WIP: fix(crowdsec): Make the whitelists actually work

modules/crowdsec/default.nix

@@ -31,6 +31,22 @@ let
     ${lib.concatMapStringsSep "\n---\n" builtins.toJSON cfg.acquisitions}
     ---
   '';
+
+  extraConfigs = pkgs.symlinkJoin {
+    name = "crowdsec-extra-configs";
+    paths = lib.mapAttrsToList (
+      path: settings:
+      (settingsFormat.generate path settings).overrideAttrs (old: {
+        patchPhase = ''
+          mkdir -p "$out/${dirOf path}/"
+          out="$out/${dirOf path}/"
+
+          echo $out
+          exit 1
+        '';
+      })
+    ) cfg.extraConfig;
+  };
 in
 {
   imports = [ ./remediations ];
@@ -38,6 +54,7 @@ in
   options.security.crowdsec =
     let
       inherit (lib.types)
+        attrsOf
         nullOr
         listOf
         package
@@ -85,6 +102,16 @@ in
         '';
       };
 
+      extraConfig = lib.mkOption {
+        type = attrsOf (settingsFormat.type);
+        default = {
+          "parsers/s02-enrich/nixos-whitelist.yaml" = cfg.parserWhitelist;
+        };
+        description = ''
+          Set of additional configurations to install.
+        '';
+      };
+
       acquisitions = lib.mkOption {
         type = listOf settingsFormat.type;
         default = [ ];
@@ -300,33 +327,6 @@ in
           group = "crowdsec";
           mode = "0700";
         };
-
-        "${cfg.stateDirectory}/config/parsers".d = lib.mkIf (cfg.parserWhitelist != [ ]) {
-          user = "crowdsec";
-          group = "crowdsec";
-          mode = "0700";
-        };
-
-        "${cfg.stateDirectory}/config/parsers/s02-enrich".d = lib.mkIf (cfg.parserWhitelist != [ ]) {
-          user = "crowdsec";
-          group = "crowdsec";
-          mode = "0700";
-        };
-
-        "${cfg.stateDirectory}/config/parsers/s02-enrich/nixos-whitelist.yaml" =
-          lib.mkIf (cfg.parserWhitelist != [ ])
-            {
-              "L+".argument =
-                (settingsFormat.generate "crowdsec-nixos-whitelist.yaml" {
-                  name = "nixos/parser-whitelist";
-                  description = "Parser whitelist generated by the crowdsec NixOS module";
-                  whitelist = {
-                    reason = "Filtered by NixOS whitelist";
-                    ip = lib.lists.filter (ip: !(lib.hasInfix "/" ip)) cfg.parserWhitelist;
-                    cidr = lib.lists.filter (ip: lib.hasInfix "/" ip) cfg.parserWhitelist;
-                  };
-                }).outPath;
-            };
       };
 
       services = {
@@ -336,6 +336,8 @@ in
           description = "Crowdsec database and config preparation";
 
           script = ''
+            cp --copy-contents --recursive ${extraConfigs}/. ${cfg.stateDirectory}/config
+
             if [ ! -e '${cfg.settings.config_paths.simulation_path}' ]; then
                 cp '${cfg.package}/share/crowdsec/config/simulation.yaml' '${cfg.settings.config_paths.simulation_path}'
             fi