Compare commits
4 commits
73c06e6ec8
...
6e2b796c0d
| Author | SHA1 | Date | |
|---|---|---|---|
6e2b796c0d
|
|||
|
b90af26085
|
|||
|
09198a416c
|
|||
|
11b4da04d8
|
20 changed files with 369 additions and 264 deletions
configuration
flake.lockflake.nixkeys
modules
pkgs
|
|
@ -18,10 +18,11 @@
|
||||||
./services/backups.nix
|
./services/backups.nix
|
||||||
./services/battery-manager.nix
|
./services/battery-manager.nix
|
||||||
./services/conduit.nix
|
./services/conduit.nix
|
||||||
./services/fail2ban.nix
|
./services/crowdsec.nix
|
||||||
./services/foundryvtt.nix
|
./services/foundryvtt.nix
|
||||||
./services/gitea.nix
|
./services/gitea.nix
|
||||||
./services/metrics
|
./services/metrics
|
||||||
|
./services/minecraft.nix
|
||||||
./services/nextcloud.nix
|
./services/nextcloud.nix
|
||||||
./services/webserver.nix
|
./services/webserver.nix
|
||||||
./services/wireguard.nix
|
./services/wireguard.nix
|
||||||
|
|
@ -70,8 +71,6 @@
|
||||||
8448
|
8448
|
||||||
# starbound
|
# starbound
|
||||||
21025
|
21025
|
||||||
# Minecraft
|
|
||||||
25565
|
|
||||||
|
|
||||||
config.services.coturn.listening-port
|
config.services.coturn.listening-port
|
||||||
config.services.coturn.tls-listening-port
|
config.services.coturn.tls-listening-port
|
||||||
|
|
@ -80,9 +79,6 @@
|
||||||
];
|
];
|
||||||
|
|
||||||
allowedUDPPorts = [
|
allowedUDPPorts = [
|
||||||
# More minecraft
|
|
||||||
25565
|
|
||||||
|
|
||||||
config.services.coturn.listening-port
|
config.services.coturn.listening-port
|
||||||
config.services.coturn.tls-listening-port
|
config.services.coturn.tls-listening-port
|
||||||
config.services.coturn.alt-listening-port
|
config.services.coturn.alt-listening-port
|
||||||
|
|
|
||||||
26
configuration/services/crowdsec.nix
Normal file
26
configuration/services/crowdsec.nix
Normal file
|
|
@ -0,0 +1,26 @@
|
||||||
|
{ pkgs, config, ... }:
|
||||||
|
{
|
||||||
|
services.crowdsec = {
|
||||||
|
enable = true;
|
||||||
|
# clientCredentials = config.sops.secrets."crowdsec/credentials".path;
|
||||||
|
|
||||||
|
settings.crowdsec_service.acquisition_path =
|
||||||
|
(pkgs.formats.yaml { }).generate "crowdsec-acquisitions.yaml"
|
||||||
|
{
|
||||||
|
source = "journalctl";
|
||||||
|
journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
|
||||||
|
labels.type = "syslog";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
# db_config = {
|
||||||
|
# type = "postgresql";
|
||||||
|
# db_path = "/run/postgresql";
|
||||||
|
# user = "crowdsec";
|
||||||
|
# db_name = "crowdsec";
|
||||||
|
# flush = {
|
||||||
|
# max_items = 10000;
|
||||||
|
# max_age = "14d";
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
|
@ -1,43 +0,0 @@
|
||||||
{ pkgs, ... }:
|
|
||||||
{
|
|
||||||
services.fail2ban = {
|
|
||||||
enable = true;
|
|
||||||
extraPackages = [ pkgs.ipset ];
|
|
||||||
banaction = "iptables-ipset-proto6-allports";
|
|
||||||
bantime-increment.enable = true;
|
|
||||||
|
|
||||||
jails = {
|
|
||||||
nginx-botsearch = ''
|
|
||||||
enabled = true
|
|
||||||
logpath = /var/log/nginx/access.log
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
ignoreIP = [
|
|
||||||
"127.0.0.0/8"
|
|
||||||
"10.0.0.0/8"
|
|
||||||
"172.16.0.0/12"
|
|
||||||
"192.168.0.0/16"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
# Allow metrics services to connect to the socket as well
|
|
||||||
users.groups.fail2ban = { };
|
|
||||||
systemd.services.fail2ban.serviceConfig = {
|
|
||||||
ExecStartPost =
|
|
||||||
"+"
|
|
||||||
+ (pkgs.writeShellScript "fail2ban-post-start" ''
|
|
||||||
while ! [ -S /var/run/fail2ban/fail2ban.sock ]; do
|
|
||||||
sleep 1
|
|
||||||
done
|
|
||||||
|
|
||||||
while ! ${pkgs.netcat}/bin/nc -zU /var/run/fail2ban/fail2ban.sock; do
|
|
||||||
sleep 1
|
|
||||||
done
|
|
||||||
|
|
||||||
${pkgs.coreutils}/bin/chown root:fail2ban /var/run/fail2ban /var/run/fail2ban/fail2ban.sock
|
|
||||||
${pkgs.coreutils}/bin/chmod 660 /var/run/fail2ban/fail2ban.sock
|
|
||||||
${pkgs.coreutils}/bin/chmod 710 /var/run/fail2ban
|
|
||||||
'');
