tbarnouin/nixos-hypervisor
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Working postgresql crowdsec config

Browse source
This commit is contained in:
Théo Barnouin 2025-04-14 15:14:53 +02:00
parent 0638a5d2e6
commit 473aba8072
3 changed files with 97 additions and 59 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
secrets.nix
View file

@ -29,6 +29,7 @@ in {
"services/postgresql/secrets/authentikDBPass.age".publicKeys = [tbarnouin postgresql]; "services/postgresql/secrets/authentikDBPass.age".publicKeys = [tbarnouin postgresql];
"services/postgresql/secrets/grafanaDBPass.age".publicKeys = [tbarnouin postgresql]; "services/postgresql/secrets/grafanaDBPass.age".publicKeys = [tbarnouin postgresql];
"services/postgresql/secrets/onlyofficeDBPass.age".publicKeys = [tbarnouin postgresql]; "services/postgresql/secrets/onlyofficeDBPass.age".publicKeys = [tbarnouin postgresql];
"secrets/postgresql-lapi-key.age".publicKeys = [tbarnouin postgresql];
"services/nginx/secrets/cs-lapi-key.age".publicKeys = [tbarnouin nginx]; "services/nginx/secrets/cs-lapi-key.age".publicKeys = [tbarnouin nginx];
"services/minimalConfig/secrets/cs-lapi-key.age".publicKeys = users ++ systems; "services/minimalConfig/secrets/cs-lapi-key.age".publicKeys = users ++ systems;

13
secrets/postgresql-lapi-key.age Normal file
View file

@ -0,0 +1,13 @@
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBabEhV
SnYvWTR6NkE1U2xUM3huNzZ3bUdXRVh0MTJoUjhTY2taNmY2MFdvCnpmNTMzMWM0
enhiMHQyWEpCYmxXZ3I3aStXYlh6UStrbFMvTTJwYjNOY2cKLT4gc3NoLWVkMjU1
MTkgc2luZ3ZRIHRHY0dNbUt0aTJQdzNGTGRXeC9jbVVoVmN2WFpRaHZIU0Qvb0c3
eUdhMXcKSi9NZEtjRENLNXFuVUVLdUlYbkNlT0EzeUVOSzJYcXlZcVRDaWFqMXVi
WQotPiBVb0wtZ3JlYXNlIGYrIEosIHpFRHBvbzI5ICljS0UKTmljdnFHQzBRTWxu
ZXpEdkhheHE5WVVJVVpXdzFaZC9HQ28KLS0tIDdmc3dNNGVYcC91QmQrcmhGaHhZ
WkNEa3FOcHZIU3loQmVDd29hd2ZqSXMKksjTw4Gh1PDeQpRnX5cg6uSv3hRRPL50
4xKqLKC7kmEoSU3PXSrNYV5yppD4V+LTnj/WRXgoBD9A89ul9PLvbmJpcxzB5SVS
+gAi73lGkRFhFrYv5eCzsIWgCfVhQZ/LeyN9ak56/OisJm0YOKntWPEN/NKjVi1x
AvFJ2jF+4bSy+BaDK0qTecHbnVfS8uW4lBr3FE7Tfj83TpI=
-----END AGE ENCRYPTED FILE-----

26
services/postgresql/default.nix
View file

@ -11,6 +11,10 @@ in {
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
age.secrets = { age.secrets = {
postgresql-lapi-key = {
file = ../../secrets/postgresql-lapi-key.age;
owner = "crowdsec";
};
nextcloudDBPass = { nextcloudDBPass = {
file = ./secrets/nextcloudDBPass.age; file = ./secrets/nextcloudDBPass.age;
owner = "postgres"; owner = "postgres";
@ -32,7 +36,26 @@ in {
owner = "postgres"; owner = "postgres";
}; };
}; };
services.postgresql = { services = {
crowdsec = {
hub.collections = [
"crowdsecurity/pgsql"
];
settings.lapi.credentialsFile = "${config.age.secrets.postgresql-lapi-key.path}";
localConfig = {
acquisitions = [
{
filenames = [
"/var/log/postgresql/*.log"
];
labels = {
type = "syslog";
};
}
];
};
};
postgresql = {
enable = true; enable = true;
package = pkgs.postgresql_16; package = pkgs.postgresql_16;
enableTCPIP = true; enableTCPIP = true;
@ -98,4 +121,5 @@ in {
''; '';
networking.firewall.allowedTCPPorts = [5432]; networking.firewall.allowedTCPPorts = [5432];
}; };
};
} }