tlaternet/tlaternet-server
1
0
Fork 0
Code Issues 10 Pull requests Activity

style(treewide): Apply linter suggestions

Browse source
This commit is contained in:
Tristan Daniël Maat 2025-05-20 20:38:43 +08:00
parent 5192ec9633
commit bbdd459c18
Signed by: tlater
GPG key ID: 49670FD774E43268
20 changed files with 432 additions and 450 deletions
Download patch file Download diff file Expand all files Collapse all files

11
checks/default.nix
View file

@ -8,6 +8,15 @@
let let
pkgs = nixpkgs.legacyPackages.${system}; pkgs = nixpkgs.legacyPackages.${system};
statix' = pkgs.statix.overrideAttrs (old: {
patches = old.patches ++ [
(pkgs.fetchpatch {
url = "https://github.com/oppiliappan/statix/commit/925dec39bb705acbbe77178b4d658fe1b752abbb.patch";
hash = "sha256-0wacO6wuYJ4ufN9PGucRVJucFdFFNF+NoHYIrLXsCWs=";
})
];
});
runNuCheck = runNuCheck =
{ {
name, name,
@ -44,7 +53,7 @@ nixpkgs.lib.recursiveUpdate {
pkgs.deadnix pkgs.deadnix
pkgs.nixfmt-rfc-style pkgs.nixfmt-rfc-style
pkgs.shellcheck pkgs.shellcheck
pkgs.statix statix'
]; ];
check = ./lints.nu; check = ./lints.nu;

10
configuration/default.nix
View file

@ -1,7 +1,5 @@
{ {
config, config,
pkgs,
lib,
modulesPath, modulesPath,
flake-inputs, flake-inputs,
... ...
@ -32,13 +30,7 @@
./sops.nix ./sops.nix
]; ];
nixpkgs.overlays = [ nixpkgs.overlays = [ (_: prev: { local = import ../pkgs { pkgs = prev; }; }) ];
(final: prev: {
local = import ../pkgs {
pkgs = prev;
};
})
];
nix = { nix = {
extraOptions = '' extraOptions = ''

31
configuration/hardware-specific/vm.nix
View file

@ -6,26 +6,35 @@
boot.kernelParams = [ "nomodeset" ]; boot.kernelParams = [ "nomodeset" ];
networking.hostName = "testvm"; networking.hostName = "testvm";
services = {
# Sets the base domain for nginx to a local domain so that we can # Sets the base domain for nginx to a local domain so that we can
# easily test locally with the VM. # easily test locally with the VM.
services.nginx.domain = "dev.local"; nginx.domain = "dev.local";
# Don't run this
batteryManager.enable = lib.mkForce false;
openssh.hostKeys = lib.mkForce [
{
type = "rsa";
bits = 4096;
path = "/etc/staging.key";
}
];
};
# Use the staging secrets # Use the staging secrets
sops.defaultSopsFile = lib.mkOverride 99 ../../keys/staging.yaml; sops.defaultSopsFile = lib.mkOverride 99 ../../keys/staging.yaml;
systemd.network.networks."10-eth0" = { systemd.network.networks."10-eth0" = {
matchConfig.Name = "eth0"; matchConfig.Name = "eth0";
gateway = [ gateway = [ "192.168.9.1" ];
"192.168.9.1"
];
networkConfig = { networkConfig = {
Address = "192.168.9.2/24"; Address = "192.168.9.2/24";
}; };
}; };
# Don't run this
services.batteryManager.enable = lib.mkForce false;
# Both so we have a predictable key for the staging env, as well as # Both so we have a predictable key for the staging env, as well as
# to have a static key for decrypting the sops secrets for the # to have a static key for decrypting the sops secrets for the
# staging env. # staging env.
@ -34,14 +43,6 @@
source = ../../keys/hosts/staging.key; source = ../../keys/hosts/staging.key;
}; };
services.openssh.hostKeys = lib.mkForce [
{
type = "rsa";
bits = 4096;
path = "/etc/staging.key";
}
];
virtualisation.vmVariant = { virtualisation.vmVariant = {
virtualisation = { virtualisation = {
memorySize = 3941; memorySize = 3941;

