mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-09-18 18:42:56 +02:00
Add nix-infra-machine
This commit is contained in:
Ruben Hensen
@@ -0,0 +1,706 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
appName = "beiwe-backend";
|
||||
defaultPort = 8080;
|
||||
|
||||
cfg = config.infrastructure.${appName};
|
||||
|
||||
# Build the beiwe-backend package
|
||||
beiwePackage = if cfg.package != null then cfg.package else
|
||||
pkgs.callPackage ./package.nix {
|
||||
rev = cfg.version;
|
||||
};
|
||||
|
||||
# Construct the Celery broker URL from RabbitMQ settings
|
||||
celeryBrokerUrl = if cfg.celery.enable then
|
||||
"amqp://${cfg.celery.rabbitmq.user}:${cfg.celery.rabbitmq.password}@${cfg.celery.rabbitmq.host}:${toString cfg.celery.rabbitmq.port}/${cfg.celery.rabbitmq.vhost}"
|
||||
else "";
|
||||
|
||||
# Environment variables for beiwe-backend configuration
|
||||
# See: https://github.com/jhsware/beiwe-backend (fork with env var support)
|
||||
beiweEnvironment = {
|
||||
# Required settings
|
||||
DOMAIN_NAME = cfg.domainName;
|
||||
FLASK_SECRET_KEY = cfg.flaskSecretKey;
|
||||
SYSADMIN_EMAILS = cfg.sysadminEmails;
|
||||
|
||||
# Database settings (PostgreSQL)
|
||||
RDS_DB_NAME = cfg.database.name;
|
||||
RDS_USERNAME = cfg.database.user;
|
||||
RDS_PASSWORD = cfg.database.password;
|
||||
RDS_HOSTNAME = cfg.database.host;
|
||||
RDS_PORT = toString cfg.database.port;
|
||||
|
||||
# PostgreSQL SSL mode
|
||||
# Multiple env vars to ensure compatibility with different Django/psycopg versions
|
||||
PGSSLMODE = cfg.database.sslmode;
|
||||
DATABASE_SSLMODE = cfg.database.sslmode;
|
||||
|
||||
# S3/MinIO settings
|
||||
S3_BUCKET = cfg.s3.bucket;
|
||||
AWS_ACCESS_KEY_ID = cfg.s3.accessKeyId;
|
||||
AWS_SECRET_ACCESS_KEY = cfg.s3.secretAccessKey;
|
||||
BEIWE_SERVER_AWS_ACCESS_KEY_ID = cfg.s3.accessKeyId;
|
||||
BEIWE_SERVER_AWS_SECRET_ACCESS_KEY = cfg.s3.secretAccessKey;
|
||||
S3_ACCESS_CREDENTIALS_USER = cfg.s3.accessKeyId;
|
||||
S3_ACCESS_CREDENTIALS_KEY = cfg.s3.secretAccessKey;
|
||||
|
||||
# Django settings
|
||||
DJANGO_SETTINGS_MODULE = "config.django_settings";
|
||||
} // (lib.optionalAttrs (cfg.s3.endpoint != "") {
|
||||
# Custom S3 endpoint for MinIO
|
||||
S3_ENDPOINT_URL = cfg.s3.endpoint;
|
||||
AWS_S3_ENDPOINT_URL = cfg.s3.endpoint;
|
||||
}) // (lib.optionalAttrs (cfg.sentry.dsn != "") {
|
||||
# Sentry error tracking (optional)
|
||||
SENTRY_ELASTIC_BEANSTALK_DSN = cfg.sentry.dsn;
|
||||
SENTRY_DATA_PROCESSING_DSN = cfg.sentry.dsn;
|
||||
}) // (lib.optionalAttrs cfg.celery.enable {
|
||||
# Celery/RabbitMQ settings
|
||||
CELERY_BROKER_URL = celeryBrokerUrl;
|
||||
BROKER_URL = celeryBrokerUrl;
|
||||
# jhsware fork environment variables for Celery configuration
|
||||
# These replace the manager_ip file requirement
|
||||
CELERY_MANAGER_IP = "${cfg.celery.rabbitmq.host}:${toString cfg.celery.rabbitmq.port}";
|
||||
CELERY_PASSWORD = cfg.celery.rabbitmq.password;
|
||||
}) // cfg.extraEnvironment;
|
||||
|
||||
|
||||
in
|
||||
{
|
||||
options.infrastructure.${appName} = {
|
||||
enable = lib.mkEnableOption "infrastructure.beiwe-backend";
|
||||
|
||||
# ==========================================================================
|
||||
# Package and Version Configuration
|
||||
# ==========================================================================
|
||||
|
||||
version = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Git commit hash of beiwe-backend to install.
|
||||
|
||||
Uses jhsware fork which adds environment variable support for Celery.
|
||||
Supported versions are defined in package.nix.
|
||||
|
||||
See package.nix for instructions on adding new versions.
|
||||
'';
|
||||
default = "93be878"; # jhsware fork with CELERY_MANAGER_IP/CELERY_PASSWORD env var support
|
||||
example = "main";
|
||||
};
|
||||
|
||||
package = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.package;
|
||||
description = ''
|
||||
Custom beiwe-backend package to use. If null, the package will be built
|
||||
using the version specified in 'version' option.
