Try to implement crowdsec everywhere, connected to central lapi

services/minimalConfig/default.nix

@@ -91,6 +91,13 @@
     ];
   };
 
+  age.secrets = {
+    cs-lapi-key = {
+      file = ./secrets/cs-lapi-key.age;
+      owner = "crowdsec";
+    };
+  };
+
   services = {
     openssh = {
       enable = true;
@@ -107,6 +114,21 @@
     fail2ban = {
       enable = true;
     };
+    crowdsec = {
+      enable = true;
+      package = pkgs.crowdsec;
+      autoUpdateService = false;
+      openFirewall = true;
+      settings = {
+        general = {
+          prometheus.listen_addr = "0.0.0.0";
+        };
+        lapi.credentialsFile = "${config.age.secrets.cs-lapi-key.path}";
+      };
+      hub.collections = [
+        "crowdsecurity/linux"
+      ];
+    };
     rsyslogd = {
       enable = true;
       extraConfig = "*.*@192.168.1.27:514;RSYSLOG_SyslogProtocol23Format";