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -59,24 +59,6 @@ in
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
# Block repeated failed login attempts
|
|
||||||
#
|
|
||||||
# TODO(tlater): Update this - we switched to forgejo, who knows what
|
|
||||||
# the new matches are.
|
|
||||||
# environment.etc = {
|
|
||||||
# "fail2ban/filter.d/gitea.conf".text = ''
|
|
||||||
# [Definition]
|
|
||||||
# failregex = .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>
|
|
||||||
# journalmatch = _SYSTEMD_UNIT=forgejo.service + _COMM=forgejo + SYSLOG_IDENTIFIER=forgejo
|
|
||||||
# '';
|
|
||||||
# };
|
|
||||||
|
|
||||||
# services.fail2ban.jails = {
|
|
||||||
# gitea = ''
|
|
||||||
# enabled = true
|
|
||||||
# '';
|
|
||||||
# };
|
|
||||||
|
|
||||||
services.backups.forgejo = {
|
services.backups.forgejo = {
|
||||||
user = "forgejo";
|
user = "forgejo";
|
||||||
paths = [
|
paths = [
|
||||||
|
|
|
||||||
|
|
@ -68,34 +68,6 @@ in
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
extraExporters = {
|
|
||||||
fail2ban =
|
|
||||||
let
|
|
||||||
cfg = config.services.prometheus.extraExporters.fail2ban;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
port = 9191;
|
|
||||||
serviceOpts = {
|
|
||||||
after = [ "fail2ban.service" ];
|
|
||||||
requires = [ "fail2ban.service" ];
|
|
||||||
serviceConfig = {
|
|
||||||
Group = "fail2ban";
|
|
||||||
RestrictAddressFamilies = [
|
|
||||||
"AF_UNIX"
|
|
||||||
"AF_INET"
|
|
||||||
"AF_INET6"
|
|
||||||
];
|
|
||||||
ExecStart = lib.concatStringsSep " " [
|
|
||||||
"${pkgs.local.prometheus-fail2ban-exporter}/bin/fail2ban-prometheus-exporter"
|
|
||||||
"--collector.f2b.socket=/var/run/fail2ban/fail2ban.sock"
|
|
||||||
"--web.listen-address='${cfg.listenAddress}:${toString cfg.port}'"
|
|
||||||
"--collector.f2b.exit-on-socket-connection-error=true"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# TODO(tlater):
|
# TODO(tlater):
|
||||||
# - wireguard (?)
|
# - wireguard (?)
|
||||||
# - postgres (?)
|
# - postgres (?)
|
||||||
|
|
|
||||||
|
|
@ -12,6 +12,7 @@ in
|
||||||
options = {
|
options = {
|
||||||
services.prometheus = {
|
services.prometheus = {
|
||||||
extraExporters = mkOption {
|
extraExporters = mkOption {
|
||||||
|
default = { };
|
||||||
type = types.attrsOf (
|
type = types.attrsOf (
|
||||||
types.submodule {
|
types.submodule {
|
||||||
options = {
|
options = {
|
||||||
|
|
|
||||||
|
|
@ -10,6 +10,7 @@
|
||||||
extraSettings.authorization.credentials_file = config.sops.secrets."forgejo/metrics-token".path;
|
extraSettings.authorization.credentials_file = config.sops.secrets."forgejo/metrics-token".path;
|
||||||
};
|
};
|
||||||
coturn.targets = [ "127.0.0.1:9641" ];
|
coturn.targets = [ "127.0.0.1:9641" ];
|
||||||
|
crowdsec.targets = [ "127.0.0.1:6060" ];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
83
configuration/services/minecraft.nix
Normal file
83
configuration/services/minecraft.nix
Normal file
|
|
@ -0,0 +1,83 @@
|
||||||
|
{
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
config,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
{
|
||||||
|
services.minecraft-server = {
|
||||||
|
enable = true;
|
||||||
|
eula = true;
|
||||||
|
# jvmOpts are set using a file for forge
|
||||||
|
# jvmOpts = "-Xmx8G -Xms8G";
|
||||||
|
openFirewall = true;
|
||||||
|
|
||||||
|
declarative = true;
|
||||||
|
|
||||||
|
whitelist = {
|
||||||
|
tlater = "140d177a-966f-41b8-a4c0-e305babd291b";
|
||||||
|
romino25 = "59cd1648-14a4-4bcf-8f5a-2e1bde678f2c";
|
||||||
|
lasi25 = "0ab6e3d1-544a-47e7-8538-2e6c248e49a4";
|
||||||
|
};
|
||||||
|
|
||||||
|
serverProperties = {
|
||||||
|
allow-flight = true;
|
||||||
|
difficulty = "hard";
|
||||||
|
motd = "tlater.net";
|
||||||
|
spawn-protection = 1;
|
||||||
|
white-list = true;
|
||||||
|
enable-query = true;
|
||||||
|
enable-status = true;
