{"id":23739356,"url":"https://github.com/kampka/nix-flake-crowdsec","last_synced_at":"2025-09-04T14:33:12.602Z","repository":{"id":227659691,"uuid":"769958026","full_name":"kampka/nix-flake-crowdsec","owner":"kampka","description":"A nix flake for running Crowdsec on NixOS","archived":true,"fork":false,"pushed_at":"2024-04-28T10:09:35.000Z","size":16,"stargazers_count":31,"open_issues_count":0,"forks_count":3,"subscribers_count":3,"default_branch":"main","last_synced_at":"2024-04-29T09:37:49.556Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Nix","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kampka.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-03-10T14:39:33.000Z","updated_at":"2024-04-28T10:38:12.000Z","dependencies_parsed_at":"2024-03-20T20:51:48.901Z","dependency_job_id":null,"html_url":"https://github.com/kampka/nix-flake-crowdsec","commit_stats":null,"previous_names":["kampka/nix-flake-crowdsec"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kampka%2Fnix-flake-crowdsec","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kampka%2Fnix-flake-crowdsec/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kampka%2Fnix-flake-crowdsec/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kampka%2Fnix-flake-crowdsec/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kampka","download_url":"https://codeload.github.com/kampka/nix-flake-crowdsec/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":231970924,"owners_count":18453924,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-31T09:36:49.101Z","updated_at":"2024-12-31T09:37:33.469Z","avatar_url":"https://github.com/kampka.png","language":"Nix","funding_links":[],"categories":["Nix"],"sub_categories":[],"readme":"# Crowdsec for NixOS\n\nThis project has moved to Codeberg.\nYou can find the latest version at https://codeberg.org/kampka/nix-flake-crowdsec\nPlease make sure to update your dependency to receive the latests updates.\n\n## About\n\nThis repository contains a [Nix flake](https://nixos.wiki/wiki/Flakes) for running [Crowdsec](https://www.crowdsec.net/) on NixOS.\n\nCrowdSec is a security tool designed to protect servers, services, and applications by analyzing user behavior and network traffic to detect and block potential attacks. It operates similarly to Fail2Ban but with a few key differences:\n\nCrowdSec leverages the power of its community by sharing information about attacks among users. When one user detects a new threat, the details are shared across the network, allowing others to protect themselves against this threat, effectively creating a collective intelligence about emerging threats.\n\nIn simple terms, think of CrowdSec as a neighborhood watch program for the internet, where everyone contributes to and benefits from a shared pool of intelligence about potential threats.\n\n## Usage\n\n### Crowdsec engine\n\nTo setup the [security engine](https://docs.crowdsec.net/docs/getting_started/security_engine_intro/), import the module and activate the service.\n\n```nix\n{\n  inputs = {\n    crowdsec = {\n      url = \"github:kampka/nix-flake-crowdsec\";\n      inputs.nixpkgs.follows = \"nixpkgs\";\n    };\n  };\n\n  outputs = flakes @ {\n    self,\n    nixpkgs,\n    crowdsec,\n    ...\n  }: {\n    nixosConfiguration.\u003cyour-hostname\u003e = nixpkgs.lib.nixosSystem {\n      # ...\n      modules = [\n        # ...\n        crowdsec.nixosModules.crowdsec\n\n        ({ pkgs, lib, ... }: {\n          services.crowdsec = {\n            enable = true;\n            enrollKeyFile = \"/path/to/enroll-key\";\n            settings = {\n              api.server = {\n                listen_uri = \"127.0.0.1:8080\";\n              };\n            };\n          };\n        })\n      ];\n    };\n  };\n}\n```\n\nIn case you are setting up a central security engine, adjust the `listen_uri` to be reachable by your bouncers.\n\nTo enroll your crowdsec engine into the central API, you need to obtain an enrollment key from the central [app dashboard](https://app.crowdsec.net/).