configuration/services/crowdsec.nix

@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ pkgs, ... }:
 {
   security.crowdsec = {
     enable = true;
@@ -7,39 +7,21 @@
       "1.64.239.213"
     ];
 
-    extraGroups = [
+    settings.crowdsec_service.acquisition_path = pkgs.writeText "crowdsec-acquisitions.yaml" ''
-      "systemd-journal"
+      ---
-      "nginx"
+      source: journalctl
-    ];
+      journalctl_filter:
-
+        - "SYSLOG_IDENTIFIER=Nextcloud"
-    acquisitions = [
+      labels:
-      {
+        type: syslog
-        source = "journalctl";
+      ---
-        labels.type = "syslog";
+      source: journalctl
-        journalctl_filter = [
+      journalctl_filter:
-          "SYSLOG_IDENTIFIER=Nextcloud"
+        - "SYSLOG_IDENTIFIER=sshd-session"
-        ];
+      labels:
-      }
+        type: syslog
-
+      ---
-      {
+    '';
-        source = "journalctl";
-        labels.type = "syslog";
-        journalctl_filter = [
-          "SYSLOG_IDENTIFIER=sshd-session"
-        ];
-      }
-
-      {
-        labels.type = "nginx";
-        filenames =
-          [
-            "/var/log/nginx/*.log"
-          ]
-          ++ lib.mapAttrsToList (
-            vHost: _: "/var/log/nginx/${vHost}/access.log"
-          ) config.services.nginx.virtualHosts;
-      }
-    ];
 
     remediationComponents.firewallBouncer = {
       enable = true;

modules/crowdsec/default.nix

@@ -28,12 +28,6 @@ let
 
     $sudo ${crowdsec}/bin/cscli "$@"
   '';
-
-  acquisitions = ''
-    ---
-    ${lib.concatMapStringsSep "\n---\n" builtins.toJSON cfg.acquisitions}
-    ---
-  '';
 in
 {
   imports = [ ./remediations ];
@@ -88,24 +82,6 @@ in
         '';
       };
 
-      acquisitions = lib.mkOption {
-        type = listOf settingsFormat.type;
-        default = [ ];
-        description = ''
-          Log acquisitions.
-        '';
-      };
-
-      extraGroups = lib.mkOption {
-        type = listOf str;
-        default = [ ];
-        description = ''
-          Additional groups to make the service part of.
-
-          Required to permit reading from various log sources.
-        '';
-      };
-
       hubConfigurations = {
         collections = lib.mkOption {
           type = listOf str;
@@ -214,13 +190,7 @@ in
           plugin_dir = lib.mkDefault "/var/empty/";
         };
 
-        crowdsec_service.acquisition_path =
+        crowdsec_service.acquisition_path = lib.mkDefault "${cfg.package}/share/crowdsec/config/acquis.yaml";
-          # Using an if/else here because `mkMerge` does not work in
-          # YAML-type options
-          if cfg.acquisitions == [ ] then
-            "${cfg.package}/share/crowdsec/config/acquis.yaml"
-          else
-            pkgs.writeText "acquis.yaml" acquisitions;
 
         cscli = {
           prometheus_uri = lib.mkDefault "127.0.0.1:6060";
@@ -369,7 +339,7 @@ in
           serviceConfig = {
             User = "crowdsec";
             Group = "crowdsec";
-            SupplementaryGroups = cfg.extraGroups;
+            SupplementaryGroups = [ "systemd-journal" ];
 
             StateDirectory = "crowdsec";
           };