contained in:
mjallen18
2025-10-09 14:53:19 -05:00
parent 8677ca747a
commit ef22231dd7
13 changed files with 311 additions and 271 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
modules/nixos/programs/default.nix
View File

@@ -62,7 +62,7 @@
libgbm
];
};
seahorse.enable = lib.mkDefault false;
seahorse.enable = lib.mkDefault true;
};
environment = {
systemPackages = with pkgs; [

1
modules/nixos/services/actual/default.nix
View File

@@ -25,7 +25,6 @@ let
userFiles = "${dataDir}/user-files";
};
};
};
users.users.actual = {
isSystemUser = true;

1
modules/nixos/services/arrs/default.nix
View File

@@ -1,6 +1,5 @@
{
config,
pkgs,
lib,
namespace,
...

45
modules/nixos/services/calibre/default.nix
View File

@@ -1,6 +1,5 @@
{
config,
pkgs,
lib,
namespace,
...
@@ -39,31 +38,31 @@ let
# };
# };
# users.users.calibre = {
# isSystemUser = true;
# uid = lib.mkForce calibreUserId;
# group = "calibre";
# };
# users.users.calibre = {
# isSystemUser = true;
# uid = lib.mkForce calibreUserId;
# group = "calibre";
# };
# users.groups = {
# calibre-web = {
# gid = lib.mkForce calibreGroupId;
# };
# };
# users.groups = {
# calibre-web = {
# gid = lib.mkForce calibreGroupId;
# };
# };
# networking = {
# firewall = {
# enable = true;
# allowedTCPPorts = [ cfg.port ];
# };
# # Use systemd-resolved inside the container
# # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
# useHostResolvConf = lib.mkForce false;
# };
# networking = {
# firewall = {
# enable = true;
# allowedTCPPorts = [ cfg.port ];
# };
# # Use systemd-resolved inside the container
# # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
# useHostResolvConf = lib.mkForce false;
# };
# services.resolved.enable = true;
# system.stateVersion = "23.11";
# };
# services.resolved.enable = true;
# system.stateVersion = "23.11";
# };
# bindMounts = {
# ${dataDir} = {

12
modules/nixos/services/crowdsec/default.nix
View File

@@ -69,8 +69,16 @@ in
];
};
settings = {
# general.api.server.enable = true;
capi.credentialsFile = cfg.apiKey;
general.api = {
server = {
enable = true;
listen_uri = "${cfg.apiAddress}:${toString cfg.port}";
};
client = {
credentials_path = lib.mkForce "/media/nas/main/nix-app-data/crowdsec/client.yaml";
};
};
capi.credentialsFile = lib.mkDefault "/media/nas/main/nix-app-data/crowdsec/capi.yaml";
};
};
};

2
modules/nixos/services/crowdsec/options.nix
View File

@@ -6,7 +6,7 @@ with lib;
port = mkOption {
type = types.port;
default = 9898;
default = 8080;
description = "Port for crowdsec API";
};

60
modules/nixos/services/gitea/default.nix
View File

@@ -27,35 +27,37 @@ let
in
{
imports = [ ./options.nix ];
config = mkIf cfg.enable {
services.gitea = {
enable = true;
stateDir = cfg.dataDir;
user = "nix-apps";
group = "jallen-nas";
mailerPasswordFile = mailerPasswordFile;
metricsTokenFile = metricsTokenFile;
settings = {
server = {
DOMAIN = "jallen-nas";
HTTP_ADDR = "0.0.0.0";
HTTP_PORT = cfg.httpPort;
PROTOCOL = "http";
ROOT_URL = rootUrl;
START_SSH_SERVER = true;
SSH_PORT = cfg.sshPort;
};
service = {
REGISTER_EMAIL_CONFIRM = false;
ENABLE_CAPTCHA = false;
DISABLE_REGISTRATION = true;
ENABLE_OPENID_SIGNIN = false;
ENABLE_LDAP_SIGNIN = false;
ENABLE_SSH_SIGNIN = true;
ENABLE_BUILTIN_SSH_SERVER = true;
ENABLE_REVERSE_PROXY_AUTHENTICATION = true;
config =
mkIf cfg.enable {
services.gitea = {
enable = true;
stateDir = cfg.dataDir;
user = "nix-apps";
group = "jallen-nas";
mailerPasswordFile = mailerPasswordFile;
metricsTokenFile = metricsTokenFile;
settings = {
server = {
DOMAIN = "jallen-nas";
HTTP_ADDR = "0.0.0.0";
HTTP_PORT = cfg.httpPort;
PROTOCOL = "http";
ROOT_URL = rootUrl;
START_SSH_SERVER = true;
SSH_PORT = cfg.sshPort;
};
service = {
REGISTER_EMAIL_CONFIRM = false;
ENABLE_CAPTCHA = false;
DISABLE_REGISTRATION = true;
ENABLE_OPENID_SIGNIN = false;
ENABLE_LDAP_SIGNIN = false;
ENABLE_SSH_SIGNIN = true;
ENABLE_BUILTIN_SSH_SERVER = true;
ENABLE_REVERSE_PROXY_AUTHENTICATION = true;
};
};
};
};
} // traefik;
}
// traefik;
}

