blob: 79c87185eb18873cf82928cbd35270a0a840a0a1 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
|
{ config, lib, ... }:
let
cfg = config.os.srv.security.crowdsec;
in
{
options.os.srv.security.crowdsec = {
enable = lib.mkEnableOption "enables CrowdSec collaborative intrusion prevention";
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = config.networking.nftables.enable;
message = "CrowdSec requires networking.nftables to be enabled for blocking.";
}
];
services.crowdsec = {
enable = true;
autoUpdateService = true;
localConfig = {
acquisitions = [
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
labels.type = "syslog";
}
{
filenames = [
"/var/log/nginx/access.log"
"/var/log/nginx/error.log"
];
labels.type = "nginx";
}
];
parsers.s02Enrich = [
{
name = "myips/whitelist";
description = "Prevent local address ranges from triggering bans";
whitelist = {
reason = "Internal private subnets";
cidr = [
"10.0.0.0/16"
];
};
}
];
};
hub = {
collections = [
"crowdsecurity/linux"
"crowdsecurity/nginx"
"crowdsecurity/sshd"
];
};
settings = {
lapi.credentialsFile = "/var/lib/crowdsec/state/lapi.yaml";
capi.credentialsFile = "/var/lib/crowdsec/state/capi.yaml";
};
};
services.crowdsec-firewall-bouncer = {
enable = true;
settings = {
update_frequency = "10s";
};
};
users.users.crowdsec.extraGroups = [
"nginx"
"systemd-journal"
];
};
}
|
