Cleanup and pin crowdsec pkg to 1.6.4 (URL bug)

modules/crowdsec.nix

@@ -602,14 +602,14 @@ in
             console_path = mkDefault consoleFile;
             profiles_path = mkDefault localProfilesFile;
 
-            #online_client = mkDefault {
+            online_client = mkDefault {
-            #  sharing = mkDefault true;
+              sharing = mkDefault true;
-            #  pull = mkDefault {
+              pull = mkDefault {
-            #    community = mkDefault true;
+                community = mkDefault true;
-            #    blocklists = mkDefault true;
+                blocklists = mkDefault true;
-            #  };
+              };
-            #  credentials_path = cfg.settings.capi.credentialsFile;
+              credentials_path = cfg.settings.capi.credentialsFile;
-            #};
+            };
           };
         };
         prometheus = {

secrets.nix

@@ -35,6 +35,7 @@ in {
   "secrets/postgresql-lapi-key.age".publicKeys = [tbarnouin postgresql];
 
   "services/nginx/secrets/cs-lapi-key.age".publicKeys = [tbarnouin nginx];
+  "services/nginx/secrets/cs-capi-key.age".publicKeys = [tbarnouin nginx];
   "services/minimalConfig/secrets/cs-lapi-key.age".publicKeys = users ++ systems;
   "secrets/cs-lapi-key.age".publicKeys = users ++ systems;
 

services/nginx/default.nix

@@ -26,6 +26,11 @@ in {
       file = ./secrets/cs-lapi-key.age;
       owner = "crowdsec";
     };
+    age.secrets.nginx-capi-key = {
+      file = ./secrets/cs-capi-key.age;
+      owner = "crowdsec";
+      mode = "600";
+    };
     services = {
       crowdsec-firewall-bouncer = {
         enable = true;
@@ -42,6 +47,7 @@ in {
             listen_uri = "${cfg.proxy_ip}:8080";
           };
           lapi.credentialsFile = "${config.age.secrets.nginx-lapi-key.path}";
+          capi.credentialsFile = "${config.age.secrets.nginx-capi-key.path}";
         };
         hub.collections = [
           "firix/authentik"

services/nginx/secrets/cs-capi-key.age

@@ -0,0 +1,16 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyB0Q1Js
+Kys0clVVOFQwVTUzV04yZ0cyUGM5QnJ6L3ZYNTZpZFVKeTRuZWtBCmYyV1RQR2xC
+SExUeEx3MjYwOGgzU0s2U1gxV0Z0ajJ2RUE2bE9LQzFZWTgKLT4gc3NoLWVkMjU1
+MTkgbXUwZm5BIEZRKzkxZnRvZThpSm9PUjc0U2VxU015RzRFWmQ5VVBiV0R3UHVJ
+aDRuWEEKTXJFWnhRckZuNUVHeXdQMWxLZ1NpUEE4MktYdHhTT0dVbVJUK3NGOTZa
+VQotPiAwUH1nLWdyZWFzZSBCdVZcJyZjaCBQXyFvUndDdCBMbk5mOWlUYyBVewoy
+cHRlR1JvUEF2VGZ2SnRIaS9RTmJlVWVTd1dneDdGQjh5LzQxSnRTNSs4WmNRWWc5
+WkFlNGlDMWw2NGdtOGpnCkNtTERzb24wSlVRT3pGSWZab2ZxQytCWlk2RTJ3MEhi
+YzlOMTBmemFtYzJPRk80NldoRTY5MmJwbHhGUAotLS0gdHBOSHRxOXNtMmo1QnR5
+N1c0clUxRnlKL2l5bU42ejVRQ0J1dEh2RzY5MAp+G3SFYm9lPhGr3CjIU11K8a8s
+YIBgWVCSZ57Dr5LPKfy7kIWuJTFI/YAx1qN4fjwwEXuvyNVWPPVOeO1PAaLhHgAt
+1Tx1V3u/LqyzYeXQWuazBZgHbLU+weKoBSmP8JCWXAyVOPzaQdpEDCT+hB/OFYdc
+i7lKvTwttJK4Fvv2bVE6R1q1mRCiIz+sVLVydXVQHEqSgGP6o8L9cCfccoIDk3Oo
+mtrP+ZEaJU9j4ZM/Y+Shsw/U2TBXOk18f9g+CidhCw==
+-----END AGE ENCRYPTED FILE-----