|
||||
'';
|
||||
default = null;
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Network Configuration
|
||||
# ==========================================================================
|
||||
|
||||
bindToIp = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "IP address to bind beiwe-backend to.";
|
||||
default = "127.0.0.1";
|
||||
example = "0.0.0.0";
|
||||
};
|
||||
|
||||
bindToPort = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
description = "Port for beiwe-backend web interface.";
|
||||
default = defaultPort;
|
||||
};
|
||||
|
||||
openFirewall = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = "Open firewall for beiwe-backend.";
|
||||
default = false;
|
||||
};
|
||||
|
||||
domainName = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Domain name for the Beiwe backend (used in DOMAIN_NAME env var).";
|
||||
default = "localhost:8080";
|
||||
example = "beiwe.example.com";
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Security Configuration
|
||||
# ==========================================================================
|
||||
|
||||
flaskSecretKey = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
A unique, cryptographically secure string for Flask sessions.
|
||||
IMPORTANT: Change this in production!
|
||||
'';
|
||||
default = "CHANGE_ME_IN_PRODUCTION_use_a_random_string";
|
||||
example = "your-super-secret-random-key-here";
|
||||
};
|
||||
|
||||
sysadminEmails = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "System administrator email addresses (comma-separated).";
|
||||
default = "sysadmin@localhost";
|
||||
example = "admin@example.com";
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Data Directory
|
||||
# ==========================================================================
|
||||
|
||||
dataDir = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "Directory where beiwe-backend data is stored.";
|
||||
default = "/var/lib/beiwe-backend";
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Database Configuration (PostgreSQL)
|
||||
# ==========================================================================
|
||||
database = {
|
||||
host = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "PostgreSQL host.";
|
||||
default = "/run/postgresql";
|
||||
example = "localhost";
|
||||
};
|
||||
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
description = "PostgreSQL port.";
|
||||
default = 5432;
|
||||
};
|
||||
|
||||
name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "PostgreSQL database name.";
|
||||
default = "beiwe";
|
||||
};
|
||||
|
||||
user = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "PostgreSQL user.";
|
||||
default = "beiwe";
|
||||
};
|
||||
|
||||
password = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
PostgreSQL password. Required by Beiwe even when using trust authentication.
|
||||
For trust authentication, use an empty string or placeholder value.
|
||||
'';
|
||||
default = "unused_with_trust_auth";
|
||||
example = "secure-password-here";
|
||||
};
|
||||
|
||||
passwordSecretName = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
description = ''
|
||||
Name of the secret containing the PostgreSQL password.
|
||||
The secret should be placed at /run/secrets/<n>.
|
||||
If null, peer/socket authentication is assumed.
|
||||
'';
|
||||
default = null;
|
||||
example = "beiwe-db-password";
|
||||
};
|
||||
|
||||
sslmode = lib.mkOption {
|
||||
type = lib.types.enum [ "disable" "allow" "prefer" "require" "verify-ca" "verify-full" ];
|
||||
description = ''
|
||||
PostgreSQL SSL mode. For local development without SSL certificates,
|
||||
use "disable". For production with SSL, use "require" or "verify-full".
|
||||
|
||||
See: https://www.postgresql.org/docs/current/libpq-ssl.html
|
||||
'';
|
||||
default = "prefer";
|
||||
example = "disable";
|
||||
};
|
||||
|
||||
createLocally = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Whether to create the database user locally.
|
||||
This requires PostgreSQL to be running locally with trust or peer authentication.
|
||||
'';
|
||||
default = false;
|
||||
};
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# S3/MinIO Configuration
|
||||
# ==========================================================================
|
||||
s3 = {
|
||||
bucket = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "S3 bucket name for data storage.";
|
||||
default = "beiwe-data";
|
||||
};
|
||||
|
||||
accessKeyId = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "AWS/MinIO access key ID.";
|
||||
default = "";
|
||||
example = "minioadmin";
|
||||
};
|
||||
|
||||
secretAccessKey = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "AWS/MinIO secret access key.";
|
||||
default = "";
|
||||
example = "minioadmin";
|
||||
};
|
||||
|
||||
endpoint = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Custom S3 endpoint URL for MinIO or other S3-compatible storage.
|
||||
Leave empty for AWS S3.
|
||||
'';
|
||||
default = "";
|
||||
example = "http://localhost:9000";
|
||||
};
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Sentry Configuration (Optional)
|
||||
# ==========================================================================
|
||||
sentry = {
|
||||
dsn = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Sentry DSN for error tracking. Leave empty to disable.";
|
||||
default = "";
|
||||
example = "https://xxx@sentry.io/xxx";
|
||||
};
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Celery Configuration (Optional - for background tasks)
|
||||
# ==========================================================================
|
||||
celery = {
|
||||
enable = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Enable Celery worker for background task processing.
|
||||
|
||||
When enabled, the following features become available:
|
||||
- Push notifications to mobile apps
|
||||
- Data processing pipelines
|
||||
- Forest analysis integration
|
||||
|
||||
Requires RabbitMQ to be running and accessible.