47
modules/nixos/services/traefik/default.nix
View File

@@ -76,7 +76,7 @@ let
traefikPlugins = {
bouncer = {
moduleName = "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin";
version = "v1.4.2";
version = "v1.4.5";
};
geoblock = {
moduleName = "github.com/PascalMinder/geoblock";
@@ -84,9 +84,6 @@ let
};
};
crowdsecAppsecHost = "${serverIp}:7422";
crowdsecLapiKeyFile = config.sops.secrets."jallen-nas/traefik/crowdsec-lapi-key".path;
# Ports
httpPort = 80;
httpsPort = 443;
@@ -111,7 +108,21 @@ in
config = mkIf cfg.enable {
sops = {
secrets = {
"jallen-nas/traefik/crowdsec-lapi-key" = {
"jallen-nas/traefik/crowdsec/lapi-key" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = config.users.users.traefik.name;
group = config.users.users.traefik.group;
restartUnits = [ "traefik.service" ];
};
"jallen-nas/traefik/crowdsec/capi-machine-id" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = config.users.users.traefik.name;
group = config.users.users.traefik.group;
restartUnits = [ "traefik.service" ];
};
"jallen-nas/traefik/crowdsec/capi-password" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = config.users.users.traefik.name;
group = config.users.users.traefik.group;
@@ -119,15 +130,27 @@ in
};
"jallen-nas/traefik/cloudflare-dns-api-token" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = config.users.users.traefik.name;
group = config.users.users.traefik.group;
restartUnits = [ "traefik.service" ];
};
"jallen-nas/traefik/cloudflare-zone-api-token" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = config.users.users.traefik.name;
group = config.users.users.traefik.group;
restartUnits = [ "traefik.service" ];
};
"jallen-nas/traefik/cloudflare-api-key" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = config.users.users.traefik.name;
group = config.users.users.traefik.group;
restartUnits = [ "traefik.service" ];
};
"jallen-nas/traefik/cloudflare-email" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = config.users.users.traefik.name;
group = config.users.users.traefik.group;
restartUnits = [ "traefik.service" ];
};
};
templates = {
@@ -250,11 +273,15 @@ in
crowdsec = {
plugin = {
bouncer = {
crowdsecAppsecEnabled = true;
crowdsecAppsecHost = crowdsecAppsecHost;
crowdsecAppsecFailureBlock = true;
crowdsecAppsecUnreachableBlock = true;
crowdsecLapiKeyFile = crowdsecLapiKeyFile;
enabled = true;
crowdsecLapiKeyFile = config.sops.secrets."jallen-nas/traefik/crowdsec/lapi-key".path;
crowdsecLapiScheme = "http";
crowdsecLapiHost = "localhost:8181";
crowdsecLapiPath = "/";
crowdsecLapiTLSInsecureVerify = false;
crowdsecCapiMachineIdFile = config.sops.secrets."jallen-nas/traefik/crowdsec/capi-machine-id".path;
crowdsecCapiPasswordFile = config.sops.secrets."jallen-nas/traefik/crowdsec/capi-password".path;
crowdsecCapiScenarios = [ ];
};
};
};

4
overlays/rcon/default.nix
View File

@@ -1,5 +1,5 @@
{ inputs, ... }:
final: _prev: {
{ ... }:
_final: _prev: {
# rcon = inputs.nixpkgs-stable.legacyPackages."x86_64-linux".rcon;
# llama-cpp = inputs.nixpkgs-stable.legacyPackages."x86_64-linux".llama-cpp;
}

399
secrets/nas-secrets.yaml
View File

File diff suppressed because one or more lines are too long

4
systems/x86_64-linux/jallen-nas/apps.nix
View File

@@ -74,8 +74,8 @@
crowdsec = {
enable = true;
port = 9898;
apiAddress = "10.0.1.3";
port = 8181;
apiAddress = "0.0.0.0";
apiKey = config.sops.secrets."jallen-nas/crowdsec-capi".path;
dataDir = "/media/nas/main/nix-app-data/crowdsec";
};

3
systems/x86_64-linux/jallen-nas/default.nix
View File

@@ -10,7 +10,7 @@
...
}:
let
inherit (lib.${namespace}) enabled disabled;
inherit (lib.${namespace}) enabled;
in
{
imports = [
@@ -150,6 +150,7 @@ in
8192
3000
2222
8181
];
allowedUDPPorts = config.${namespace}.network.firewall.allowedTCPPorts;
};

2
systems/x86_64-linux/jallen-nas/sops.nix
View File

@@ -100,6 +100,8 @@ in
"jallen-nas/crowdsec-capi" = {
sopsFile = defaultSops;
owner = "crowdsec";
group = "crowdsec";
restartUnits = [ "crowdsec.service" ];
};