{ pkgs, ... }:
{
  services.crowdsec = {
    enable = true;

    parserWhitelist = [
      "1.64.239.213"
    ];

    settings.crowdsec_service.acquisition_path = pkgs.writeText "crowdsec-acquisitions.yaml" ''
      ---
      source: journalctl
      journalctl_filter:
        - "SYSLOG_IDENTIFIER=Nextcloud"
      labels:
        type: syslog
      ---
      source: journalctl
      journalctl_filter:
        - "SYSLOG_IDENTIFIER=sshd-service"
      labels:
        type: syslog
      ---
    '';
  };
}