feat: Add crowdsec to replace fail2ban

modules/crowdsec/default.nix

@@ -335,36 +335,6 @@ in
             SupplementaryGroups = [ "systemd-journal" ];
 
             StateDirectory = "crowdsec";
-
-            # PrivateTmp = true;
-            # PrivateUsers = true;
-            # ProtectHome = true;
-            # CapabilityBoundingSet = [ ];
-            # LockPersonality = true;
-            # PrivateDevices = true;
-            # ProtectHostname = true;
-            # ProtectKernelTunables = true;
-            # ProtectKernelModules = true;
-            # ProtectControlGroups = true;
-
-            # NoNewPrivileges = true;
-            # RestrictSUIDSGID = true;
-
-            # ProtectProc = "invisible";
-            # ProcSubset = "pid"; # Needed for journal access
-
-            # RestrictNamespaces = true;
-            # RestrictRealtime = true;
-
-            # SystemCallFilter = [
-            #   "@system-service"
-            #   "@network-io"
-            # ];
-            # SystemCallArchitectures = [ "native" ];
-            # SystemCallErrorNumber = "EPERM";
-
-            # ExecPaths = [ "/nix/store" ];
-            # NoExecPaths = [ "/" ];
           };
         };
       };