|
||||||
|
|
||||||
|
# Allows the server to write chunks without hogging the main
|
||||||
|
# thread...
|
||||||
|
sync-chunk-writes = false;
|
||||||
|
# Disables chat reporting, because we don't need any of that
|
||||||
|
# drama on a lil' friends-only server.
|
||||||
|
enforce-secure-profile = false;
|
||||||
|
};
|
||||||
|
|
||||||
|
package = pkgs.writeShellApplication {
|
||||||
|
name = "minecraft-server";
|
||||||
|
runtimeInputs = with pkgs; [ jdk17_headless ];
|
||||||
|
|
||||||
|
text = ''
|
||||||
|
exec /var/lib/minecraft/run.sh $@
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.minecraft-server = {
|
||||||
|
path = with pkgs; [ jdk17_headless ];
|
||||||
|
|
||||||
|
# Since we read from our own HTTP server, we need to wait for it
|
||||||
|
# to be up
|
||||||
|
after = [ "nginx.service" ];
|
||||||
|
|
||||||
|
serviceConfig = {
|
||||||
|
# Use packwiz to install mods
|
||||||
|
ExecStartPre = [
|
||||||
|
"${pkgs.jdk17_headless}/bin/java -jar ${config.services.minecraft-server.dataDir}/packwiz-installer-bootstrap.jar -g -s server 'https://minecraft.${config.services.nginx.domain}/cobblemon-pack/pack.toml'"
|
||||||
|
];
|
||||||
|
# Forge requires some bonus JVM options, which they include in a
|
||||||
|
# little `run.sh` script
|
||||||
|
ExecStart = lib.mkForce "${config.services.minecraft-server.dataDir}/run.sh --nogui";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.tmpfiles.settings."10-minecraft" = {
|
||||||
|
"/srv/minecraft".d = {
|
||||||
|
user = "nginx";
|
||||||
|
group = "minecraft";
|
||||||
|
mode = "0775";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."minecraft.${config.services.nginx.domain}" = {
|
||||||
|
forceSSL = true;
|
||||||
|
useACMEHost = "tlater.net";
|
||||||
|
enableHSTS = true;
|
||||||
|
|
||||||
|
root = "/srv/minecraft";
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -70,29 +70,6 @@ in
|
||||||
# The upstream module already adds HSTS
|
# The upstream module already adds HSTS
|
||||||
};
|
};
|
||||||
|
|
||||||
# Block repeated failed login attempts
|
|
||||||
environment.etc = {
|
|
||||||
"fail2ban/filter.d/nextcloud.conf".text = ''
|
|
||||||
[Definition]
|
|
||||||
_groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)
|
|
||||||
failregex = \{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
|
|
||||||
\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
|
|
||||||
datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"
|
|
||||||
journalmatch = SYSLOG_IDENTIFIER=Nextcloud
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
services.fail2ban.jails = {
|
|
||||||
nextcloud = ''