20
configuration/nginx.nix
View file

@ -1,6 +1,7 @@
{ config, lib, ... }: { config, lib, ... }:
{ {
services.nginx = { services = {
nginx = {
enable = true; enable = true;
recommendedTlsSettings = true; recommendedTlsSettings = true;
recommendedOptimisation = true; recommendedOptimisation = true;
@ -19,7 +20,7 @@
''; '';
}; };
services.logrotate.settings = logrotate.settings =
{ {
# Override the default, just keep fewer logs # Override the default, just keep fewer logs
nginx.rotate = 6; nginx.rotate = 6;
@ -36,6 +37,14 @@
} }
) config.services.nginx.virtualHosts; ) config.services.nginx.virtualHosts;
backups.acme = {
user = "acme";
paths = lib.mapAttrsToList (
virtualHost: _: "/var/lib/acme/${virtualHost}"
) config.services.nginx.virtualHosts;
};
};
systemd.tmpfiles.rules = lib.mapAttrsToList ( systemd.tmpfiles.rules = lib.mapAttrsToList (
virtualHost: _: virtualHost: _:
# #
@ -66,11 +75,4 @@
systemd.services.nginx.serviceConfig.SupplementaryGroups = [ systemd.services.nginx.serviceConfig.SupplementaryGroups = [
config.security.acme.certs."tlater.net".group config.security.acme.certs."tlater.net".group
]; ];
services.backups.acme = {
user = "acme";
paths = lib.mapAttrsToList (
virtualHost: _: "/var/lib/acme/${virtualHost}"
) config.services.nginx.virtualHosts;
};
} }

4
configuration/services/backups.nix
View file

@ -57,7 +57,7 @@ in
''; '';
type = types.attrsOf ( type = types.attrsOf (
types.submodule ( types.submodule (
{ config, name, ... }: { name, ... }:
{ {
options = { options = {
user = lib.mkOption { user = lib.mkOption {
@ -246,7 +246,7 @@ in
}; };
} }
// lib.mapAttrs' ( // lib.mapAttrs' (
name: backup: name: _:
lib.nameValuePair "backup-${name}" { lib.nameValuePair "backup-${name}" {
wantedBy = [ "timers.target" ]; wantedBy = [ "timers.target" ];
timerConfig = { timerConfig = {

36
configuration/services/conduit/default.nix
View file

@ -18,7 +18,8 @@ in
./matrix-hookshot.nix ./matrix-hookshot.nix
]; ];
services.matrix-conduit = { services = {
matrix-conduit = {
enable = true; enable = true;
package = flake-inputs.continuwuity.packages.${pkgs.system}.default; package = flake-inputs.continuwuity.packages.${pkgs.system}.default;
settings.global = { settings.global = {
@ -48,20 +49,7 @@ in
}; };
}; };
systemd.services.conduit.serviceConfig = { coturn = {
ExecStart = lib.mkForce "${config.services.matrix-conduit.package}/bin/conduwuit";
# Pass in the TURN secret via EnvironmentFile, not supported by
# upstream module currently.
#
# See also https://gitlab.com/famedly/conduit/-/issues/314
EnvironmentFile = config.sops.secrets."turn/env".path;
};
systemd.services.coturn.serviceConfig.SupplementaryGroups = [
config.security.acme.certs."tlater.net".group
];
services.coturn = {
enable = true; enable = true;
no-cli = true; no-cli = true;
use-auth-secret = true; use-auth-secret = true;
@ -117,7 +105,7 @@ in
''; '';
}; };
services.nginx.virtualHosts."${domain}" = { nginx.virtualHosts."${domain}" = {
useACMEHost = "tlater.net"; useACMEHost = "tlater.net";
listen = [ listen = [
@ -171,11 +159,25 @@ in
}; };
}; };
services.backups.conduit = { backups.conduit = {
user = "root"; user = "root";
paths = [ "/var/lib/private/matrix-conduit/" ]; paths = [ "/var/lib/private/matrix-conduit/" ];
# Other services store their data in conduit, so no other services # Other services store their data in conduit, so no other services
# need to be shut down currently. # need to be shut down currently.
pauseServices = [ "conduit.service" ]; pauseServices = [ "conduit.service" ];
}; };
};
systemd.services.conduit.serviceConfig = {
ExecStart = lib.mkForce "${config.services.matrix-conduit.package}/bin/conduwuit";
# Pass in the TURN secret via EnvironmentFile, not supported by
# upstream module currently.
#
# See also https://gitlab.com/famedly/conduit/-/issues/314
EnvironmentFile = config.sops.secrets."turn/env".path;
};
systemd.services.coturn.serviceConfig.SupplementaryGroups = [
config.security.acme.certs."tlater.net".group
];
} }

