mjallen/nix-config
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

crowdsec

Browse Source
This commit is contained in:
mjallen18
2025-10-09 14:53:19 -05:00
parent 8677ca747a
commit ef22231dd7
13 changed files with 311 additions and 271 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
modules/nixos/programs/default.nix
View File

@@ -62,7 +62,7 @@
libgbm libgbm
]; ];
}; };
seahorse.enable = lib.mkDefault false; seahorse.enable = lib.mkDefault true;
}; };
environment = { environment = {
systemPackages = with pkgs; [ systemPackages = with pkgs; [

1
modules/nixos/services/actual/default.nix
View File

@@ -25,7 +25,6 @@ let
userFiles = "${dataDir}/user-files"; userFiles = "${dataDir}/user-files";
}; };
}; };
};
users.users.actual = { users.users.actual = {
isSystemUser = true; isSystemUser = true;

1
modules/nixos/services/arrs/default.nix
View File

@@ -1,6 +1,5 @@
{ {
config, config,
pkgs,
lib, lib,
namespace, namespace,
... ...

45
modules/nixos/services/calibre/default.nix
View File

@@ -1,6 +1,5 @@
{ {
config, config,
pkgs,
lib, lib,
namespace, namespace,
... ...
@@ -39,31 +38,31 @@ let
# }; # };
# }; # };
# users.users.calibre = { # users.users.calibre = {
# isSystemUser = true; # isSystemUser = true;
# uid = lib.mkForce calibreUserId; # uid = lib.mkForce calibreUserId;
# group = "calibre"; # group = "calibre";
# }; # };
# users.groups = { # users.groups = {
# calibre-web = { # calibre-web = {
# gid = lib.mkForce calibreGroupId; # gid = lib.mkForce calibreGroupId;
# }; # };
# }; # };
# networking = { # networking = {
# firewall = { # firewall = {
# enable = true; # enable = true;
# allowedTCPPorts = [ cfg.port ]; # allowedTCPPorts = [ cfg.port ];
# }; # };
# # Use systemd-resolved inside the container # # Use systemd-resolved inside the container
# # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686 # # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
# useHostResolvConf = lib.mkForce false; # useHostResolvConf = lib.mkForce false;
# }; # };
# services.resolved.enable = true; # services.resolved.enable = true;
# system.stateVersion = "23.11"; # system.stateVersion = "23.11";
# }; # };
# bindMounts = { # bindMounts = {
# ${dataDir} = { # ${dataDir} = {

12
modules/nixos/services/crowdsec/default.nix
View File

@@ -69,8 +69,16 @@ in
]; ];
}; };
settings = { settings = {
# general.api.server.enable = true; general.api = {
capi.credentialsFile = cfg.apiKey; server = {
enable = true;
listen_uri = "${cfg.apiAddress}:${toString cfg.port}";
};
client = {
credentials_path = lib.mkForce "/media/nas/main/nix-app-data/crowdsec/client.yaml";
};
};
capi.credentialsFile = lib.mkDefault "/media/nas/main/nix-app-data/crowdsec/capi.yaml";
}; };
}; };
}; };

2
modules/nixos/services/crowdsec/options.nix
View File

@@ -6,7 +6,7 @@ with lib;
port = mkOption { port = mkOption {
type = types.port; type = types.port;
default = 9898; default = 8080;
description = "Port for crowdsec API"; description = "Port for crowdsec API";
}; };

60
modules/nixos/services/gitea/default.nix
View File

@@ -27,35 +27,37 @@ let
in in
{ {
imports = [ ./options.nix ]; imports = [ ./options.nix ];
config = mkIf cfg.enable { config =
services.gitea = { mkIf cfg.enable {
enable = true; services.gitea = {
stateDir = cfg.dataDir; enable = true;
user = "nix-apps"; stateDir = cfg.dataDir;
group = "jallen-nas"; user = "nix-apps";
mailerPasswordFile = mailerPasswordFile; group = "jallen-nas";
metricsTokenFile = metricsTokenFile; mailerPasswordFile = mailerPasswordFile;
settings = { metricsTokenFile = metricsTokenFile;
server = { settings = {
DOMAIN = "jallen-nas"; server = {
HTTP_ADDR = "0.0.0.0"; DOMAIN = "jallen-nas";
HTTP_PORT = cfg.httpPort; HTTP_ADDR = "0.0.0.0";
PROTOCOL = "http"; HTTP_PORT = cfg.httpPort;
ROOT_URL = rootUrl; PROTOCOL = "http";
START_SSH_SERVER = true; ROOT_URL = rootUrl;
SSH_PORT = cfg.sshPort; START_SSH_SERVER = true;
}; SSH_PORT = cfg.sshPort;
service = { };
REGISTER_EMAIL_CONFIRM = false; service = {
ENABLE_CAPTCHA = false; REGISTER_EMAIL_CONFIRM = false;
DISABLE_REGISTRATION = true; ENABLE_CAPTCHA = false;
ENABLE_OPENID_SIGNIN = false; DISABLE_REGISTRATION = true;
ENABLE_LDAP_SIGNIN = false; ENABLE_OPENID_SIGNIN = false;
ENABLE_SSH_SIGNIN = true; ENABLE_LDAP_SIGNIN = false;
ENABLE_BUILTIN_SSH_SERVER = true; ENABLE_SSH_SIGNIN = true;
ENABLE_REVERSE_PROXY_AUTHENTICATION = true; ENABLE_BUILTIN_SSH_SERVER = true;
ENABLE_REVERSE_PROXY_AUTHENTICATION = true;
};
}; };
}; };
}; }
} // traefik; // traefik;
} }

47
modules/nixos/services/traefik/default.nix
View File

@@ -76,7 +76,7 @@ let
traefikPlugins = { traefikPlugins = {
bouncer = { bouncer = {
moduleName = "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"; moduleName = "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin";
version = "v1.4.2"; version = "v1.4.5";
}; };
geoblock = { geoblock = {
moduleName = "github.com/PascalMinder/geoblock"; moduleName = "github.com/PascalMinder/geoblock";
@@ -84,9 +84,6 @@ let
}; };
}; };
crowdsecAppsecHost = "${serverIp}:7422";
crowdsecLapiKeyFile = config.sops.secrets."jallen-nas/traefik/crowdsec-lapi-key".path;
# Ports # Ports
httpPort = 80; httpPort = 80;
httpsPort = 443; httpsPort = 443;
@@ -111,7 +108,21 @@ in
config = mkIf cfg.enable { config = mkIf cfg.enable {
sops = { sops = {
secrets = { secrets = {
"jallen-nas/traefik/crowdsec-lapi-key" = { "jallen-nas/traefik/crowdsec/lapi-key" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = config.users.users.traefik.name;
group = config.users.users.traefik.group;
restartUnits = [ "traefik.service" ];
};
"jallen-nas/traefik/crowdsec/capi-machine-id" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = config.users.users.traefik.name;
group = config.users.users.traefik.group;
restartUnits = [ "traefik.service" ];
};
"jallen-nas/traefik/crowdsec/capi-password" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml"); sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = config.users.users.traefik.name; owner = config.users.users.traefik.name;
group = config.users.users.traefik.group; group = config.users.users.traefik.group;
@@ -119,15 +130,27 @@ in
}; };
"jallen-nas/traefik/cloudflare-dns-api-token" = { "jallen-nas/traefik/cloudflare-dns-api-token" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml"); sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = config.users.users.traefik.name;
group = config.users.users.traefik.group;
restartUnits = [ "traefik.service" ];
}; };
"jallen-nas/traefik/cloudflare-zone-api-token" = { "jallen-nas/traefik/cloudflare-zone-api-token" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml"); sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = config.users.users.traefik.name;
group = config.users.users.traefik.group;
restartUnits = [ "traefik.service" ];
}; };
"jallen-nas/traefik/cloudflare-api-key" = { "jallen-nas/traefik/cloudflare-api-key" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml"); sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = config.users.users.traefik.name;
group = config.users.users.traefik.group;
restartUnits = [ "traefik.service" ];
}; };
"jallen-nas/traefik/cloudflare-email" = { "jallen-nas/traefik/cloudflare-email" = {
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml"); sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
owner = config.users.users.traefik.name;
group = config.users.users.traefik.group;
restartUnits = [ "traefik.service" ];
}; };
}; };
templates = { templates = {
@@ -250,11 +273,15 @@ in
crowdsec = { crowdsec = {
plugin = { plugin = {
bouncer = { bouncer = {
crowdsecAppsecEnabled = true; enabled = true;
crowdsecAppsecHost = crowdsecAppsecHost; crowdsecLapiKeyFile = config.sops.secrets."jallen-nas/traefik/crowdsec/lapi-key".path;
crowdsecAppsecFailureBlock = true; crowdsecLapiScheme = "http";
crowdsecAppsecUnreachableBlock = true; crowdsecLapiHost = "localhost:8181";
crowdsecLapiKeyFile = crowdsecLapiKeyFile; crowdsecLapiPath = "/";
crowdsecLapiTLSInsecureVerify = false;
crowdsecCapiMachineIdFile = config.sops.secrets."jallen-nas/traefik/crowdsec/capi-machine-id".path;
crowdsecCapiPasswordFile = config.sops.secrets."jallen-nas/traefik/crowdsec/capi-password".path;
crowdsecCapiScenarios = [ ];
}; };
}; };
}; };