|
|
||||||
enabled = true
|
|
||||||
|
|
||||||
# Nextcloud does some throttling already, so we need to set
|
|
||||||
# these to something bigger.
|
|
||||||
findtime = 43200
|
|
||||||
bantime = 86400
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
services.backups.nextcloud = {
|
services.backups.nextcloud = {
|
||||||
user = "nextcloud";
|
user = "nextcloud";
|
||||||
paths = [
|
paths = [
|
||||||
|
|
|
||||||
|
|
@ -13,6 +13,11 @@
|
||||||
group = "battery-manager";
|
group = "battery-manager";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
"crowdsec/credentials" = {
|
||||||
|
owner = "crowdsec";
|
||||||
|
group = "crowdsec";
|
||||||
|
};
|
||||||
|
|
||||||
# Gitea
|
# Gitea
|
||||||
"forgejo/metrics-token" = {
|
"forgejo/metrics-token" = {
|
||||||
owner = "forgejo";
|
owner = "forgejo";
|
||||||
|
|
|
||||||
78
flake.lock
generated
78
flake.lock
generated
|
|
@ -114,44 +114,10 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"flake-compat_3": {
|
|
||||||
"flake": false,
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1696426674,
|
|
||||||
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
|
|
||||||
"owner": "edolstra",
|
|
||||||
"repo": "flake-compat",
|
|
||||||
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "edolstra",
|
|
||||||
"repo": "flake-compat",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"flake-utils": {
|
"flake-utils": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"systems": "systems_2"
|
"systems": "systems_2"
|
||||||
},
|
},
|
||||||
"locked": {
|
|
||||||
"lastModified": 1731533236,
|
|
||||||
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
|
|
||||||
"owner": "numtide",
|
|
||||||
"repo": "flake-utils",
|
|
||||||
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "numtide",
|
|
||||||
"repo": "flake-utils",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"flake-utils_2": {
|
|
||||||
"inputs": {
|
|
||||||
"systems": "systems_3"
|
|
||||||
},
|
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1726560853,
|
"lastModified": 1726560853,
|
||||||
"narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
|
"narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
|
||||||
|
|
@ -272,37 +238,15 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nvfetcher": {
|
|
||||||
"inputs": {
|
|
||||||
"flake-compat": "flake-compat_2",
|
|
||||||
"flake-utils": "flake-utils",
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1732501185,
|
|
||||||
"narHash": "sha256-Z0BpHelaGQsE5VD9hBsBHsvMU9h+Xt0kfkDJyFivZOU=",
|
|
||||||
"owner": "berberman",
|
|
||||||
"repo": "nvfetcher",
|
|
||||||
"rev": "bdb14eab6fe9cefc29efe01e60c3a3f616d6b62a",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "berberman",
|
|
||||||
"repo": "nvfetcher",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"poetry2nixi": {
|
"poetry2nixi": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-utils": "flake-utils_2",
|
"flake-utils": "flake-utils",
|
||||||
"nix-github-actions": "nix-github-actions",
|
"nix-github-actions": "nix-github-actions",
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"sonnenshift",
|
"sonnenshift",
|
||||||
"nixpkgs"
|
"nixpkgs"
|
||||||
],
|
],
|
||||||
"systems": "systems_4",
|
"systems": "systems_3",
|
||||||
"treefmt-nix": "treefmt-nix"
|
"treefmt-nix": "treefmt-nix"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
|
|
@ -321,7 +265,7 @@
|
||||||
},
|
},
|
||||||
"purescript-overlay": {
|
"purescript-overlay": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-compat": "flake-compat_3",
|
"flake-compat": "flake-compat_2",
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"tlaternet-webserver",
|
"tlaternet-webserver",
|
||||||
"dream2nix",
|
"dream2nix",
|
||||||
|
|
@ -367,7 +311,6 @@
|
||||||
"foundryvtt": "foundryvtt",
|
"foundryvtt": "foundryvtt",
|
||||||
"nixpkgs": "nixpkgs_2",
|
"nixpkgs": "nixpkgs_2",
|
||||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||||
"nvfetcher": "nvfetcher",
|
|
||||||
"sonnenshift": "sonnenshift",
|
"sonnenshift": "sonnenshift",
|
||||||
"sops-nix": "sops-nix",
|
"sops-nix": "sops-nix",
|
||||||
"tlaternet-webserver": "tlaternet-webserver"
|
"tlaternet-webserver": "tlaternet-webserver"
|
||||||
|
|
@ -485,21 +428,6 @@
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"systems_3": {
|
"systems_3": {
|
||||||
"locked": {
|
|
||||||
"lastModified": 1681028828,
|
|
||||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
|
||||||
"owner": "nix-systems",
|
|
||||||
"repo": "default",
|
|
||||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "nix-systems",
|
|
||||||
"repo": "default",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"systems_4": {
|
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1681028828,
|
"lastModified": 1681028828,
|
||||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||||
|
|
|
||||||
17
flake.nix
17
flake.nix
|
|
@ -13,10 +13,6 @@
|
||||||
url = "github:Mic92/sops-nix";
|
url = "github:Mic92/sops-nix";
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
nvfetcher = {
|
|
||||||
url = "github:berberman/nvfetcher";
|
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
};
|
|
||||||
tlaternet-webserver = {
|
tlaternet-webserver = {
|
||||||
url = "git+https://gitea.tlater.net/tlaternet/tlaternet.git";
|
url = "git+https://gitea.tlater.net/tlaternet/tlaternet.git";
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
@ -37,7 +33,6 @@
|
||||||
self,
|
self,
|
||||||
nixpkgs,
|
nixpkgs,
|
||||||
sops-nix,
|
sops-nix,
|
||||||
nvfetcher,
|
|
||||||
deploy-rs,
|
deploy-rs,
|
||||||
...
|
...