12
configuration/services/conduit/matrix-hookshot.nix
View file

@ -74,9 +74,7 @@ in
services.matrix-hookshot = { services.matrix-hookshot = {
enable = true; enable = true;
serviceDependencies = [ serviceDependencies = [ "conduit.service" ];
"conduit.service"
];
registrationFile = "/run/matrix-hookshot/registration.yaml"; registrationFile = "/run/matrix-hookshot/registration.yaml";
@ -126,15 +124,11 @@ in
listeners = [ listeners = [
{ {
port = 9000; port = 9000;
resources = [ resources = [ "webhooks" ];
"webhooks"
];
} }
{ {
port = 9001; port = 9001;
resources = [ resources = [ "metrics" ];
"metrics"
];
} }
]; ];

16
configuration/services/crowdsec.nix
View file

@ -8,9 +8,7 @@
security.crowdsec = { security.crowdsec = {
enable = true; enable = true;
parserWhitelist = [ parserWhitelist = [ "10.45.249.2" ];
"10.45.249.2"
];
extraGroups = [ extraGroups = [
"systemd-journal" "systemd-journal"
@ -21,25 +19,19 @@
{ {
source = "journalctl"; source = "journalctl";
labels.type = "syslog"; labels.type = "syslog";
journalctl_filter = [ journalctl_filter = [ "SYSLOG_IDENTIFIER=Nextcloud" ];
"SYSLOG_IDENTIFIER=Nextcloud"
];
} }
{ {
source = "journalctl"; source = "journalctl";
labels.type = "syslog"; labels.type = "syslog";
journalctl_filter = [ journalctl_filter = [ "SYSLOG_IDENTIFIER=sshd-session" ];
"SYSLOG_IDENTIFIER=sshd-session"
];
} }
{ {
labels.type = "nginx"; labels.type = "nginx";
filenames = filenames =
[ [ "/var/log/nginx/*.log" ]
"/var/log/nginx/*.log"
]
++ lib.mapAttrsToList ( ++ lib.mapAttrsToList (
vHost: _: "/var/log/nginx/${vHost}/access.log" vHost: _: "/var/log/nginx/${vHost}/access.log"
) config.services.nginx.virtualHosts; ) config.services.nginx.virtualHosts;

16
configuration/services/foundryvtt.nix
View file

@ -11,7 +11,8 @@ in
{ {
imports = [ flake-inputs.foundryvtt.nixosModules.foundryvtt ]; imports = [ flake-inputs.foundryvtt.nixosModules.foundryvtt ];
services.foundryvtt = { services = {
foundryvtt = {
enable = true; enable = true;
hostName = domain; hostName = domain;
minifyStaticFiles = true; minifyStaticFiles = true;
@ -20,11 +21,7 @@ in
package = flake-inputs.foundryvtt.packages.${pkgs.system}.foundryvtt_11; package = flake-inputs.foundryvtt.packages.${pkgs.system}.foundryvtt_11;
}; };
# Want to start it manually when I need it, not have it constantly nginx.virtualHosts."${domain}" =
# running
systemd.services.foundryvtt.wantedBy = lib.mkForce [ ];
services.nginx.virtualHosts."${domain}" =
let let
inherit (config.services.foundryvtt) port; inherit (config.services.foundryvtt) port;
in in
@ -39,9 +36,14 @@ in
}; };
}; };
services.backups.foundryvtt = { backups.foundryvtt = {
user = "foundryvtt"; user = "foundryvtt";
paths = [ config.services.foundryvtt.dataDir ]; paths = [ config.services.foundryvtt.dataDir ];
pauseServices = [ "foundryvtt.service" ]; pauseServices = [ "foundryvtt.service" ];
}; };
};
# Want to start it manually when I need it, not have it constantly
# running
systemd.services.foundryvtt.wantedBy = lib.mkForce [ ];
} }

