blob: 71818bd2f335d85f106ee5b6b99684a414846b57 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
|
{ config, lib, ... }:
let
cfg = config.os.srv.security.crowdsec;
in
{
options.os.srv.security.crowdsec = {
enable = lib.mkEnableOption "enables CrowdSec collaborative intrusion prevention";
aggregator.enable = lib.mkEnableOption "this node acting as a central LAPI aggregator for the network";
agent.enable = lib.mkEnableOption "local log parsing and threat intelligence generation on this node";
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = config.networking.nftables.enable;
message = "CrowdSec requires networking.nftables to be enabled for blocking.";
}
{
assertion = cfg.agent.enable || cfg.aggregator.enable;
message = "You must enable at least one CrowdSec role: 'agent.enable' or 'aggregator.enable'.";
}
];
services.crowdsec = {
enable = true;
autoUpdateService = true;
openFirewall = cfg.aggregator.enable;
settings = {
api.server.enable = cfg.aggregator.enable;
lapi.client.api_url = "http://${config.os.core.network.ips.gateway-vm}:8080";
};
hub = lib.mkIf cfg.agent.enable {
collections = [
"crowdsecurity/linux"
"crowdsecurity/nginx"
"crowdsecurity/authelia"
"crowdsecurity/sshd"
];
};
localConfig = {
acquisitions = lib.mkIf cfg.agent.enable [
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
labels.type = "syslog";
}
{
source = "file";
filenames = [ "/var/log/nginx/*.log" ];
labels.type = "nginx";
}
{
source = "file";
filenames = [ "/var/log/authelia/authelia.log" ];
labels.type = "authelia";
}
];
parsers.s02Enrich = lib.mkIf cfg.agent.enable [
{
name = "myips/whitelist";
description = "Prevent local address ranges from triggering bans";
whitelist = {
reason = "Internal private subnets";
cidr = [
"10.0.0.0/24"
"10.1.0.0/24"
"10.3.0.0/24"
"10.4.0.0/24"
];
};
}
];
notifications = lib.mkIf cfg.aggregator.enable [
{
name = "ntfy_alerts";
type = "http";
method = "POST";
#TODO add ntfy sops thing
url = "https://ntfy.sh/your_secret_topic_here";
headers = {
Title = "CrowdSec Alert on Bibus-Lab";
Priority = "high";
};
format = ''
{{range .}} {{.Alert.Message}} (Scenario: {{.Alert.Scenario}}) from IP {{.Alert.Source.IP}} {{end}}
'';
log_level = "info";
}
];
};
};
services.crowdsec-firewall-bouncer = {
enable = true;
registerBouncer.enable = cfg.aggregator.enable;
settings = {
mode = "nftables";
update_frequency = "10s";
api_url = "http://${config.os.core.network.ips.gateway-vm}:8080";
};
};
users.users.crowdsec.extraGroups = lib.mkIf cfg.agent.enable [
"systemd-journal"
"nginx"
"authelia-main"
];
};
}
|