|
||||||
}@inputs:
|
}@inputs:
|
||||||
|
|
@ -120,18 +115,6 @@
|
||||||
${vm.config.system.build.vm.outPath}/bin/run-testvm-vm
|
${vm.config.system.build.vm.outPath}/bin/run-testvm-vm
|
||||||
'').outPath;
|
'').outPath;
|
||||||
};
|
};
|
||||||
|
|
||||||
update-pkgs = {
|
|
||||||
type = "app";
|
|
||||||
program =
|
|
||||||
let
|
|
||||||
nvfetcher-bin = "${nvfetcher.packages.${system}.default}/bin/nvfetcher";
|
|
||||||
in
|
|
||||||
(pkgs.writeShellScript "update-pkgs" ''
|
|
||||||
cd "$(git rev-parse --show-toplevel)/pkgs"
|
|
||||||
${nvfetcher-bin} -o _sources_pkgs -c nvfetcher.toml
|
|
||||||
'').outPath;
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
|
||||||
###########################
|
###########################
|
||||||
|
|
|
||||||
|
|
@ -2,6 +2,8 @@ hetzner-api: ENC[AES256_GCM,data:1Zjp003j60g=,iv:+vDcyiqYm4A9CMIrW4oGZKdZiczatBc
|
||||||
battery-manager:
|
battery-manager:
|
||||||
email: ENC[AES256_GCM,data:LM/EGzWHfVQ=,iv:jFaoUQuUfuGoOyj/GFpdI8TerH/c8D9fjvio+IEt2Tc=,tag:IWLiN011JEnHRLIXWQgfmA==,type:str]
|
email: ENC[AES256_GCM,data:LM/EGzWHfVQ=,iv:jFaoUQuUfuGoOyj/GFpdI8TerH/c8D9fjvio+IEt2Tc=,tag:IWLiN011JEnHRLIXWQgfmA==,type:str]
|
||||||
password: ENC[AES256_GCM,data:SUxjqS7SJHM=,iv:LvdKk88S+nSImh6/ZezbFGLCUBu1Lpdu+neF2xyHdBg=,tag:rcMyZuW4FVNbcbz00wQKBg==,type:str]
|
password: ENC[AES256_GCM,data:SUxjqS7SJHM=,iv:LvdKk88S+nSImh6/ZezbFGLCUBu1Lpdu+neF2xyHdBg=,tag:rcMyZuW4FVNbcbz00wQKBg==,type:str]
|
||||||
|
crowdsec:
|
||||||
|
credentials: ENC[AES256_GCM,data:jJ+tRa3696odtbI=,iv:M3bhbrqa2XxNkt97Vih/zUaX3J2F71tbSXm/ARo5wQ8=,tag:DlFJJ4qZq4tc80ArUmcCOA==,type:str]
|
||||||
forgejo:
|
forgejo:
|
||||||
metrics-token: ENC[AES256_GCM,data:HEDV/GK/WtI=,iv:ihPEusEGVUNZjjjxz2ys6Nfag/og4n7Cqmd4rroT6Ww=,tag:Brcv7XW6HfzzgF3emtuT2A==,type:str]
|
metrics-token: ENC[AES256_GCM,data:HEDV/GK/WtI=,iv:ihPEusEGVUNZjjjxz2ys6Nfag/og4n7Cqmd4rroT6Ww=,tag:Brcv7XW6HfzzgF3emtuT2A==,type:str]
|
||||||
grafana:
|
grafana:
|
||||||
|
|
@ -32,8 +34,8 @@ sops:
|
||||||
azure_kv: []
|
azure_kv: []
|
||||||
hc_vault: []
|
hc_vault: []
|
||||||
age: []
|
age: []
|
||||||
lastmodified: "2024-04-15T23:13:27Z"
|
lastmodified: "2025-01-23T17:19:30Z"
|
||||||
mac: ENC[AES256_GCM,data:JhEVrKF2Jsqpdztcr3g5lMrgEFeLXfBRQTwQJ6PmLSNyDORcTU09TJPNWTPDnR5okDrvIU/wlzi5DZ8A0ebNhrKf6l0tNFBT9LSvQFHU5SBxqY/m8uEJKSrEC4IL5lugOOISDka2KSvYXVCXrumMHE5FnmOS/CgOZaZk6LUjPYA=,iv:ygygnSedcTo2Vsc56s2qrz1qkWchvSgvoiMTebRxQQ8=,tag:vf6z8rxsXmqzwpDy9Avifw==,type:str]
|
mac: ENC[AES256_GCM,data:eWItAwXJ3JTf3RgzFo8oh0REeCeeZvLWZn8jsIpdRMsA+pRXTu8d+Eh5YCkUA13P/rNbn28EP7hEwEIU7RQSoTuyO2gNytoROkOttO/m0ehwSX6b5Kvwjw81KpQ6GBXst5BEaCkPznv5iBLuYLnngM3QE3GauTdUI63yVWSomUI=,iv:/0SuOpE01hr8CXbRvcRrClLzfid1WJoIyZ/qilV6UrM=,tag:/HDq+n8ahiMCUIwpTHT/kA==,type:str]
|
||||||
pgp:
|
pgp:
|
||||||
- created_at: "2025-01-21T17:55:30Z"
|
- created_at: "2025-01-21T17:55:30Z"
|
||||||
enc: |-
|
enc: |-
|
||||||
|
|
@ -71,4 +73,4 @@ sops:
|
||||||
-----END PGP MESSAGE-----
|
-----END PGP MESSAGE-----
|
||||||
