tlaternet/tlaternet-server
1
0
Fork 0
Code Issues11 Pull requests Releases Activity

Compare commits

..

6 commits
16c36c410a ... f927dc50ae

Author SHA1 Message Date
Tristan Daniël Maat f927dc50ae
WIP: feat: Add minecraft server 2025-02-08 05:29:59 +08:00
Tristan Daniël Maat c0e71abd53
feat(conduit): Refactor appservices and add matrix-hookshot 2025-02-08 05:29:58 +08:00
Tristan Daniël Maat 08ff591117
fix(vm): Make sops not break if running without battery manager 2025-02-08 05:29:57 +08:00
Tristan Daniël Maat 9f5b6014ef
bump(flake.lock): Update sonnenshift input 2025-02-08 05:29:56 +08:00
Tristan Daniël Maat e11b6f810b
feat(crowdsec): Switch to whitelisting wireguard IP 
My IP address is not static, and grafana seems to comfortably produce
enough traffic to get me IP banned.
 2025-02-08 05:29:56 +08:00
Tristan Daniël Maat e1989a6009
fix(crowdsec): Filter out events against matrix 2025-02-08 05:29:55 +08:00
2 changed files with 41 additions and 2 deletions
configuration/services
conduit
matrix-hookshot.nix
crowdsec.nix

4
configuration/services/conduit/matrix-hookshot.nix
View file

@ -16,7 +16,7 @@ let
registration = matrixLib.writeRegistrationScript {
id = "matrix-hookshot";
url = "${address}:${toString port}";
url = "http://${address}:${toString port}";
sender_localpart = "hookshot";
namespaces = {
@ -91,6 +91,8 @@ in
bindAddress = "127.0.0.1";
};
bot.displayname = "Hookshot";
generic = {
enabled = true;
outbound = false;

39
configuration/services/crowdsec.nix
View file

@ -1,4 +1,9 @@
{ config, lib, ... }:
{
pkgs,
config,
lib,
...
}:
{
security.crowdsec = {
enable = true;
@ -50,4 +55,36 @@
};
};
};
# Add whitelists for matrix
systemd.tmpfiles.settings."10-matrix" =
let
stateDir = config.security.crowdsec.stateDirectory;
in
{
"${stateDir}/config/postoverflows".d = {
user = "crowdsec";
group = "crowdsec";
mode = "0700";
};
"${stateDir}/config/postoverflows/s01-whitelist".d = {
user = "crowdsec";
group = "crowdsec";
mode = "0700";
};
"${stateDir}/config/postoverflows/s01-whitelist/matrix-whitelist.yaml"."L+".argument =
((pkgs.formats.yaml { }).generate "crowdsec-matrix-whitelist.yaml" {
name = "tetsumaki/matrix";
description = "custom matrix whitelist";
whitelist = {
reason = "whitelist false positive for matrix";
expression = [
"evt.Overflow.Alert.Events[0].GetMeta('target_fqdn') == '${config.services.matrix-conduit.settings.global.server_name}'"
"evt.Overflow.Alert.GetScenario() in ['crowdsecurity/http-probing', 'crowdsecurity/http-crawl-non_statics']"
];
};
}).outPath;
};
}