infrastructure

commit 0482b64399060159a9f8ad732c89c51cfa38d395
parent 88807d442c21ad6c56e36b844df155cdcf472082
Author: Silas Brack <silasbrack@gmail.com>
Date:   Fri,  3 Apr 2026 13:01:46 +0200

feat: add CrowdSec

Diffstat:
M
nixos/configuration-debian-2gb-hel1-1.nix
 | 
34
++++++++++++++++++++++++++++++++++

1 file changed, 34 insertions(+), 0 deletions(-)
diff --git a/nixos/configuration-debian-2gb-hel1-1.nix b/nixos/configuration-debian-2gb-hel1-1.nix
@@ -128,6 +128,40 @@
     limit_req_status 429;
   '';
 
+  # CrowdSec intrusion detection/prevention
+  services.crowdsec = {
+    enable = true;
+    autoUpdateService = true;
+    hub.collections = [
+      "crowdsecurity/linux"
+      "crowdsecurity/nginx"
+      "crowdsecurity/sshd"
+    ];
+    localConfig.acquisitions = [
+      {
+        source = "journalctl";
+        journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
+        labels.type = "syslog";
+      }
+      {
+        filenames = [ "/var/log/nginx/access.log" ];
+        labels.type = "nginx";
+      }
+    ];
+  };
+
+  # CrowdSec firewall bouncer - blocks malicious IPs
+  services.crowdsec-firewall-bouncer = {
+    enable = true;
+    registerBouncer = {
+      enable = true;
+      bouncerName = "firewall-bouncer";
+    };
+  };
+
+  # Grant crowdsec access to nginx logs
+  users.users.crowdsec.extraGroups = [ "nginx" ];
+
   # MediaWiki
   services.mediawiki = {
     enable = true;