\nEnrolling your engine will give it access to community or commercial blocklist and decisions, depending on your plan.\nEnrollment is optional, if you do not want to enroll your engine and just at on your own logs / events, simply omit the `enrollKeyFile` from the settings.\n\nFor additional configuration options, please consult the (Crowdsec documentation)[https://docs.crowdsec.net/docs/configuration/crowdsec_configuration/].\n\n\n### Crowdsec firewall bouncer\n\nThis flake ships the Crowdsec [firewall bouncer](https://docs.crowdsec.net/docs/getting_started/security_engine_intro/).\nIt will block traffic from blacklisted IPs on the firewall level.\n\nAt the time of writing, only `iptables` support has proper defaults and testing.\nIf you are using `nftables` (`networking.nftables.enable = true`), you need to supply bouncer configuration yourself (PRs welcome). \nPlease consult the [bouncer documentation](https://docs.crowdsec.net/u/bouncers/firewall/#nftables-specific-directives) for directions.\n\n\n```nix\n{\n  inputs = {\n    crowdsec = {\n      url = \"github:kampka/nix-flake-crowdsec\";\n      inputs.nixpkgs.follows = \"nixpkgs\";\n    };\n  };\n\n  outputs = flakes @ {\n    self,\n    nixpkgs,\n    crowdsec,\n    ...\n  }: {\n    nixosConfiguration.\u003cyour-hostname\u003e = nixpkgs.lib.nixosSystem {\n      # ...\n      modules = [\n        # ...\n        crowdsec.nixosModules.crowdsec-firewall-bouncer;\n\n        ({ pkgs, lib, ... }: {\n          nixpkgs.overlays = [crowdsec.overlays.default];\n          services.crowdsec-firewall-bouncer = {\n            enable = true;\n            settings = {\n              api_key = \"\u003capi-key\u003e\";\n              api_url = \"http://localhost:8080\";\n            };\n          };\n        })\n      ];\n    };\n  };\n}\n```\n\nIn order to connect to your security engine, you need to [add your bouncer](https://docs.crowdsec.net/docs/cscli/cscli_bouncers_add/) to the security engine.\nYou can either use a pre-generated key or have the security engine generate one for you.\nDepending on your security requirements and secrets management, this process is scriptable through an `ExecStartPre` script of the engine, eg.\n\n```nix\n{\n  systemd.services.crowdsec.serviceConfig = {\n    ExecStartPre = let\n      script = pkgs.writeScriptBin \"register-bouncer\" ''\n        #!${pkgs.runtimeShell}\n        set -eu\n        set -o pipefail\n\n        if ! cscli bouncers list | grep -q \"my-bouncer\"; then\n          cscli bouncers add \"my-bouncer\" --key \"\u003capi-key\u003e\"\n        fi\n      '';\n    in [\"${script}/bin/register-bouncer\"];\n  };\n}\n\n```\n\n## Examples\n\n### Local SSHd with systemd-journal\n\nThis scenario is probably the most common scenario when getting started with Crowdsec.\nIt configures the engine to parse logs from the systems local systemd-journal for\nfailed SSH authentications and blocks IPs trying to brute-force the SSH key.\n\n```nix\n{\n  services.crowdsec = let\n    yaml = (pkgs.formats.yaml {}).generate;\n    acquisitions_file = yaml \"acquisitions.yaml\" {\n      source = \"journalctl\";\n      journalctl_filter = [\"_SYSTEMD_UNIT=sshd.service\"];\n      labels.type = \"syslog\";\n    };\n  in {\n    enable = true;\n    allowLocalJournalAccess = true;\n    settings = {\n      crowdsec_service.acquisition_path = acquisitions_file;\n    };\n  };\n}\n```\n\nThen, install a scenario to act on your logs. The [crowdsecurity/linux](https://app.crowdsec.net/hub/author/crowdsecurity/collections/linux)\ncollection provides a good base collection to get started.\n\n```shell\n  cscli collections install crowdsecurity/linux\n```\n\nThis can be automated using eg. `ExecStartPre` scripts. See some example in this README for inspiration.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkampka%2Fnix-flake-crowdsec","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkampka%2Fnix-flake-crowdsec","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkampka%2Fnix-flake-crowdsec/lists"}