Flake for my desktop, laptop, and my homelab.
avoid paying for crowdsec
+13
-8
+13
-8
modules/services/crowdsec.nix
+13
-8
modules/services/crowdsec.nix
···
60
60
"crowdsecurity/linux"
61
61
"crowdsecurity/sshd"
62
62
"crowdsecurity/traefik"
63
+
"crowdsecurity/whitelist-good-actors"
63
64
"firix/authentik"
64
65
# keep-sorted end
65
66
];
···
159
160
type: http
160
161
name: gotify
161
162
log_level: info
163
+
group_threshold: 1
162
164
url: ${gotifyUrl}
163
165
method: POST
164
166
headers:
···
167
169
format: |
168
170
{{ range . -}}
169
171
{{ $alert := . -}}
172
+
{{ $scenario := $alert.GetScenario -}}
173
+
{{ $source := $alert.GetValue -}}
170
174
{
171
175
"extras": {
172
176
"client::display": {
···
174
178
}
175
179
},
176
180
"priority": 3,
177
-
{{range .Decisions -}}
178
-
"title": "{{.Type }} {{ .Value }} for {{.Duration}}",
179
-
"message": "{{.Scenario}}\n\n[crowdsec cti](https://app.crowdsec.net/cti/{{.Value -}})\n\n[shodan](https://www.shodan.io/host/{{.Value -}})"
180
-
{{end -}}
181
+
"title": "CrowdSec Alert",
182
+
"message": {{ printf "**Scenario:** `%s`\n\n**IP:** `%s`\n\n**Machine:** `%s`" $scenario $source $alert.MachineID | toJson }}
181
183
}
182
184
{{ end -}}
183
185
'';
···
201
203
console.enrollKeyFile = secrets."crowdsec/console_enroll_key".path;
202
204
203
205
profiles = [
204
-
# keep-sorted start block=yes newline_separated=yes
206
+
{
207
+
filters = [''Alert.GetScenario() != "" && !(Alert.GetScenario() contains "external/blocklist")''];
208
+
name = "all_scenario_notifications";
209
+
notifications = ["gotify"];
210
+
on_success = "continue";
211
+
}
212
+
205
213
{
206
214
decisions = [
207
215
{
···
212
220
213
221
filters = [''Alert.Remediation == true && Alert.GetScope() == "Ip"''];
214
222
name = "default_ip_remediation";
215
-
notifications = ["gotify"];
216
223
on_success = "break";
217
224
}
218
225
···
226
233
227
234
filters = [''Alert.Remediation == true && Alert.GetScope() == "Range"''];
228
235
name = "default_ip_remediation";
229
-
notifications = ["gotify"];
230
236
on_success = "break";
231
237
}
232
-
# keep-sorted end
233
238
];
234
239
};
235
240