infrastructure

commit 2f5cb731b0737d6d2ee653d3dc0b478a06d34112
parent 6ad34e7c248a3dcbc1b5dfa91dbef71d1aa409da
Author: Silas Brack <silasbrack@gmail.com>
Date:   Fri,  3 Apr 2026 16:28:00 +0200

fix: remove crowdsec

Diffstat:
M
nixos/configuration-debian-2gb-hel1-1.nix
 | 
50
++++++++++++++++----------------------------------

1 file changed, 16 insertions(+), 34 deletions(-)
diff --git a/nixos/configuration-debian-2gb-hel1-1.nix b/nixos/configuration-debian-2gb-hel1-1.nix
@@ -128,40 +128,6 @@
     limit_req_status 429;
   '';
 
-  # CrowdSec intrusion detection/prevention
-  services.crowdsec = {
-    enable = true;
-    autoUpdateService = true;
-    hub.collections = [
-      "crowdsecurity/linux"
-      "crowdsecurity/nginx"
-      "crowdsecurity/sshd"
-    ];
-    localConfig.acquisitions = [
-      {
-        source = "journalctl";
-        journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
-        labels.type = "syslog";
-      }
-      {
-        filenames = [ "/var/log/nginx/access.log" ];
-        labels.type = "nginx";
-      }
-    ];
-  };
-
-  # CrowdSec firewall bouncer - blocks malicious IPs
-  services.crowdsec-firewall-bouncer = {
-    enable = true;
-    registerBouncer = {
-      enable = true;
-      bouncerName = "firewall-bouncer";
-    };
-  };
-
-  # Grant crowdsec access to nginx logs
-  users.users.crowdsec.extraGroups = [ "nginx" ];
-
   # MediaWiki
   services.mediawiki = {
     enable = true;
@@ -339,4 +305,20 @@
     3000
     8081
   ];
+
+  # Gitea runner SSH known hosts setup
+  systemd.services.gitea-runner-known-hosts = {
+    description = "Populate Gitea runner SSH known_hosts";
+    wantedBy = [ "multi-user.target" ];
+    before = [ "gitea-runner-default.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      mkdir -p /var/lib/gitea-runner/default/.ssh
+      ${pkgs.openssh}/bin/ssh-keyscan -H 46.62.150.48 >> /var/lib/gitea-runner/default/.ssh/known_hosts 2>/dev/null || true
+      chmod 644 /var/lib/gitea-runner/default/.ssh/known_hosts
+    '';
+  };
 }