1 files changed, 61 insertions, 20 deletions

diff --git a/os/srv/crowdsec.nix b/os/srv/crowdsec.nix
index 79c8718..71818bd 100644
--- a/os/srv/crowdsec.nix
+++ b/os/srv/crowdsec.nix
@@ -5,6 +5,9 @@ in
 {
   options.os.srv.security.crowdsec = {
     enable = lib.mkEnableOption "enables CrowdSec collaborative intrusion prevention";
+
+    aggregator.enable = lib.mkEnableOption "this node acting as a central LAPI aggregator for the network";
+    agent.enable = lib.mkEnableOption "local log parsing and threat intelligence generation on this node";
   };
 
   config = lib.mkIf cfg.enable {
@@ -13,66 +16,104 @@ in
         assertion = config.networking.nftables.enable;
         message = "CrowdSec requires networking.nftables to be enabled for blocking.";
       }
+      {
+        assertion = cfg.agent.enable || cfg.aggregator.enable;
+        message = "You must enable at least one CrowdSec role: 'agent.enable' or 'aggregator.enable'.";
+      }
     ];
 
     services.crowdsec = {
       enable = true;
       autoUpdateService = true;
 
+      openFirewall = cfg.aggregator.enable;
+
+      settings = {
+        api.server.enable = cfg.aggregator.enable;
+        lapi.client.api_url = "http://${config.os.core.network.ips.gateway-vm}:8080";
+      };
+
+      hub = lib.mkIf cfg.agent.enable {
+        collections = [
+          "crowdsecurity/linux"
+          "crowdsecurity/nginx"
+          "crowdsecurity/authelia"
+          "crowdsecurity/sshd"
+        ];
+      };
+
       localConfig = {
-        acquisitions = [
+        acquisitions = lib.mkIf cfg.agent.enable [
           {
             source = "journalctl";
             journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
             labels.type = "syslog";
           }
           {
-            filenames = [
-              "/var/log/nginx/access.log"
-              "/var/log/nginx/error.log"
-            ];
+            source = "file";
+            filenames = [ "/var/log/nginx/*.log" ];
             labels.type = "nginx";
           }
+          {
+            source = "file";
+            filenames = [ "/var/log/authelia/authelia.log" ];
+            labels.type = "authelia";
+          }
         ];
 
-        parsers.s02Enrich = [
+        parsers.s02Enrich = lib.mkIf cfg.agent.enable [
           {
             name = "myips/whitelist";
             description = "Prevent local address ranges from triggering bans";
             whitelist = {
               reason = "Internal private subnets";
               cidr = [
-                "10.0.0.0/16"
+                "10.0.0.0/24"
+                "10.1.0.0/24"
+                "10.3.0.0/24"
+                "10.4.0.0/24"
               ];
             };
           }
         ];
-      };
 
-      hub = {
-        collections = [
-          "crowdsecurity/linux"
-          "crowdsecurity/nginx"
-          "crowdsecurity/sshd"
+        notifications = lib.mkIf cfg.aggregator.enable [
+          {
+            name = "ntfy_alerts";
+            type = "http";
+            method = "POST";
+            #TODO add ntfy sops thing
+            url = "https://ntfy.sh/your_secret_topic_here";
+            headers = {
+              Title = "CrowdSec Alert on Bibus-Lab";
+              Priority = "high";
+            };
+            format = ''
+              {{range .}} {{.Alert.Message}} (Scenario: {{.Alert.Scenario}}) from IP {{.Alert.Source.IP}} {{end}}
+            '';
+            log_level = "info";
+          }
         ];
       };
-
-      settings = {
-        lapi.credentialsFile = "/var/lib/crowdsec/state/lapi.yaml";
-        capi.credentialsFile = "/var/lib/crowdsec/state/capi.yaml";
-      };
     };
 
     services.crowdsec-firewall-bouncer = {
       enable = true;
+
+      registerBouncer.enable = cfg.aggregator.enable;
+
       settings = {
+        mode = "nftables";
         update_frequency = "10s";
+
+        api_url = "http://${config.os.core.network.ips.gateway-vm}:8080";
       };
     };
 
-    users.users.crowdsec.extraGroups = [
-      "nginx"
+    users.users.crowdsec.extraGroups = lib.mkIf cfg.agent.enable [
       "systemd-journal"
+      "nginx"
+      "authelia-main"
     ];
   };
 }