fp: 2f5caa73e7ceea4fcc8d2881fde587e6737d2dbc
|
fp: 2f5caa73e7ceea4fcc8d2881fde587e6737d2dbc
|
||||||
unencrypted_suffix: _unencrypted
|
unencrypted_suffix: _unencrypted
|
||||||
version: 3.8.1
|
version: 3.9.2
|
||||||
|
|
|
||||||
237
modules/crowdsec.nix
Normal file
237
modules/crowdsec.nix
Normal file
|
|
@ -0,0 +1,237 @@
|
||||||
|
{
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
config,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
let
|
||||||
|
cfg = config.services.crowdsec;
|
||||||
|
settingsFormat = pkgs.formats.yaml { };
|
||||||
|
|
||||||
|
# TODO(tlater): Upstream properly installing the service file
|
||||||
|
crowdsec = pkgs.symlinkJoin {
|
||||||
|
name = "crowdsec-with-unit";
|
||||||
|
paths = [
|
||||||
|
pkgs.crowdsec
|
||||||
|
(pkgs.runCommandLocal "crowdsec.service" { } ''
|
||||||
|
mkdir -p $out/lib/systemd/system/
|
||||||
|
|
||||||
|
substitute ${pkgs.crowdsec}/share/crowdsec/config/crowdsec.service $out/lib/systemd/system/crowdsec.service \
|
||||||
|
--replace-fail /usr/local ${pkgs.crowdsec}
|
||||||
|
'')
|
||||||
|
];
|
||||||
|
};
|
||||||
|
in
|
||||||
|
{
|
||||||
|
options.services.crowdsec =
|
||||||
|
let
|
||||||
|
inherit (lib.types) nullOr package path;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
enable = lib.mkEnableOption "crowdsec";
|
||||||
|
|
||||||
|
package = lib.mkOption {
|
||||||
|
type = package;
|
||||||
|
default = crowdsec;
|
||||||
|
};
|
||||||
|
|
||||||
|
stateDirectory = lib.mkOption {
|
||||||
|
type = path;
|
||||||
|
readOnly = true;
|
||||||
|
|
||||||
|
description = ''
|
||||||
|
The state directory of the crowdsec instance. Cannot be
|
||||||
|
changed, but is exposed for downstream use.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
settings = lib.mkOption {
|
||||||
|
inherit (settingsFormat) type;
|
||||||
|
default = { };
|
||||||
|
|
||||||
|
description = ''
|
||||||
|
The crowdsec configuration. Refer to
|
||||||
|
<https://docs.crowdsec.net/docs/next/configuration/crowdsec_configuration/>
|
||||||
|
for details on supported values.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
# clientCredentials = lib.mkOption {
|
||||||
|
# type = path;
|
||||||
|
|
||||||
|
# description = ''
|
||||||
|
# The API client credentials to configure; Required to access
|
||||||
|
# the service at all.
|
||||||
|
# '';
|
||||||
|
# };
|
||||||
|
|
||||||
|
centralApiCredentials = lib.mkOption {
|
||||||
|
type = nullOr path;
|
||||||
|
default = null;
|
||||||
|
|
||||||
|
description = ''
|
||||||
|
The API key to access crowdsec's central API - this is
|
||||||
|
required to access any of the shared blocklists.
|
||||||
|
|
||||||
|
Use of this feature is optional, entering no API key (the
|
||||||
|
default) turns all sharing or receiving of blocked IPs off.
|
||||||
|
|
||||||
|
Note that adding the API key by itself does not enable
|
||||||
|
sharing of blocked IPs with the central API. This limits the
|
||||||
|
types of blocklists this instance can access.