24
configuration/services/gitea.nix
View file

@ -8,7 +8,8 @@ let
domain = "gitea.${config.services.nginx.domain}"; domain = "gitea.${config.services.nginx.domain}";
in in
{ {
services.forgejo = { services = {
forgejo = {
enable = true; enable = true;
database.type = "postgres"; database.type = "postgres";
@ -29,16 +30,8 @@ in
}; };
}; };
systemd.services.forgejo.serviceConfig.ExecStartPre =
let
replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
secretPath = config.sops.secrets."forgejo/metrics-token".path;
runConfig = "${config.services.forgejo.customDir}/conf/app.ini";
in
[ "+${replaceSecretBin} '#metricstoken#' '${secretPath}' '${runConfig}'" ];
# Set up SSL # Set up SSL
services.nginx.virtualHosts."${domain}" = nginx.virtualHosts."${domain}" =
let let
httpAddress = config.services.forgejo.settings.server.HTTP_ADDR; httpAddress = config.services.forgejo.settings.server.HTTP_ADDR;
httpPort = config.services.forgejo.settings.server.HTTP_PORT; httpPort = config.services.forgejo.settings.server.HTTP_PORT;
@ -59,7 +52,7 @@ in
}; };
}; };
services.backups.forgejo = { backups.forgejo = {
user = "forgejo"; user = "forgejo";
paths = [ paths = [
"/var/lib/forgejo/forgejo-db.sql" "/var/lib/forgejo/forgejo-db.sql"
@ -78,4 +71,13 @@ in
}; };
pauseServices = [ "forgejo.service" ]; pauseServices = [ "forgejo.service" ];
}; };
};
systemd.services.forgejo.serviceConfig.ExecStartPre =
let
replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
secretPath = config.sops.secrets."forgejo/metrics-token".path;
runConfig = "${config.services.forgejo.customDir}/conf/app.ini";
in
[ "+${replaceSecretBin} '#metricstoken#' '${secretPath}' '${runConfig}'" ];
} }

2
configuration/services/metrics/exporters.nix
View file

@ -74,7 +74,7 @@ in
listenAddress = "127.0.0.1"; listenAddress = "127.0.0.1";
group = "nginx"; group = "nginx";
settings.namespaces = lib.mapAttrsToList (name: virtualHost: { settings.namespaces = lib.mapAttrsToList (name: _: {
inherit name; inherit name;
metrics_override.prefix = "nginxlog"; metrics_override.prefix = "nginxlog";
namespace_label = "vhost"; namespace_label = "vhost";