|
||||
'';
|
||||
default = false;
|
||||
};
|
||||
|
||||
rabbitmq = {
|
||||
host = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "RabbitMQ host for Celery broker.";
|
||||
default = "127.0.0.1";
|
||||
example = "rabbitmq.example.com";
|
||||
};
|
||||
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
description = "RabbitMQ port.";
|
||||
default = 5672;
|
||||
};
|
||||
|
||||
user = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "RabbitMQ user.";
|
||||
default = "guest";
|
||||
example = "beiwe";
|
||||
};
|
||||
|
||||
password = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "RabbitMQ password.";
|
||||
default = "guest";
|
||||
example = "secure-password";
|
||||
};
|
||||
|
||||
vhost = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "RabbitMQ virtual host.";
|
||||
default = "";
|
||||
example = "beiwe";
|
||||
};
|
||||
};
|
||||
|
||||
concurrency = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
description = "Number of concurrent Celery worker processes.";
|
||||
default = 2;
|
||||
};
|
||||
|
||||
queues = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
description = ''
|
||||
Celery queues to process. Beiwe uses separate queues for different tasks:
|
||||
- celery (default queue)
|
||||
- data_processing
|
||||
- push_notifications
|
||||
- forest
|
||||
'';
|
||||
default = [ "celery" "data_processing" "push_notifications" "forest" ];
|
||||
};
|
||||
|
||||
logLevel = lib.mkOption {
|
||||
type = lib.types.enum [ "DEBUG" "INFO" "WARNING" "ERROR" "CRITICAL" ];
|
||||
description = "Celery worker log level.";
|
||||
default = "INFO";
|
||||
};
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Gunicorn Configuration
|
||||
# ==========================================================================
|
||||
gunicorn = {
|
||||
workers = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
description = "Number of Gunicorn worker processes.";
|
||||
default = 4;
|
||||
};
|
||||
|
||||
threads = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
description = "Number of threads per worker.";
|
||||
default = 2;
|
||||
};
|
||||
|
||||
timeout = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
description = "Request timeout in seconds.";
|
||||
default = 120;
|
||||
};
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Extra Environment Variables
|
||||
# ==========================================================================
|
||||
|
||||
extraEnvironment = lib.mkOption {
|
||||
type = lib.types.attrsOf lib.types.str;
|
||||
description = ''
|
||||
Additional environment variables for beiwe-backend.
|
||||
These are passed directly to the service.
|
||||
'';
|
||||
default = {};
|
||||
example = lib.literalExpression ''
|
||||
{
|
||||
DEBUG = "false";
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Reverse Proxy Configuration
|
||||
# ==========================================================================
|
||||
|
||||
reverseProxy = {
|
||||
enable = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = "Enable nginx reverse proxy for beiwe-backend.";
|
||||
default = false;
|
||||
};
|
||||
|
||||
hostName = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Hostname for the reverse proxy.";
|
||||
default = "localhost";
|
||||
example = "beiwe.example.com";
|
||||
};
|
||||
|
||||
ssl = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = "Enable SSL/HTTPS for the reverse proxy.";
|
||||
default = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# ==========================================================================
|
||||
# Beiwe User and Group
|
||||
# ==========================================================================
|
||||
|
||||
users.users.beiwe = {
|
||||
isSystemUser = true;
|
||||
group = "beiwe";
|
||||
home = cfg.dataDir;
|
||||
createHome = true;
|
||||
description = "Beiwe backend service user";
|
||||
};
|
||||
|
||||
users.groups.beiwe = {};
|
||||
|
||||
# ==========================================================================
|
||||
# Beiwe Backend Systemd Service (Web Server)
|
||||
# ==========================================================================
|
||||
|
||||
systemd.services.beiwe-backend = {
|
||||
description = "Beiwe Backend - Digital Phenotyping Research Platform";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" "postgresql.service" ] ++
|
||||
lib.optionals cfg.reverseProxy.enable [ "nginx.service" ] ++
|
||||
lib.optionals cfg.celery.enable [ "rabbitmq.service" ];
|
||||
wants = lib.optionals cfg.database.createLocally [
|
||||
"beiwe-db-setup.service"
|
||||
];
|
||||
requires = lib.optionals cfg.database.createLocally [
|
||||
"postgresql.service"
|
||||
];
|
||||
|
||||
environment = beiweEnvironment;
|
||||
|
||||
# Load database password from secret file if specified
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
User = "beiwe";
|
||||
Group = "beiwe";
|
||||
WorkingDirectory = "${beiwePackage}/lib/beiwe-backend";
|
||||
|
||||
ExecStartPre = let
|
||||
preStartScript = pkgs.writeShellScript "beiwe-pre-start" ''
|
||||
# Run database migrations
|
||||
${beiwePackage}/bin/beiwe-manage migrate --noinput || true
|
||||
'';
|
||||
in "+${preStartScript}";
|
||||
|
||||
ExecStart = ''
|
||||
${beiwePackage}/bin/beiwe-gunicorn wsgi:application \
|
||||
--bind ${cfg.bindToIp}:${toString cfg.bindToPort} \
|
||||
--workers ${toString cfg.gunicorn.workers} \
|
||||
--threads ${toString cfg.gunicorn.threads} \
|
||||
--timeout ${toString cfg.gunicorn.timeout} \
|
||||
--access-logfile - \
|
||||
--error-logfile -
|
||||
'';
|
||||
|
||||
Restart = "on-failure";
|
||||
RestartSec = "5s";
|
||||
|
||||
# Hardening
|
||||
NoNewPrivileges = true;
|
||||
PrivateTmp = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
ReadWritePaths = [ cfg.dataDir ];
|
||||
} // (lib.optionalAttrs (cfg.database.passwordSecretName != null) {
|
||||
EnvironmentFile = "/run/secrets/${cfg.database.passwordSecretName}";
|
||||
});
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Beiwe Celery Worker Service (Background Task Processing)
