tlaternet/tlaternet-server
1
0
Fork 0
Code Issues11 Pull requests Releases Activity

Compare commits

..

5 commits
f927dc50ae ... 16c36c410a

Author SHA1 Message Date
Tristan Daniël Maat 16c36c410a
WIP: feat: Add minecraft server 2025-02-08 03:45:02 +08:00
Tristan Daniël Maat 31b2527e40
feat(conduit): Refactor appservices and add matrix-hookshot 2025-02-08 03:45:02 +08:00
Tristan Daniël Maat 3c7e1f106b
fix(vm): Make sops not break if running without battery manager 2025-02-08 03:38:45 +08:00
Tristan Daniël Maat e9a9a5bc26
bump(flake.lock): Update sonnenshift input 2025-02-07 02:47:34 +08:00
Tristan Daniël Maat f5b1acda4f
feat(crowdsec): Switch to whitelisting wireguard IP 
My IP address is not static, and grafana seems to comfortably produce
enough traffic to get me IP banned.
 2025-02-07 01:40:45 +08:00
2 changed files with 2 additions and 41 deletions
configuration/services
conduit
matrix-hookshot.nix
crowdsec.nix

4
configuration/services/conduit/matrix-hookshot.nix
View file

@ -16,7 +16,7 @@ let
registration = matrixLib.writeRegistrationScript {
id = "matrix-hookshot";
url = "http://${address}:${toString port}";
url = "${address}:${toString port}";
sender_localpart = "hookshot";
namespaces = {
@ -91,8 +91,6 @@ in
bindAddress = "127.0.0.1";
};
bot.displayname = "Hookshot";
generic = {
enabled = true;
outbound = false;

39
configuration/services/crowdsec.nix
View file

@ -1,9 +1,4 @@
{
pkgs,
config,
lib,
...
}:
{ config, lib, ... }:
{
security.crowdsec = {
enable = true;
@ -55,36 +50,4 @@
};
};
};
# Add whitelists for matrix
systemd.tmpfiles.settings."10-matrix" =
let
stateDir = config.security.crowdsec.stateDirectory;
in
{
"${stateDir}/config/postoverflows".d = {
user = "crowdsec";
group = "crowdsec";
mode = "0700";
};
"${stateDir}/config/postoverflows/s01-whitelist".d = {
user = "crowdsec";
group = "crowdsec";
mode = "0700";
};
"${stateDir}/config/postoverflows/s01-whitelist/matrix-whitelist.yaml"."L+".argument =
((pkgs.formats.yaml { }).generate "crowdsec-matrix-whitelist.yaml" {
name = "tetsumaki/matrix";
description = "custom matrix whitelist";
whitelist = {
reason = "whitelist false positive for matrix";
expression = [
"evt.Overflow.Alert.Events[0].GetMeta('target_fqdn') == '${config.services.matrix-conduit.settings.global.server_name}'"
"evt.Overflow.Alert.GetScenario() in ['crowdsecurity/http-probing', 'crowdsecurity/http-crawl-non_statics']"
];
};
}).outPath;
};
}