60
configuration/services/metrics/options.nix
View file

@ -38,7 +38,7 @@ in
services.victoriametrics.scrapeConfigs = mkOption { services.victoriametrics.scrapeConfigs = mkOption {
type = types.attrsOf ( type = types.attrsOf (
types.submodule ( types.submodule (
{ name, self, ... }: { name, ... }:
{ {
options = { options = {
job_name = mkOption { job_name = mkOption {
@ -106,35 +106,37 @@ in
# module is an intractable mess # module is an intractable mess
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
after = [ "network.target" ]; after = [ "network.target" ];
serviceConfig.Restart = mkDefault "always"; serviceConfig = {
serviceConfig.PrivateTmp = mkDefault true; Restart = mkDefault "always";
serviceConfig.WorkingDirectory = mkDefault /tmp; PrivateTmp = mkDefault true;
serviceConfig.DynamicUser = mkDefault true; WorkingDirectory = mkDefault /tmp;
DynamicUser = mkDefault true;
# Hardening # Hardening
serviceConfig.CapabilityBoundingSet = mkDefault [ "" ]; CapabilityBoundingSet = mkDefault [ "" ];
serviceConfig.DeviceAllow = [ "" ]; DeviceAllow = [ "" ];
serviceConfig.LockPersonality = true; LockPersonality = true;
serviceConfig.MemoryDenyWriteExecute = true; MemoryDenyWriteExecute = true;
serviceConfig.NoNewPrivileges = true; NoNewPrivileges = true;
serviceConfig.PrivateDevices = mkDefault true; PrivateDevices = mkDefault true;
serviceConfig.ProtectClock = mkDefault true; ProtectClock = mkDefault true;
serviceConfig.ProtectControlGroups = true; ProtectControlGroups = true;
serviceConfig.ProtectHome = true; ProtectHome = true;
serviceConfig.ProtectHostname = true; ProtectHostname = true;
serviceConfig.ProtectKernelLogs = true; ProtectKernelLogs = true;
serviceConfig.ProtectKernelModules = true; ProtectKernelModules = true;
serviceConfig.ProtectKernelTunables = true; ProtectKernelTunables = true;
serviceConfig.ProtectSystem = mkDefault "strict"; ProtectSystem = mkDefault "strict";
serviceConfig.RemoveIPC = true; RemoveIPC = true;
serviceConfig.RestrictAddressFamilies = [ RestrictAddressFamilies = [
"AF_INET" "AF_INET"
"AF_INET6" "AF_INET6"
]; ];
serviceConfig.RestrictNamespaces = true; RestrictNamespaces = true;
serviceConfig.RestrictRealtime = true; RestrictRealtime = true;
serviceConfig.RestrictSUIDSGID = true; RestrictSUIDSGID = true;
serviceConfig.SystemCallArchitectures = "native"; SystemCallArchitectures = "native";
serviceConfig.UMask = "0077"; UMask = "0077";
};
} }
exporter.serviceOpts exporter.serviceOpts
] ]
@ -144,7 +146,7 @@ in
{ {
vmagent-scrape-exporters = vmagent-scrape-exporters =
let let
listenAddress = config.services.victoriametrics.listenAddress; inherit (config.services.victoriametrics) listenAddress;
vmAddr = (lib.optionalString (lib.hasPrefix ":" listenAddress) "127.0.0.1") + listenAddress; vmAddr = (lib.optionalString (lib.hasPrefix ":" listenAddress) "127.0.0.1") + listenAddress;
promscrape = yaml.generate "prometheus.yml" { promscrape = yaml.generate "prometheus.yml" {
scrape_configs = lib.mapAttrsToList ( scrape_configs = lib.mapAttrsToList (
@ -153,7 +155,7 @@ in
inherit (scrape) job_name; inherit (scrape) job_name;
static_configs = static_configs =
scrape.static_configs scrape.static_configs
++ lib.optional (scrape.targets != [ ]) { targets = scrape.targets; }; ++ lib.optional (scrape.targets != [ ]) { inherit (scrape) targets; };
} scrape.extraSettings } scrape.extraSettings
) config.services.victoriametrics.scrapeConfigs; ) config.services.victoriametrics.scrapeConfigs;
}; };
@ -212,7 +214,7 @@ in
services.victoriametrics.scrapeConfigs = services.victoriametrics.scrapeConfigs =
let let
allExporters = lib.mapAttrs (name: exporter: { inherit (exporter) listenAddress port; }) ( allExporters = lib.mapAttrs (_: exporter: { inherit (exporter) listenAddress port; }) (
(lib.filterAttrs ( (lib.filterAttrs (
name: exporter: name: exporter:
# A bunch of deprecated exporters that need to be ignored # A bunch of deprecated exporters that need to be ignored

6
configuration/services/metrics/victorialogs.nix
View file

@ -1,8 +1,4 @@
{ { config, lib, ... }:
config,
lib,
...
}:
let let
cfg = config.services.victorialogs; cfg = config.services.victorialogs;
in in

20
configuration/services/nextcloud.nix
View file

@ -9,18 +9,19 @@ let
hostName = "nextcloud.${config.services.nginx.domain}"; hostName = "nextcloud.${config.services.nginx.domain}";
in in
{ {
services.nextcloud = { services = {
nextcloud = {
inherit hostName; inherit hostName;
package = nextcloud; package = nextcloud;
phpPackage = lib.mkForce ( phpPackage = lib.mkForce (
pkgs.php.override { pkgs.php.override {
packageOverrides = final: prev: { packageOverrides = _: prev: {
extensions = prev.extensions // { extensions = prev.extensions // {
pgsql = prev.extensions.pgsql.overrideAttrs (old: { pgsql = prev.extensions.pgsql.overrideAttrs (_: {
configureFlags = [ "--with-pgsql=${lib.getDev config.services.postgresql.package}" ]; configureFlags = [ "--with-pgsql=${lib.getDev config.services.postgresql.package}" ];
}); });
pdo_pgsql = prev.extensions.pdo_pgsql.overrideAttrs (old: { pdo_pgsql = prev.extensions.pdo_pgsql.overrideAttrs (_: {
configureFlags = [ "--with-pdo-pgsql=${lib.getDev config.services.postgresql.package}" ]; configureFlags = [ "--with-pdo-pgsql=${lib.getDev config.services.postgresql.package}" ];
}); });
}; };
@ -60,17 +61,14 @@ in
}; };
}; };
# Ensure that this service doesn't start before postgres is ready
systemd.services.nextcloud-setup.after = [ "postgresql.service" ];
# Set up SSL # Set up SSL
services.nginx.virtualHosts."${hostName}" = { nginx.virtualHosts."${hostName}" = {
forceSSL = true; forceSSL = true;
useACMEHost = "tlater.net"; useACMEHost = "tlater.net";
# The upstream module already adds HSTS # The upstream module already adds HSTS
}; };
services.backups.nextcloud = { backups.nextcloud = {
user = "nextcloud"; user = "nextcloud";
paths = [ paths = [
"/var/lib/nextcloud/nextcloud-db.sql" "/var/lib/nextcloud/nextcloud-db.sql"
@ -98,4 +96,8 @@ in
''; '';
}; };
}; };
};
# Ensure that this service doesn't start before postgres is ready
systemd.services.nextcloud-setup.after = [ "postgresql.service" ];
} }