|
||||||
|
|
||||||
|
To also turn sharing blocked IPs on, set
|
||||||
|
`api.server.online_client.sharing = true;`.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
ctiApiKey = lib.mkOption {
|
||||||
|
type = nullOr path;
|
||||||
|
default = null;
|
||||||
|
|
||||||
|
description = ''
|
||||||
|
The API key for crowdsec's CTI offering.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = lib.mkIf cfg.enable {
|
||||||
|
# Set up default settings; anything that *shouldn't* be changed is
|
||||||
|
# set to the default priority so that users need to use
|
||||||
|
# `lib.mkForce`.
|
||||||
|
services.crowdsec = {
|
||||||
|
stateDirectory = "/var/lib/crowdsec";
|
||||||
|
|
||||||
|
settings = {
|
||||||
|
common = {
|
||||||
|
# Default config daemonizes, but the service is set to
|
||||||
|
# `notify`; presumably the daemonization isn't really intended
|
||||||
|
daemonize = false;
|
||||||
|
# The default logs to files, which isn't the preferred way
|
||||||
|
# on NixOS
|
||||||
|
log_media = "stdout";
|
||||||
|
};
|
||||||
|
|
||||||
|
config_paths = {
|
||||||
|
config_dir = "/etc/crowdsec/";
|
||||||
|
data_dir = "${cfg.stateDirectory}/data/";
|
||||||
|
# This "config" file is intended to be written to using the
|
||||||
|
# cscli tool, so you can temporarily make it so rules don't
|
||||||
|
# do anything but log what they *would* do for
|
||||||
|
# experimentation.
|
||||||
|
simulation_path = "${cfg.stateDirectory}/config/simulation.yaml";
|
||||||
|
|
||||||
|
pattern_dir = "${cfg.package}/share/crowdsec/config/patterns";
|
||||||
|
|
||||||
|
# We don't want to actually download anything; Any rules
|
||||||
|
# will be properly packaged.
|
||||||
|
hub_dir = lib.mkDefault "/var/empty/";
|
||||||
|
index_path = lib.mkDefault "/var/empty/.index.json";
|
||||||
|
|
||||||
|
# Integrations aren't supported for now
|
||||||
|
notification_dir = lib.mkDefault "/var/empty/";
|
||||||
|
plugin_dir = lib.mkDefault "/var/empty/";
|
||||||
|
};
|
||||||
|
|
||||||
|
crowdsec_service.acquisition_path = lib.mkDefault "${cfg.package}/share/crowdsec/config/acquis.yaml";
|
||||||
|
|
||||||
|
cscli = {
|
||||||
|
prometheus_uri = lib.mkDefault "127.0.0.1:6060";
|
||||||
|
};
|
||||||
|
|
||||||
|
api = {
|
||||||
|
cti = {
|
||||||
|
enabled = cfg.ctiApiKey != null;
|
||||||
|
key = cfg.ctiApiKey;
|
||||||
|
};
|
||||||
|
# client.credentials_path = cfg.clientCredentials;
|
||||||
|
client.credentials_path = "${cfg.stateDirectory}/local_credentials.yaml";
|
||||||
|
server = {
|
||||||
|
listen_uri = lib.mkDefault "127.0.0.1:8080";
|
||||||
|
profiles_path = lib.mkDefault "${cfg.package}/share/crowdsec/config/profiles.yaml";
|
||||||
|
console_path = lib.mkDefault "${cfg.package}/share/crowdsec/config/console.yaml";
|
||||||
|
|
||||||
|
online_client = {
|
||||||
|
# By default, we don't let crowdsec phone home, since
|
||||||
|
# this is usually within NixOS users' concerns.
|
||||||
|
#
|
||||||
|
# TODO: Enable when this option becomes available
|
||||||
|
# (1.6.4, current nixpkgs-unstable)
|
||||||
|
# sharing = lib.mkDefault false;
|
||||||
|
credentials_path = cfg.centralApiCredentials;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# We enable prometheus by default, since cscli relies on it
|
||||||
|
# for metrics
|
||||||
|
prometheus = {
|
||||||
|
enabled = lib.mkDefault true;
|
||||||
|
level = lib.mkDefault "full";
|
||||||
|
listen_addr = lib.mkDefault "127.0.0.1";
|
||||||
|
listen_port = lib.mkDefault 6060;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.packages = [
|
||||||
|
cfg.package
|
||||||
|
];
|
||||||
|
|
||||||
|
environment.etc."crowdsec/config.yaml".source =
|
||||||
|
settingsFormat.generate "crowdsec-settings.yaml" cfg.settings;
|
||||||
|
|
||||||
|
# Note that the service basics are already defined upstream
|
||||||
|
systemd.services.crowdsec.serviceConfig = {
|
||||||
|
|
||||||
|
# TODO: ExecStartPre to make `/var/lib/crowdsec/config`
|
||||||
|
|
||||||
|
