Try to implement crowdsec everywhere, connected to central lapi

services/grafana/default.nix

@@ -33,7 +33,24 @@ in {
       };
       kuma-token.file = ./secrets/kuma-token.age;
     };
-    services.rsyslogd = {
+    services = {
+      crowdsec = {
+        hub.collections = [
+          "LePresidente/grafana"
+        ];
+        localConfig = {
+          acquisitions = [
+            {
+              source = "journalctl";
+              journalctl_filter = [ "_SYSTEMD_UNIT=grafana.service" ];
+              labels = {
+                type = "syslog";
+              };
+            }
+          ];
+        };
+      };
+      rsyslogd = {
         enable = true;
         extraConfig = ''
           ruleset(name="remote"){
@@ -47,10 +64,10 @@ in {
           input(type="imtcp" port="514" ruleset="remote")
         '';
       };
-    services.influxdb2 = {
+      influxdb2 = {
         enable = true;
       };
-    services.grafana = {
+      grafana = {
         enable = true;
         settings = {
           server = {
@@ -83,7 +100,7 @@ in {
           };
         };
       };
-    services.prometheus = {
+      prometheus = {
         enable = true;
         port = 9001;
         scrapeConfigs = [
@@ -171,6 +188,14 @@ in {
               }
             ];
           }
+          {
+            job_name = "crowdsec_nextcloud";
+            static_configs = [
+              {
+                targets = ["192.168.1.45:6060"];
+              }
+            ];
+          }
           {
             job_name = "jellyfin";
             static_configs = [
@@ -179,9 +204,17 @@ in {
               }
             ];
           }
+          {
+            job_name = "crowdsec_jellyfin";
+            static_configs = [
+              {
+                targets = ["192.168.1.42:6060"];
+              }
+            ];
+          }
         ];
       };
-    services.loki = {
+      loki = {
         enable = true;
         configuration = {
           server.http_listen_port = 3100;
@@ -248,7 +281,7 @@ in {
           };
         };
       };
-    services.promtail = {
+      promtail = {
         enable = true;
         configuration = {
           server = {
@@ -304,6 +337,7 @@ in {
           ];
         };
       };
+    };
 
     # Open ports in the firewall.
     networking.firewall.allowedTCPPorts = [3000 3100 3101 8086 9001 1514 514];

services/minimalConfig/default.nix

@@ -91,6 +91,13 @@
     ];
   };
 
+  age.secrets = {
+    cs-lapi-key = {
+      file = ./secrets/cs-lapi-key.age;
+      owner = "crowdsec";
+    };
+  };
+
   services = {
     openssh = {
       enable = true;
@@ -107,6 +114,21 @@
     fail2ban = {
       enable = true;
     };
+    crowdsec = {
+      enable = true;
+      package = pkgs.crowdsec;
+      autoUpdateService = false;
+      openFirewall = true;
+      settings = {
+        general = {
+          prometheus.listen_addr = "0.0.0.0";
+        };
+        lapi.credentialsFile = "${config.age.secrets.cs-lapi-key.path}";
+      };
+      hub.collections = [
+        "crowdsecurity/linux"
+      ];
+    };
     rsyslogd = {
       enable = true;
       extraConfig = "*.*@192.168.1.27:514;RSYSLOG_SyslogProtocol23Format";

services/nginx/default.nix

@@ -15,12 +15,6 @@ in {
     };
   };
   config = lib.mkIf cfg.enable {
-    age.secrets = {
-      cs-lapi-key = {
-        file = ./secrets/cs-lapi-key.age;
-        owner = "crowdsec";
-      };
-    };
     security.acme = {
       acceptTerms = true;
       defaults.email = "theo.barnouin@le43.eu";
@@ -34,14 +28,10 @@ in {
         package = inputs.crowdsec.packages."x86_64-linux".crowdsec-firewall-bouncer;
         settings = {
           api_key = "XIgNVuxdP74m+UPbd3WJnHHJdLhRiTbhuH6z2mPRIFg";
-          api_url = "http://127.0.0.1:8080";
+          api_url = "http://${cfg.proxy_ip}:8080";
         };
       };
       crowdsec = {
-        enable = true;
-        package = pkgs.crowdsec;
-        autoUpdateService = false;
-        openFirewall = true;
         settings = {
           general = {
             api = {
@@ -50,19 +40,14 @@ in {
                 listen_uri = "${cfg.proxy_ip}:8080";
               };
             };
-            prometheus.listen_addr = "0.0.0.0";
           };
-          lapi.credentialsFile = "${config.age.secrets.cs-lapi-key.path}";
         };
         hub.collections = [
           "firix/authentik"
           "crowdsecurity/sshd"
           "crowdsecurity/linux"
           "crowdsecurity/nginx"
-          "LePresidente/grafana"
-          "LePresidente/jellyfin"
           "crowdsecurity/http-cve"
-          "crowdsecurity/nextcloud"
           "crowdsecurity/base-http-scenarios"
         ];
         localConfig = {

