nixconfig/modules/nixos/orac/crowdsec.nix

{ config, pkgs, ... }:

{
  services.crowdsec = {
    enable = true;
    allowLocalAPI = true;

    hub = {
      collections = [
        "crowdsecurity/linux"
        "crowdsecurity/sshd"
        "crowdsecurity/traefik"
        "crowdsecurity/http-cve"
      ];
    };

    acquisitions = [
      {
        source = "journalctl";
        journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
        labels.type = "syslog";
      }
      {
        source = "journalctl";
        journalctl_filter = [
          "SYSLOG_IDENTIFIER=sudo"
          "SYSLOG_IDENTIFIER=auth"
        ];
        labels.type = "syslog";
      }
      {
        source = "journalctl";
        journalctl_filter = [ "_SYSTEMD_UNIT=docker-traefik.service" ];
        labels.type = "traefik";
      }
    ];
  };

  services.crowdsec-firewall-bouncer = {
    enable = true;

    registerBouncer = {
      enable = true;
    };

    settings = {
      mode = "nftables";
      log_level = "info";
      update_frequency = "10s";
      api_url = "http://127.0.0.1:8080/";
    };
  };

  users.users.crowdsec.extraGroups = [ "systemd-journal" ];
}