|
||||
# ==========================================================================
|
||||
#
|
||||
# Uses jhsware fork which supports CELERY_MANAGER_IP and CELERY_PASSWORD
|
||||
# environment variables instead of requiring a manager_ip file.
|
||||
|
||||
systemd.services.beiwe-celery-worker = lib.mkIf cfg.celery.enable {
|
||||
description = "Beiwe Celery Worker - Background Task Processing";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" "postgresql.service" "rabbitmq.service" ];
|
||||
requires = [ "rabbitmq.service" ];
|
||||
wants = [ "beiwe-backend.service" ];
|
||||
|
||||
environment = beiweEnvironment;
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
User = "beiwe";
|
||||
Group = "beiwe";
|
||||
WorkingDirectory = "${beiwePackage}/lib/beiwe-backend";
|
||||
|
||||
# Celery command pattern from beiwe-backend wiki:
|
||||
# python3 -m celery -A services.celery_data_processing worker -Q ...
|
||||
ExecStart = let
|
||||
queuesArg = lib.concatStringsSep "," cfg.celery.queues;
|
||||
in ''
|
||||
${beiwePackage}/bin/beiwe-celery \
|
||||
-A services.celery_data_processing \
|
||||
worker \
|
||||
--queues=${queuesArg} \
|
||||
--concurrency=${toString cfg.celery.concurrency} \
|
||||
--loglevel=${cfg.celery.logLevel}
|
||||
'';
|
||||
|
||||
Restart = "on-failure";
|
||||
RestartSec = "10s";
|
||||
|
||||
# Hardening
|
||||
NoNewPrivileges = true;
|
||||
PrivateTmp = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
ReadWritePaths = [ cfg.dataDir "/tmp" ];
|
||||
} // (lib.optionalAttrs (cfg.database.passwordSecretName != null) {
|
||||
EnvironmentFile = "/run/secrets/${cfg.database.passwordSecretName}";
|
||||
});
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Beiwe Celery Beat Service (Scheduled Tasks)
|
||||
# ==========================================================================
|
||||
|
||||
systemd.services.beiwe-celery-beat = lib.mkIf cfg.celery.enable {
|
||||
description = "Beiwe Celery Beat - Task Scheduler";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" "rabbitmq.service" "beiwe-celery-worker.service" ];
|
||||
requires = [ "rabbitmq.service" ];
|
||||
wants = [ "beiwe-celery-worker.service" ];
|
||||
|
||||
environment = beiweEnvironment;
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
User = "beiwe";
|
||||
Group = "beiwe";
|
||||
WorkingDirectory = "${beiwePackage}/lib/beiwe-backend";
|
||||
|
||||
ExecStart = ''
|
||||
${beiwePackage}/bin/beiwe-celery \
|
||||
-A services.celery_data_processing \
|
||||
beat \
|
||||
--loglevel=${cfg.celery.logLevel} \
|
||||
--schedule=${cfg.dataDir}/celerybeat-schedule
|
||||
'';
|
||||
|
||||
Restart = "on-failure";
|
||||
RestartSec = "10s";
|
||||
|
||||
# Hardening
|
||||
NoNewPrivileges = true;
|
||||
PrivateTmp = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
ReadWritePaths = [ cfg.dataDir ];
|
||||
} // (lib.optionalAttrs (cfg.database.passwordSecretName != null) {
|
||||
EnvironmentFile = "/run/secrets/${cfg.database.passwordSecretName}";
|
||||
});
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# PostgreSQL Database Setup (Optional)
|
||||
# ==========================================================================
|
||||
|
||||
systemd.services.beiwe-db-setup = lib.mkIf cfg.database.createLocally {
|
||||
description = "Create Beiwe database and user";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "postgresql.service" ];
|
||||
requires = [ "postgresql.service" ];
|
||||
before = [ "beiwe-backend.service" ];
|
||||
requiredBy = [ "beiwe-backend.service" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
User = "postgres";
|
||||
};
|
||||
script = let
|
||||
dbUser = cfg.database.user;
|
||||
dbName = cfg.database.name;
|
||||
dbHost = cfg.database.host;
|
||||
dbPort = toString cfg.database.port;
|
||||
in ''
|
||||
set -euo pipefail
|
||||
|
||||
# Wait for PostgreSQL to be ready
|
||||
echo "Waiting for PostgreSQL to be ready..."
|
||||
until ${pkgs.postgresql}/bin/pg_isready -h ${dbHost} -p ${dbPort} 2>/dev/null; do
|
||||
sleep 1
|
||||
done
|
||||
echo "PostgreSQL is ready"
|
||||
|
||||
# Create database user if it doesn't exist
|
||||
echo "Checking if user '${dbUser}' exists..."
|
||||
if ! ${pkgs.postgresql}/bin/psql -h ${dbHost} -p ${dbPort} -tAc "SELECT 1 FROM pg_roles WHERE rolname='${dbUser}'" | grep -q 1; then
|
||||
echo "Creating user '${dbUser}'..."
