104 lines
2.8 KiB
Nix
104 lines
2.8 KiB
Nix
{ config, lib, ... }:
|
|
{
|
|
services = {
|
|
crowdsec = {
|
|
enable = true;
|
|
autoUpdateService = true;
|
|
|
|
settings = {
|
|
general.api.server = {
|
|
enable = true;
|
|
online_client.sharing = false;
|
|
};
|
|
|
|
lapi.credentialsFile = "/var/lib/crowdsec/state/local_credentials.yaml";
|
|
};
|
|
|
|
hub = {
|
|
collections = [
|
|
"crowdsecurity/base-http-scenarios"
|
|
"crowdsecurity/http-cve"
|
|
"crowdsecurity/linux"
|
|
"crowdsecurity/nextcloud"
|
|
"crowdsecurity/nginx"
|
|
"crowdsecurity/sshd"
|
|
];
|
|
};
|
|
|
|
localConfig = {
|
|
acquisitions = [
|
|
{
|
|
labels.type = "syslog";
|
|
journalctl_filter = [
|
|
"SYSLOG_IDENTIFIER=Nextcloud"
|
|
"SYSLOG_IDENTIFIER=sshd-session"
|
|
];
|
|
source = "journalctl";
|
|
}
|
|
|
|
{
|
|
labels.type = "nginx";
|
|
filenames = [
|
|
"/var/log/nginx/*.log"
|
|
]
|
|
++ lib.mapAttrsToList (
|
|
vHost: _: "/var/log/nginx/${vHost}/access.log"
|
|
) config.services.nginx.virtualHosts;
|
|
}
|
|
];
|
|
|
|
parsers.s02Enrich = [
|
|
{
|
|
name = "nixos/parser-whitelist";
|
|
description = "Parser whitelist generated by the crowdsec NixOS module";
|
|
whitelist = {
|
|
reason = "Filtered by NixOS whitelist";
|
|
ip = [ "10.45.249.2" ];
|
|
};
|
|
}
|
|
];
|
|
|
|
postOverflows.s01Whitelist = [
|
|
{
|
|
description = "custom matrix whitelist";
|
|
name = "tetsumaki/matrix";
|
|
whitelist = {
|
|
reason = "whitelist false positive for matrix";
|
|
expression = [
|
|
"evt.Overflow.Alert.Events[0].GetMeta('target_fqdn') == '${config.services.matrix-conduit.settings.global.server_name}'"
|
|
"evt.Overflow.Alert.GetScenario() in ['crowdsecurity/http-probing', 'crowdsecurity/http-crawl-non_statics']"
|
|
];
|
|
};
|
|
}
|
|
];
|
|
};
|
|
};
|
|
|
|
crowdsec-firewall-bouncer = {
|
|
enable = true;
|
|
settings.prometheus = {
|
|
enabled = true;
|
|
listen_addr = "127.0.0.1";
|
|
listen_port = "60601";
|
|
};
|
|
};
|
|
|
|
victoriametrics.scrapeConfigs = {
|
|
crowdsec.targets =
|
|
let
|
|
cfg = config.services.crowdsec.settings.general;
|
|
address = cfg.prometheus.listen_addr;
|
|
port = cfg.prometheus.listen_port;
|
|
in
|
|
[ "${address}:${toString port}" ];
|
|
|
|
csFirewallBouncer.targets =
|
|
let
|
|
cfg = config.services.crowdsec-firewall-bouncer.settings;
|
|
address = cfg.prometheus.listen_addr;
|
|
port = cfg.prometheus.listen_port;
|
|
in
|
|
[ "${address}:${toString port}" ];
|
|
};
|
|
};
|
|
}
|