1 files changed, 68 insertions, 6 deletions

diff --git a/os/srv/crowdsec.nix b/os/srv/crowdsec.nix
index 71818bd..c3df81b 100644
--- a/os/srv/crowdsec.nix
+++ b/os/srv/crowdsec.nix
@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  masterDomain,
+  ...
+}:
 let
   cfg = config.os.srv.security.crowdsec;
 in
@@ -22,14 +27,71 @@ in
       }
     ];
 
+    sops = {
+      secrets."crowdsec/env" = {
+        owner = "crowdsec";
+        group = "crowdsec";
+        restartUnits = [ "crowdsec.service" ];
+      };
+
+      templates."local_api_credentials.yaml" = {
+        owner = "crowdsec";
+        group = "crowdsec";
+        restartUnits = [ "crowdsec.service" ];
+        content = ''
+          url: http://${config.os.core.network.ips.gateway-vm}:8080
+          login: ${config.networking.hostName}
+          password: ${config.sops.placeholder."crowdsec/client_password"}
+        '';
+      };
+    };
+
+    systemd.services.crowdsec.serviceConfig.EnvironmentFile = config.sops.secrets."crowdsec/env".path;
+
     services.crowdsec = {
       enable = true;
       autoUpdateService = true;
 
-      openFirewall = cfg.aggregator.enable;
+      openFirewall = true;
 
       settings = {
-        api.server.enable = cfg.aggregator.enable;
+        common = {
+          compress_logs = true;
+          log_format = "json";
+        };
+        prometheus = {
+          enabled = true;
+          level = "full";
+          listen_addr = "0.0.0.0";
+          listen_port = 6060;
+        };
+        db_config = {
+          type = "postgresql";
+          host = config.os.core.network.ips.database-vm;
+          port = 5432;
+          db_name = "crowdsec";
+          user = "crowdsec";
+          password = "$CROWDSEC_DB_PASSWORD";
+          sslmode = "require";
+        };
+
+        api = {
+          server = {
+            enable = cfg.aggregator.enable;
+            listen_uri = "0.0.0.0:8080";
+            trusted_ips = [
+              "127.0.0.1"
+              "10.0.0.0/24"
+            ];
+
+            auto_registration = {
+              enabled = cfg.aggregator.enable;
+              token = "$CROWDSEC_REGISTER_TOKEN";
+              allowed_ranges = [ "10.0.0.0/24" ];
+            };
+          };
+          client.credentials_path = config.sops.templates."local_api_credentials.yaml".path;
+        };
         lapi.client.api_url = "http://${config.os.core.network.ips.gateway-vm}:8080";
       };
 
@@ -82,11 +144,11 @@ in
             name = "ntfy_alerts";
             type = "http";
             method = "POST";
-            #TODO add ntfy sops thing
-            url = "https://ntfy.sh/your_secret_topic_here";
+            url = "https://ntfy.${masterDomain}/crowdsec-alerts";
             headers = {
               Title = "CrowdSec Alert on Bibus-Lab";
               Priority = "high";
+              Authorization = "$NTFY_AUTH_TOKEN";
             };
             format = ''
               {{range .}} {{.Alert.Message}} (Scenario: {{.Alert.Scenario}}) from IP {{.Alert.Source.IP}} {{end}}
@@ -105,8 +167,8 @@ in
       settings = {
         mode = "nftables";
         update_frequency = "10s";
-
         api_url = "http://${config.os.core.network.ips.gateway-vm}:8080";
+        api_key = lib.mkIf cfg.aggregator.enable "$CROWDSEC_LOCAL_BOUNCER_KEY";
       };
     };