|
||||
${pkgs.postgresql}/bin/psql -h ${dbHost} -p ${dbPort} -c "CREATE USER ${dbUser}"
|
||||
else
|
||||
echo "User '${dbUser}' already exists"
|
||||
fi
|
||||
|
||||
# Create database if it doesn't exist
|
||||
echo "Checking if database '${dbName}' exists..."
|
||||
if ! ${pkgs.postgresql}/bin/psql -h ${dbHost} -p ${dbPort} -tAc "SELECT 1 FROM pg_database WHERE datname='${dbName}'" | grep -q 1; then
|
||||
echo "Creating database '${dbName}'..."
|
||||
${pkgs.postgresql}/bin/psql -h ${dbHost} -p ${dbPort} -c "CREATE DATABASE ${dbName} OWNER ${dbUser}"
|
||||
else
|
||||
echo "Database '${dbName}' already exists"
|
||||
fi
|
||||
|
||||
# Grant privileges on database (idempotent)
|
||||
echo "Granting privileges..."
|
||||
${pkgs.postgresql}/bin/psql -h ${dbHost} -p ${dbPort} -c "GRANT ALL PRIVILEGES ON DATABASE ${dbName} TO ${dbUser}" || true
|
||||
${pkgs.postgresql}/bin/psql -h ${dbHost} -p ${dbPort} -d ${dbName} -c "GRANT ALL ON SCHEMA public TO ${dbUser}" || true
|
||||
|
||||
echo "Database setup complete"
|
||||
'';
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Nginx Reverse Proxy (Optional)
|
||||
# ==========================================================================
|
||||
|
||||
services.nginx = lib.mkIf cfg.reverseProxy.enable {
|
||||
enable = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = cfg.reverseProxy.ssl;
|
||||
|
||||
virtualHosts.${cfg.reverseProxy.hostName} = {
|
||||
forceSSL = cfg.reverseProxy.ssl;
|
||||
enableACME = cfg.reverseProxy.ssl;
|
||||
|
||||
locations."/" = {
|
||||
proxyPass = "http://${cfg.bindToIp}:${toString cfg.bindToPort}";
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_read_timeout ${toString cfg.gunicorn.timeout}s;
|
||||
proxy_connect_timeout ${toString cfg.gunicorn.timeout}s;
|
||||
client_max_body_size 100M;
|
||||
'';
|
||||
};
|
||||
|
||||
# Static files
|
||||
locations."/static/" = {
|
||||
alias = "${beiwePackage}/lib/beiwe-backend/frontend/static/";
|
||||
extraConfig = ''
|
||||
expires 30d;
|
||||
add_header Cache-Control "public, immutable";
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Firewall Configuration
|
||||
# ==========================================================================
|
||||
|
||||
networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall (
|
||||
[ cfg.bindToPort ] ++
|
||||
(lib.optionals cfg.reverseProxy.enable [ 80 443 ])
|
||||
);
|
||||
|
||||
# ==========================================================================
|
||||
# Utilities
|
||||
# ==========================================================================
|
||||
|
||||
environment.systemPackages = [
|
||||
beiwePackage
|
||||
pkgs.curl
|
||||
pkgs.jq
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,309 @@
|
||||
# Beiwe Backend package
|
||||
# A Django-based smartphone digital phenotyping research platform backend
|
||||
#
|
||||
# Using jhsware fork which adds environment variable support for Celery configuration
|
||||
# (CELERY_MANAGER_IP and CELERY_PASSWORD instead of manager_ip file)
|
||||
#
|
||||
# To update to a new version:
|
||||
# 1. Update the rev to the new commit hash
|
||||
# 2. Run: nix-prefetch-url --unpack https://github.com/jhsware/beiwe-backend/archive/<NEW_COMMIT>.tar.gz
|
||||
# 3. Update the hash with the output from step 2
|
||||
|
||||
{
|
||||
lib,
|
||||
stdenv,
|
||||
fetchFromGitHub,
|
||||
fetchPypi,
|
||||
python312,
|
||||
python312Packages,
|
||||
postgresql,
|
||||
# Custom parameters
|
||||
rev ? "93be878", # jhsware fork with env var support for Celery
|
||||
}:
|
||||
|
||||
|
||||
let
|
||||
# Known version hashes
|
||||
# To add a new version, run:
|
||||
# nix-prefetch-url --unpack https://github.com/jhsware/beiwe-backend/archive/<COMMIT>.tar.gz
|
||||
versionHashes = {
|
||||
# jhsware fork with CELERY_MANAGER_IP and CELERY_PASSWORD env var support
|
||||
"93be878" = {
|
||||
srcHash = "sha256-marYxVINxgW0X9x+xoHL7bdRYEgm+4q+O1CF5WXeZGg=";
|
||||
};
|
||||
# Original onnela-lab version (for reference)
|
||||
"6bb5363" = {
|
||||
srcHash = "sha256-EeD+I3mWC81mhmlO9cKzRrArDLKVBmqhZjgJI8+geu0=";
|
||||
};
|
||||
};
|
||||
|
||||
hashes = versionHashes.${rev} or (throw ''
|
||||
beiwe-backend revision ${rev} is not supported.