2
configuration/services/webserver.nix
View file

@ -1,6 +1,6 @@
{ config, ... }: { config, ... }:
let let
domain = config.services.nginx.domain; inherit (config.services.nginx) domain;
in in
{ {
services.tlaternet-webserver = { services.tlaternet-webserver = {

2
flake.nix
View file

@ -121,8 +121,6 @@
run-vm = { run-vm = {
type = "app"; type = "app";
program = program =
let
in
(pkgs.writeShellScript "" '' (pkgs.writeShellScript "" ''
${vm.config.system.build.vm.outPath}/bin/run-testvm-vm ${vm.config.system.build.vm.outPath}/bin/run-testvm-vm
'').outPath; '').outPath;

4
modules/crowdsec/default.nix
View file

@ -267,9 +267,7 @@ in
}; };
}; };
systemd.packages = [ systemd.packages = [ cfg.package ];
cfg.package
];
environment = { environment = {
systemPackages = [ systemPackages = [

11
modules/crowdsec/remediations/cs-firewall-bouncer.nix
View file

@ -6,10 +6,11 @@
... ...
}: }:
let let
inherit (flake-inputs.self.packages.${pkgs.system}) crowdsec-firewall-bouncer;
crowdsecCfg = config.security.crowdsec; crowdsecCfg = config.security.crowdsec;
cfg = crowdsecCfg.remediationComponents.firewallBouncer; cfg = crowdsecCfg.remediationComponents.firewallBouncer;
settingsFormat = pkgs.formats.yaml { }; settingsFormat = pkgs.formats.yaml { };
crowdsec-firewall-bouncer = flake-inputs.self.packages.${pkgs.system}.crowdsec-firewall-bouncer;
in in
{ {
options.security.crowdsec.remediationComponents.firewallBouncer = { options.security.crowdsec.remediationComponents.firewallBouncer = {
@ -31,9 +32,7 @@ in
security.crowdsec.remediationComponents.firewallBouncer.settings = { security.crowdsec.remediationComponents.firewallBouncer.settings = {
mode = lib.mkDefault "${if config.networking.nftables.enable then "nftables" else "iptables"}"; mode = lib.mkDefault "${if config.networking.nftables.enable then "nftables" else "iptables"}";
log_mode = "stdout"; log_mode = "stdout";
iptables_chains = [ iptables_chains = [ "nixos-fw" ];
"nixos-fw"
];
# Don't let users easily override this; unfortunately we need to # Don't let users easily override this; unfortunately we need to
# set up this key through substitution at runtime. # set up this key through substitution at runtime.
@ -78,9 +77,7 @@ in
requiredBy = [ "crowdsec.service" ]; requiredBy = [ "crowdsec.service" ];
path = path =
lib.optionals (cfg.settings.mode == "ipset" || cfg.settings.mode == "iptables") [ lib.optionals (cfg.settings.mode == "ipset" || cfg.settings.mode == "iptables") [ pkgs.ipset ]
pkgs.ipset
]
++ lib.optional (cfg.settings.mode == "iptables") pkgs.iptables ++ lib.optional (cfg.settings.mode == "iptables") pkgs.iptables
++ lib.optional (cfg.settings.mode == "nftables") pkgs.nftables; ++ lib.optional (cfg.settings.mode == "nftables") pkgs.nftables;
}; };

6
modules/crowdsec/remediations/default.nix
View file

@ -1,5 +1 @@
{ { imports = [ ./cs-firewall-bouncer.nix ]; }
imports = [
./cs-firewall-bouncer.nix
];
}

5
pkgs/crowdsec/hub.nix
View file

@ -1,4 +1 @@
{ { sources }: sources.crowdsec-hub.src
sources,
}:
sources.crowdsec-hub.src