{ config, lib, ... }:
let
  cfg = config.os.srv.security.crowdsec;
in
{
  options.os.srv.security.crowdsec = {
    enable = lib.mkEnableOption "enables CrowdSec collaborative intrusion prevention";
  };

  config = lib.mkIf cfg.enable {
    assertions = [
      {
        assertion = config.networking.nftables.enable;
        message = "CrowdSec requires networking.nftables to be enabled for blocking.";
      }
    ];

    services.crowdsec = {
      enable = true;
      autoUpdateService = true;

      localConfig = {
        acquisitions = [
          {
            source = "journalctl";
            journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
            labels.type = "syslog";
          }
          {
            filenames = [
              "/var/log/nginx/access.log"
              "/var/log/nginx/error.log"
            ];
            labels.type = "nginx";
          }
        ];

        parsers.s02Enrich = [
          {
            name = "myips/whitelist";
            description = "Prevent local address ranges from triggering bans";
            whitelist = {
              reason = "Internal private subnets";
              cidr = [
                "10.0.0.0/16"
              ];
            };
          }
        ];
      };

      hub = {
        collections = [
          "crowdsecurity/linux"
          "crowdsecurity/nginx"
          "crowdsecurity/sshd"
        ];
      };

      settings = {
        lapi.credentialsFile = "/var/lib/crowdsec/state/lapi.yaml";
        capi.credentialsFile = "/var/lib/crowdsec/state/capi.yaml";
      };
    };

    services.crowdsec-firewall-bouncer = {
      enable = true;
      settings = {
        update_frequency = "10s";
      };
    };

    users.users.crowdsec.extraGroups = [
      "nginx"
      "systemd-journal"
    ];
  };
}