|
||||
|
||||
Supported revisions: ${builtins.concatStringsSep ", " (builtins.attrNames versionHashes)}
|
||||
|
||||
To add support for revision ${rev}:
|
||||
1. Get source hash: nix-prefetch-url --unpack https://github.com/jhsware/beiwe-backend/archive/${rev}.tar.gz
|
||||
2. Add entry to versionHashes in app_modules/_unstable/beiwe-backend/package.nix
|
||||
'');
|
||||
|
||||
# Build cronutils from PyPI (not available in nixpkgs)
|
||||
cronutils = python312Packages.buildPythonPackage rec {
|
||||
pname = "cronutils";
|
||||
version = "0.4.2";
|
||||
format = "setuptools";
|
||||
|
||||
src = fetchPypi {
|
||||
inherit pname version;
|
||||
hash = "sha256-SFHkQ9NltAyWArArkFpSBIJF3gMoXbxHEXreM1SEPUY=";
|
||||
};
|
||||
|
||||
propagatedBuildInputs = with python312Packages; [
|
||||
sentry-sdk
|
||||
];
|
||||
|
||||
# Tests require network access
|
||||
doCheck = false;
|
||||
|
||||
pythonImportsCheck = [ "cronutils" ];
|
||||
|
||||
meta = with lib; {
|
||||
description = "Utilities for cron jobs including error handling";
|
||||
homepage = "https://pypi.org/project/cronutils/";
|
||||
license = licenses.mit;
|
||||
};
|
||||
};
|
||||
|
||||
# Build beiwe-forest from GitHub (Forest analysis library)
|
||||
# See: https://github.com/onnela-lab/forest
|
||||
# Note: pip install git+https://github.com/onnela-lab/forest
|
||||
beiweForest = python312Packages.buildPythonPackage rec {
|
||||
pname = "forest";
|
||||
version = "unstable-2024-12-01";
|
||||
format = "pyproject";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "onnela-lab";
|
||||
repo = "forest";
|
||||
rev = "develop"; # Main development branch
|
||||
hash = "sha256-t+oq/jfJUmWCs0XzrN+xciYc3lz4oPiO8V8qfj3iTJA=";
|
||||
};
|
||||
|
||||
nativeBuildInputs = with python312Packages; [
|
||||
setuptools
|
||||
];
|
||||
|
||||
propagatedBuildInputs = with python312Packages; [
|
||||
# Core data science
|
||||
numpy
|
||||
pandas
|
||||
scipy
|
||||
scikit-learn
|
||||
|
||||
# Time/date utilities
|
||||
pytz
|
||||
holidays
|
||||
timezonefinder
|
||||
|
||||
# GIS/mapping
|
||||
shapely
|
||||
pyproj
|
||||
|
||||
# Audio processing (for voice analysis)
|
||||
librosa
|
||||
|
||||
# HTTP/API
|
||||
requests
|
||||
ratelimit
|
||||
];
|
||||
|
||||
# Some optional dependencies not in nixpkgs (openrouteservice, ssqueezepy)
|
||||
# Disable strict runtime deps check to allow partial functionality
|
||||
pythonRelaxDeps = true;
|
||||
pythonRemoveDeps = [ "openrouteservice" "ssqueezepy" ];
|
||||
|
||||
# Tests require data files
|
||||
doCheck = false;
|
||||
|
||||
pythonImportsCheck = [ "forest" ];
|
||||
|
||||
meta = with lib; {
|
||||
description = "Forest library for analyzing Beiwe digital phenotyping data";
|
||||
homepage = "https://github.com/onnela-lab/forest";
|
||||
license = licenses.bsd3;
|
||||
};
|
||||
};
|
||||
|
||||
# Python environment with all dependencies from requirements.txt
|
||||
|
||||
pythonEnv = python312.withPackages (ps: with ps; [
|
||||
# Django and web framework
|
||||
django
|
||||
django-extensions
|
||||
django-timezone-field # Provides timezone_field module
|
||||
gunicorn
|
||||
jinja2
|
||||
|
||||
# Database - using psycopg (v3) as specified in requirements.txt
|
||||
psycopg
|
||||
|
||||
# AWS/S3 support
|
||||
boto3
|
||||
|
||||
# Celery for task queue
|
||||
celery
|
||||
|
||||
# Error tracking and monitoring
|
||||
sentry-sdk
|
||||
cronutils # Custom package built above
|
||||
|
||||
# Firebase (push notifications)
|
||||
firebase-admin
|
||||
|
||||
# Security and crypto
|
||||
pycryptodomex # Note: pycryptodomex not pycryptodome
|
||||
pyotp
|
||||
bleach
|
||||
|
||||
# Serialization
|
||||
orjson
|
||||
|
||||
# Date/time utilities
|
||||
python-dateutil
|
||||
pytz
|
||||
|
||||
# Compression - pyzstd provides "import pyzstd" (jhsware fork uses pyzstd)
|
||||
pyzstd
|
||||
|
||||
# Data analysis
|
||||
numpy
|
||||
pandas
|
||||
scipy
|
||||
scikit-learn
|
||||
beiweForest # Custom package - provides "import forest"
|
||||
|
||||
# Other utilities
|
||||
requests
|
||||
rcssmin
|
||||
pypng
|
||||
pyqrcode
|
||||
|
||||
# Development/debugging
|
||||
ipython
|
||||
mypy
|
||||
]);
|
||||
|
||||
|
||||
in
|
||||
|
||||
stdenv.mkDerivation {
|
||||
pname = "beiwe-backend";
|
||||
version = rev;
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "jhsware"; # Fork with env var support for Celery
|
||||
repo = "beiwe-backend";
|
||||
inherit rev;
|
||||
hash = hashes.srcHash;
|
||||
};
|
||||
|
||||
buildInputs = [
|
||||
pythonEnv
|
||||
postgresql
|
||||
];
|
||||
|
||||
# No build phase needed - this is a Python application
|
||||
dontBuild = true;
|
||||
|
||||
# Patch Django settings to support DATABASE_SSLMODE environment variable
|
||||
# This allows controlling PostgreSQL SSL mode via environment variable
|
||||
postPatch = ''
|
||||
# Find the Django settings file and patch the database configuration
|
||||
# to include sslmode from environment variable
|
||||
|
||||
# Add sslmode support to database configuration
|
||||
# This sed command finds the DATABASES dict and adds OPTIONS with sslmode
|
||||
if [ -f config/django_settings.py ]; then
|
||||
echo "Patching config/django_settings.py for DATABASE_SSLMODE support..."