User = "crowdsec";
|
||||||
|
Group = "crowdsec";
|
||||||
|
SupplementaryGroups = [ "systemd-journal" ];
|
||||||
|
|
||||||
|
StateDirectory = "crowdsec";
|
||||||
|
|
||||||
|
PrivateTmp = true;
|
||||||
|
PrivateUsers = true;
|
||||||
|
ProtectHome = true;
|
||||||
|
CapabilityBoundingSet = [ ];
|
||||||
|
LockPersonality = true;
|
||||||
|
PrivateDevices = true;
|
||||||
|
ProtectHostname = true;
|
||||||
|
ProtectKernelTunables = true;
|
||||||
|
ProtectKernelModules = true;
|
||||||
|
ProtectControlGroups = true;
|
||||||
|
|
||||||
|
NoNewPrivileges = true;
|
||||||
|
RestrictSUIDSGID = true;
|
||||||
|
|
||||||
|
ProtectProc = "invisible";
|
||||||
|
ProcSubset = "pid"; # Needed for journal access
|
||||||
|
|
||||||
|
RestrictNamespaces = true;
|
||||||
|
RestrictRealtime = true;
|
||||||
|
|
||||||
|
SystemCallFilter = [
|
||||||
|
"@system-service"
|
||||||
|
"@network-io"
|
||||||
|
];
|
||||||
|
SystemCallArchitectures = [ "native" ];
|
||||||
|
SystemCallErrorNumber = "EPERM";
|
||||||
|
|
||||||
|
ExecPaths = [ "/nix/store" ];
|
||||||
|
NoExecPaths = [ "/" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
users = {
|
||||||
|
users.crowdsec = {
|
||||||
|
isSystemUser = true;
|
||||||
|
home = cfg.stateDirectory;
|
||||||
|
group = "crowdsec";
|
||||||
|
};
|
||||||
|
groups = {
|
||||||
|
crowdsec = { };
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -1 +1,6 @@
|
||||||
{ imports = [ ./nginxExtensions.nix ]; }
|
{
|
||||||
|
imports = [
|
||||||
|
./crowdsec.nix
|
||||||
|
./nginxExtensions.nix
|
||||||
|
];
|
||||||
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,22 +0,0 @@
|
||||||
{
|
|
||||||
"prometheus-fail2ban-exporter": {
|
|
||||||
"cargoLocks": null,
|
|
||||||
"date": null,
|
|
||||||
"extract": null,
|
|
||||||
"name": "prometheus-fail2ban-exporter",
|
|
||||||
"passthru": null,
|
|
||||||
"pinned": false,
|
|
||||||
"src": {
|
|
||||||
"deepClone": false,
|
|
||||||
"fetchSubmodules": false,
|
|
||||||
"leaveDotGit": false,
|
|
||||||
"name": null,
|
|
||||||
"rev": "v0.10.1",
|
|
||||||
"sha256": "sha256-zGEhDy3uXIbvx4agSA8Mx7bRtiZZtoDZGbNbHc9L+yI=",
|
|
||||||
"sparseCheckout": [],
|
|
||||||
"type": "git",
|
|
||||||
"url": "https://gitlab.com/hectorjsmith/fail2ban-prometheus-exporter"
|
|
||||||
},
|
|
||||||
"version": "v0.10.1"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
@ -1,17 +0,0 @@
|
||||||
# This file was generated by nvfetcher, please do not modify it manually.
|
|
||||||
{ fetchgit, fetchurl, fetchFromGitHub, dockerTools }:
|
|
||||||
{
|
|
||||||
prometheus-fail2ban-exporter = {
|
|
||||||
pname = "prometheus-fail2ban-exporter";
|
|
||||||
version = "v0.10.1";
|
|
||||||
src = fetchgit {
|
|
||||||
url = "https://gitlab.com/hectorjsmith/fail2ban-prometheus-exporter";
|
|
||||||
rev = "v0.10.1";
|
|
||||||
fetchSubmodules = false;
|
|
||||||
deepClone = false;
|
|
||||||
leaveDotGit = false;
|
|
||||||
sparseCheckout = [ ];
|
|
||||||
sha256 = "sha256-zGEhDy3uXIbvx4agSA8Mx7bRtiZZtoDZGbNbHc9L+yI=";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -4,7 +4,4 @@ let
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
starbound = callPackage ./starbound { };
|
starbound = callPackage ./starbound { };
|
||||||
prometheus-fail2ban-exporter = callPackage ./prometheus/fail2ban-exporter.nix {
|
|
||||||
sources = pkgs.callPackage ./_sources_pkgs/generated.nix { };
|
|
||||||
};
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,3 +0,0 @@
|
||||||
[prometheus-fail2ban-exporter]
|
|
||||||
src.manual = "v0.10.1" # No gitlab support in nvfetcher
|
|
||||||
fetch.git = "https://gitlab.com/hectorjsmith/fail2ban-prometheus-exporter"
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
{ buildGoModule, sources }:
|
|
||||||
buildGoModule {
|
|
||||||
inherit (sources.prometheus-fail2ban-exporter) pname src version;
|
|
||||||
vendorHash = "sha256-5o8p5p0U/c0WAIV5dACnWA3ThzSh2tt5LIFMb59i9GY=";
|
|
||||||
}
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue