120 lines
3.1 KiB
Nix
Executable File
120 lines
3.1 KiB
Nix
Executable File
{
|
|
config,
|
|
lib,
|
|
namespace,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.${namespace}.services.crowdsec;
|
|
in
|
|
{
|
|
imports = [ ./options.nix ];
|
|
config = lib.mkIf cfg.enable {
|
|
|
|
services = {
|
|
crowdsec = {
|
|
enable = true;
|
|
openFirewall = true;
|
|
hub = {
|
|
appSecConfigs = [
|
|
"crowdsecurity/appsec-default"
|
|
];
|
|
appSecRules = [
|
|
"crowdsecurity/base-config"
|
|
];
|
|
collections = [
|
|
"crowdsecurity/http-cve"
|
|
"crowdsecurity/http-dos"
|
|
"crowdsecurity/linux"
|
|
"crowdsecurity/nextcloud"
|
|
"crowdsecurity/pgsql"
|
|
"crowdsecurity/smb"
|
|
"crowdsecurity/sshd"
|
|
"crowdsecurity/traefik"
|
|
"firix/authentik"
|
|
];
|
|
parsers = [
|
|
"crowdsecurity/actual-budget-whitelist"
|
|
"crowdsecurity/jellyfin-whitelist"
|
|
"crowdsecurity/jellyseerr-whitelist"
|
|
"crowdsecurity/nextcloud-logs"
|
|
"crowdsecurity/nextcloud-whitelist"
|
|
"crowdsecurity/pgsql-logs"
|
|
"crowdsecurity/smb-logs"
|
|
"crowdsecurity/sshd-logs"
|
|
"crowdsecurity/sshd-success-logs"
|
|
"crowdsecurity/syslog-logs"
|
|
];
|
|
postOverflows = [
|
|
"crowdsecurity/auditd-nix-wrappers-whitelist-process"
|
|
];
|
|
scenarios = [
|
|
"crowdsecurity/ssh-bf"
|
|
];
|
|
};
|
|
localConfig = {
|
|
acquisitions = [
|
|
{
|
|
journalctl_filter = [
|
|
"_SYSTEMD_UNIT=authentik.service"
|
|
];
|
|
labels = {
|
|
type = "syslog";
|
|
};
|
|
source = "journalctl";
|
|
}
|
|
{
|
|
journalctl_filter = [
|
|
"_SYSTEMD_UNIT=postgresql.service"
|
|
];
|
|
labels = {
|
|
type = "syslog";
|
|
};
|
|
source = "journalctl";
|
|
}
|
|
{
|
|
journalctl_filter = [
|
|
"_SYSTEMD_UNIT=smbd.service"
|
|
];
|
|
labels = {
|
|
type = "syslog";
|
|
};
|
|
source = "journalctl";
|
|
}
|
|
{
|
|
journalctl_filter = [
|
|
"_SYSTEMD_UNIT=sshd.service"
|
|
];
|
|
labels = {
|
|
type = "syslog";
|
|
};
|
|
source = "journalctl";
|
|
}
|
|
{
|
|
journalctl_filter = [
|
|
"_SYSTEMD_UNIT=traefik.service"
|
|
];
|
|
labels = {
|
|
type = "syslog";
|
|
};
|
|
source = "journalctl";
|
|
}
|
|
];
|
|
};
|
|
settings = {
|
|
general.api = {
|
|
server = {
|
|
enable = true;
|
|
listen_uri = "${cfg.apiAddress}:${toString cfg.port}";
|
|
};
|
|
client = {
|
|
credentials_path = lib.mkForce "/media/nas/main/nix-app-data/crowdsec/client.yaml";
|
|
};
|
|
};
|
|
capi.credentialsFile = lib.mkDefault "/media/nas/main/nix-app-data/crowdsec/capi.yaml";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|