|
||||
|
||||
# Add import for os at the top if not already there
|
||||
if ! grep -q "^import os" config/django_settings.py; then
|
||||
sed -i '1i import os' config/django_settings.py
|
||||
fi
|
||||
|
||||
# Append code to add sslmode to database options at the end of the file
|
||||
cat >> config/django_settings.py << 'SSLPATCH'
|
||||
|
||||
# Patched by nix-infra-machine: Add DATABASE_SSLMODE support
|
||||
# This allows setting PostgreSQL sslmode via environment variable
|
||||
_db_sslmode = os.environ.get('DATABASE_SSLMODE', os.environ.get('PGSSLMODE', 'prefer'))
|
||||
if 'default' in DATABASES:
|
||||
if 'OPTIONS' not in DATABASES['default']:
|
||||
DATABASES['default']['OPTIONS'] = {}
|
||||
DATABASES['default']['OPTIONS']['sslmode'] = _db_sslmode
|
||||
SSLPATCH
|
||||
echo "Patched database settings for sslmode support"
|
||||
else
|
||||
echo "Warning: config/django_settings.py not found, skipping sslmode patch"
|
||||
fi
|
||||
'';
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
|
||||
# Create directory structure
|
||||
mkdir -p $out/lib/beiwe-backend
|
||||
mkdir -p $out/bin
|
||||
|
||||
# Copy all source files
|
||||
cp -r . $out/lib/beiwe-backend/
|
||||
|
||||
# Create wrapper scripts
|
||||
cat > $out/bin/beiwe-manage <<EOF
|
||||
#!/usr/bin/env bash
|
||||
cd $out/lib/beiwe-backend
|
||||
exec ${pythonEnv}/bin/python manage.py "\$@"
|
||||
EOF
|
||||
chmod +x $out/bin/beiwe-manage
|
||||
|
||||
cat > $out/bin/beiwe-gunicorn <<EOF
|
||||
#!/usr/bin/env bash
|
||||
cd $out/lib/beiwe-backend
|
||||
exec ${pythonEnv}/bin/gunicorn "\$@"
|
||||
EOF
|
||||
chmod +x $out/bin/beiwe-gunicorn
|
||||
|
||||
cat > $out/bin/beiwe-celery <<EOF
|
||||
#!/usr/bin/env bash
|
||||
cd $out/lib/beiwe-backend
|
||||
exec ${pythonEnv}/bin/celery "\$@"
|
||||
EOF
|
||||
chmod +x $out/bin/beiwe-celery
|
||||
|
||||
runHook postInstall
|
||||
'';
|
||||
|
||||
meta = {
|
||||
description = "Beiwe - smartphone-based digital phenotyping research platform backend";
|
||||
longDescription = ''
|
||||
The Beiwe Research Platform collects high-throughput smartphone-based
|
||||
digital phenotyping data including spatial trajectories (GPS), physical
|
||||
activity patterns (accelerometer/gyroscope), social networks and
|
||||
communication dynamics (call/text logs), and voice samples.
|
||||
|
||||
This package provides the Django-based backend server that supports:
|
||||
- Web-based study management portal
|
||||
- API endpoints for iOS/Android mobile apps
|
||||
- Data processing pipelines
|
||||
|
||||
This is the jhsware fork which adds environment variable support for
|
||||
Celery configuration (CELERY_MANAGER_IP and CELERY_PASSWORD).
|
||||
|
||||
Patched by nix-infra-machine to support DATABASE_SSLMODE environment
|
||||
variable for controlling PostgreSQL SSL mode.
|
||||
'';
|
||||
homepage = "https://github.com/jhsware/beiwe-backend";
|
||||
license = lib.licenses.bsd3;
|
||||
platforms = lib.platforms.unix;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,318 @@
|
||||
# CrowdSec Firewall Bouncer Module
|
||||
# Provides firewall-level IP blocking using iptables/nftables/ipset
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
appName = "crowdsec";
|
||||
cfg = config.infrastructure.${appName};
|
||||
stateDir = "/var/lib/crowdsec";
|
||||
yamlFormat = pkgs.formats.yaml {};
|
||||
in
|
||||
{
|
||||
# ==========================================================================
|
||||
# Options
|
||||
# ==========================================================================
|
||||
options.infrastructure.${appName} = {
|
||||
features.firewallBouncer = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Enable the firewall bouncer to automatically block malicious IPs.