services/nixarr/default.nix

@@ -1,6 +1,5 @@
 {
   config,
-  pkgs,
   lib,
   ...
 }: let
@@ -39,6 +38,34 @@ in {
                 type = "syslog";
               };
             }
+            {
+              source = "journalctl";
+              journalctl_filter = [ "_SYSTEMD_UNIT=sonarr.service" ];
+              labels = {
+                type = "syslog";
+              };
+            }
+            {
+              source = "journalctl";
+              journalctl_filter = [ "_SYSTEMD_UNIT=bazarr.service" ];
+              labels = {
+                type = "syslog";
+              };
+            }
+            {
+              source = "journalctl";
+              journalctl_filter = [ "_SYSTEMD_UNIT=prowlarr.service" ];
+              labels = {
+                type = "syslog";
+              };
+            }
+            {
+              source = "journalctl";
+              journalctl_filter = [ "_SYSTEMD_UNIT=jellyseerr.service" ];
+              labels = {
+                type = "syslog";
+              };
+            }
           ];
         };
       };

systems/minimalLXCConfig.nix

@@ -1,9 +1,5 @@
 {
-  config,
   pkgs,
-  lib,
-  inputs,
-  modulesPath,
   ...
 }: {
   nix = {
@@ -11,6 +7,21 @@
     settings.trusted-users = ["root" "@wheel"];
   };
 
+  nixpkgs.overlays = [
+    (final: prev: {
+      crowdsec = prev.crowdsec.overrideAttrs ( prev: rec {
+        pname = "crowdsec";
+        version = "1.6.4";
+          src = pkgs.fetchFromGitHub {
+          owner = "crowdsecurity";
+          repo = "${pname}";
+          tag = "v${version}";
+          hash = "sha256-/NTlj0kYCOMxShfoKdmouJTiookDjccUj5HFHLPn5HI=";
+        };
+      });
+    })
+  ];
+
   networking = {
     firewall = {
       enable = true;
@@ -35,7 +46,7 @@
   time.timeZone = "Europe/Paris";
   console.keyMap = "fr";
   i18n.defaultLocale = "fr_FR.UTF-8";
-  environment.sessionVariables = rec {
+  environment.sessionVariables = {
     TERM = "xterm-256color";
   };
 
@@ -97,6 +108,7 @@
       nmap
       iperf3
       netcat-openbsd
+      gnugrep
     ];
   };
 

systems/minimalVMConfig.nix

@@ -1,8 +1,5 @@
 {
-  config, pkgs,
+  pkgs,
-  lib,
-  inputs,
-  modulesPath,
   ...
 }: {
   nix = {
@@ -10,6 +7,21 @@
     settings.trusted-users = ["root" "@wheel"];
   };
 
+  nixpkgs.overlays = [
+    (final: prev: {
+      crowdsec = prev.crowdsec.overrideAttrs ( prev: rec {
+        pname = "crowdsec";
+        version = "1.6.4";
+          src = pkgs.fetchFromGitHub {
+          owner = "crowdsecurity";
+          repo = "${pname}";
+          tag = "v${version}";
+          hash = "sha256-/NTlj0kYCOMxShfoKdmouJTiookDjccUj5HFHLPn5HI=";
+        };
+      });
+    })
+  ];
+
   networking = {
     firewall = {
       enable = true;
@@ -21,7 +33,7 @@
   time.timeZone = "Europe/Paris";
   console.keyMap = "fr";
   i18n.defaultLocale = "fr_FR.UTF-8";
-  environment.sessionVariables = rec {
+  environment.sessionVariables = {
     TERM = "xterm-256color";
   };
 
@@ -83,6 +95,7 @@
       nmap
       iperf3
       netcat-openbsd
+      gnugrep
     ];
   };