4
overlays/rcon/default.nix
View File

@@ -1,5 +1,5 @@
{ inputs, ... }: { ... }:
final: _prev: { _final: _prev: {
# rcon = inputs.nixpkgs-stable.legacyPackages."x86_64-linux".rcon; # rcon = inputs.nixpkgs-stable.legacyPackages."x86_64-linux".rcon;
# llama-cpp = inputs.nixpkgs-stable.legacyPackages."x86_64-linux".llama-cpp; # llama-cpp = inputs.nixpkgs-stable.legacyPackages."x86_64-linux".llama-cpp;
} }

399
secrets/nas-secrets.yaml
View File

File diff suppressed because one or more lines are too long

4
systems/x86_64-linux/jallen-nas/apps.nix
View File

@@ -74,8 +74,8 @@
crowdsec = { crowdsec = {
enable = true; enable = true;
port = 9898; port = 8181;
apiAddress = "10.0.1.3"; apiAddress = "0.0.0.0";
apiKey = config.sops.secrets."jallen-nas/crowdsec-capi".path; apiKey = config.sops.secrets."jallen-nas/crowdsec-capi".path;
dataDir = "/media/nas/main/nix-app-data/crowdsec"; dataDir = "/media/nas/main/nix-app-data/crowdsec";
}; };

3
systems/x86_64-linux/jallen-nas/default.nix
View File

@@ -10,7 +10,7 @@
... ...
}: }:
let let
inherit (lib.${namespace}) enabled disabled; inherit (lib.${namespace}) enabled;
in in
{ {
imports = [ imports = [
@@ -150,6 +150,7 @@ in
8192 8192
3000 3000
2222 2222
8181
]; ];
allowedUDPPorts = config.${namespace}.network.firewall.allowedTCPPorts; allowedUDPPorts = config.${namespace}.network.firewall.allowedTCPPorts;
}; };

2
systems/x86_64-linux/jallen-nas/sops.nix
View File

@@ -100,6 +100,8 @@ in
"jallen-nas/crowdsec-capi" = { "jallen-nas/crowdsec-capi" = {
sopsFile = defaultSops; sopsFile = defaultSops;
owner = "crowdsec";
group = "crowdsec";
restartUnits = [ "crowdsec.service" ]; restartUnits = [ "crowdsec.service" ];
}; };