1 files changed, 78 insertions, 0 deletions
diff --git a/os/srv/crowdsec.nix b/os/srv/crowdsec.nix
new file mode 100644
index 0000000..79c8718
--- /dev/null
+++ b/os/srv/crowdsec.nix
@@ -0,0 +1,78 @@
+{ config, lib, ... }:
+let
+  cfg = config.os.srv.security.crowdsec;
+in
+{
+  options.os.srv.security.crowdsec = {
+    enable = lib.mkEnableOption "enables CrowdSec collaborative intrusion prevention";
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.networking.nftables.enable;
+        message = "CrowdSec requires networking.nftables to be enabled for blocking.";
+      }
+    ];
+
+    services.crowdsec = {
+      enable = true;
+      autoUpdateService = true;
+
+      localConfig = {
+        acquisitions = [
+          {
+            source = "journalctl";
+            journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
+            labels.type = "syslog";
+          }
+          {
+            filenames = [
+              "/var/log/nginx/access.log"
+              "/var/log/nginx/error.log"
+            ];
+            labels.type = "nginx";
+          }
+        ];
+
+        parsers.s02Enrich = [
+          {
+            name = "myips/whitelist";
+            description = "Prevent local address ranges from triggering bans";
+            whitelist = {
+              reason = "Internal private subnets";
+              cidr = [
+                "10.0.0.0/16"
+              ];
+            };
+          }
+        ];
+      };
+
+      hub = {
+        collections = [
+          "crowdsecurity/linux"
+          "crowdsecurity/nginx"
+          "crowdsecurity/sshd"
+        ];
+      };
+
+      settings = {
+        lapi.credentialsFile = "/var/lib/crowdsec/state/lapi.yaml";
+        capi.credentialsFile = "/var/lib/crowdsec/state/capi.yaml";
+      };
+    };
+
+    services.crowdsec-firewall-bouncer = {
+      enable = true;
+      settings = {
+        update_frequency = "10s";
+      };
+    };
+
+    users.users.crowdsec.extraGroups = [
+      "nginx"
+      "systemd-journal"
+    ];
+  };
+}