services/nginx/secrets/cs-lapi-key.age

@@ -1,13 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyBPc0Q4
-UU1TbDBWL3RKQ2VQRDZncE9sZC8vVVdESzYxNkQ0amoySFdNZFRJClVpS3ZaeFhP
-WVNpQXJQbWp2aDMyMldkdVczdkZCTU5McFpRMTN6NXBtQkkKLT4gc3NoLWVkMjU1
-MTkgbXUwZm5BIFlxK0RKY0plTmtGV2FYZHBUMjlVa1FwYkRkalVyUEsvREJ3VmFz
-SXVUVWMKZGF1eW9MbkhuajU5aFhHcml4TDVHQVZtZ1ZDbXIzdXRXNERmOGtkYm50
-NAotPiBGLWdyZWFzZSBaUnNXYQo0U0ovMWZTaXhZdy96dWRpY1lud3V3cFNoSnFS
-WExsWEs5VVI2NG5XcHI4eVlJWFZoQVpCVEs2QnkxT3p6b01RCmIrbjZVTWU5U2VV
-VHpTcVIxM01ECi0tLSBqV0ZTbndQU2xQMjcwQUxRR1dCQ2JsSnlpUzlrMmRVUXRH
-aytLOStjYmJnCg2ocDo5O53RoiV3p9kGD+NulQKb1+01Ay1R2W0Upcgpu132Rexy
-nwUvMrRbPgWUdgeUjkhKJ/ZR1gCVEav38aUsZugs39ndLYOwpluw5lUs+i2piB7k
-rOC+NhPXSXJLMb4vKdkkioJehv+VbSZ9M4PW2vbsziQAhfWErm7RAi/FvtoUdypT
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyByTU5i
+RzF4ZE4zQk8zeTNqN2hYVGU1cmZwYkR6bTAwZUlZUWNaNGdmc0RVClRwN1YyVnZj
+a0pjRERBY0tPbjdyMVNpVHZONW9uKzA3aHNGbjUzeVNmbFEKLT4gc3NoLWVkMjU1
+MTkgbXUwZm5BIHBxYWhuVDNyZVNFbjF1aTVVQjNERS9FalNSMGZKa2FSV2ZqaGFk
+Z2ZxeTQKcFFYNm5aTHRzWHJqb1pBdHAyd3c4OUZFSXdhZVp5T1BvcS9oQllENmlD
+YwotPiBrfmFlTnUtZ3JlYXNlICM8IH5iekBhWGo+CmsrNFE2eTkzamlLeGVSRUFP
+M3JRTEVaaEpQVDhuOVhWQ3hPdjc5T21GU2xJKzhBaFprUXVWY3FmUm1NCi0tLSAr
+QVY3S2kyOU1SL0NEaEJNMm9xR0lmUHVFU0VVYkhJcTBkdEl3Skp0N3F3Ck+9Y6el
+QMrUREWKK7hxuZRE2gVoSQj/ia8xNWRALMOgY+FgskwRwFLaJhI+hwfAexUHuDbn
+I80dUbUsM/ccELMs3nx6DWbchUWh9KMHYejyBMRX6NpHy1UDq+q80zile9WPygtk
+fmVPd6OOd/84e3pFmIcgTteDVnadLiZNvDVapVVbJqm8B72h
 -----END AGE ENCRYPTED FILE-----