feat: Add crowdsec to replace fail2ban

2025-01-30 03:50:08 +08:00 · 2025-01-30 03:50:08 +08:00 · 40187d4b2d
commit 40187d4b2d
parent d0c6f2bcbe
3 changed files with 52 additions and 0 deletions
--- a/configuration/services/crowdsec.nix
+++ b/configuration/services/crowdsec.nix
@ -0,0 +1,35 @@
+{ pkgs, ... }:
+{
+  security.crowdsec = {
+    enable = true;
+
+    parserWhitelist = [
+      "1.64.239.213"
+    ];
+
+    settings.crowdsec_service.acquisition_path = pkgs.writeText "crowdsec-acquisitions.yaml" ''
+      ---
+      source: journalctl
+      journalctl_filter:
+        - "SYSLOG_IDENTIFIER=Nextcloud"
+      labels:
+        type: syslog
+      ---
+      source: journalctl
+      journalctl_filter:
+        - "SYSLOG_IDENTIFIER=sshd-session"
+      labels:
+        type: syslog
+      ---
+    '';
+
+    remediationComponents.firewallBouncer = {
+      enable = true;
+      settings.prometheus = {
+        enabled = true;
+        listen_addr = "127.0.0.1";
+        listen_port = "60601";
+      };
+    };
+  };
+}