|
||||
|
||||
The bouncer fetches decisions from the CrowdSec API and applies
|
||||
them to the system firewall (iptables/nftables). Available in
|
||||
nixpkgs as pkgs.crowdsec-firewall-bouncer starting from NixOS 25.11.
|
||||
|
||||
When using nftables mode (default), the module creates declarative
|
||||
nftables tables that integrate properly with NixOS's firewall and
|
||||
survive system rebuilds.
|
||||
|
||||
[NIS2 COMPLIANCE]
|
||||
Article 21(2)(b) - Incident Handling: Provides automated incident
|
||||
response by blocking identified threats in real-time.
|
||||
|
||||
Article 21(2)(d) - Network Security: Implements active network
|
||||
protection through automated firewall rule management.
|
||||
'';
|
||||
default = false;
|
||||
};
|
||||
|
||||
bouncer = {
|
||||
package = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.package;
|
||||
description = ''
|
||||
CrowdSec firewall bouncer package to use.
|
||||
|
||||
The package is available in nixpkgs as pkgs.crowdsec-firewall-bouncer
|
||||
starting from NixOS 25.11.
|
||||
|
||||
Set to null to disable the bouncer even when features.firewallBouncer
|
||||
is enabled (useful for testing detection without blocking).
|
||||
'';
|
||||
default = pkgs.crowdsec-firewall-bouncer or null;
|
||||
defaultText = lib.literalExpression "pkgs.crowdsec-firewall-bouncer";
|
||||
example = lib.literalExpression "pkgs.crowdsec-firewall-bouncer";
|
||||
};
|
||||
|
||||
mode = lib.mkOption {
|
||||
type = lib.types.enum [ "iptables" "nftables" "ipset" ];
|
||||
description = ''
|
||||
Firewall mode for the bouncer.
|
||||
|
||||
- "nftables": Recommended for NixOS. Uses nftables sets which integrate
|
||||
well with NixOS declarative firewall. The module creates the necessary
|
||||
tables/chains declaratively, and the bouncer only manages set membership.
|
||||
|
||||
- "iptables": Traditional iptables rules. May conflict with NixOS firewall
|
||||
on system rebuilds.
|
||||
|
||||
- "ipset": Uses ipset for IP blocking. More compatible with iptables-based
|
||||
firewalls and survives rule flushes better.
|
||||
|
||||
[NIS2 COMPLIANCE]
|
||||
All modes provide equivalent security protection. Choose based on your
|
||||
existing firewall infrastructure.
|
||||
'';
|
||||
default = "nftables";
|
||||
};
|
||||
|
||||
nftablesIntegration = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
When using nftables mode, declaratively create the CrowdSec table
|
||||
structure in NixOS configuration. This ensures the tables/chains
|
||||
survive NixOS rebuilds and prevents conflicts with the declarative
|
||||
firewall.
|
||||
|
||||
When enabled:
|
||||
- Creates "crowdsec" and "crowdsec6" tables declaratively
|
||||
- Configures bouncer in "set-only" mode
|
||||
- Bouncer only manages IP set membership, not table structure
|
||||
|
||||
When disabled:
|
||||
- Bouncer creates and manages its own tables
|
||||
- May conflict with NixOS firewall rebuilds
|
||||
'';
|
||||
default = true;
|
||||
};
|
||||
|
||||
denyAction = lib.mkOption {
|
||||
type = lib.types.enum [ "DROP" "REJECT" ];
|
||||
description = ''
|
||||
Action to take for blocked IPs.
|
||||
|
||||
- "DROP": Silently drop packets (recommended for security)
|
||||
- "REJECT": Send rejection response to client
|
||||
|
||||
DROP is generally preferred as it doesn't reveal firewall presence.
|
||||
'';
|
||||
default = "DROP";
|
||||
};
|
||||
|
||||
denyLog = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Log blocked connections before dropping/rejecting.
|
||||
|
||||
[NIS2 COMPLIANCE]
|
||||
Article 21(2)(g) - Security Monitoring: Maintains audit trail
|
||||
of blocked threats for incident analysis and reporting.
|
||||
'';
|
||||
default = true;
|
||||
};
|
||||
|
||||
denyLogPrefix = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Prefix for firewall log entries.";
|
||||
default = "crowdsec: ";
|
||||
};
|
||||
|
||||
banDuration = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Default ban duration for blocked IPs.
|
||||
|
||||
Format: Go duration string (e.g., "4h", "24h", "7d")
|
||||
'';
|
||||
default = "4h";
|
||||
example = "24h";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Configuration
|
||||
# ==========================================================================
|
||||
config = lib.mkIf (cfg.enable && cfg.features.firewallBouncer && cfg.bouncer.package != null) (
|
||||
let
|
||||
useNftablesIntegration = cfg.bouncer.mode == "nftables" && cfg.bouncer.nftablesIntegration;
|
||||
|
||||
# Bouncer config - uses set-only mode when nftablesIntegration is enabled
|
||||
bouncerConfigFile = yamlFormat.generate "crowdsec-firewall-bouncer.yaml" ({
|
||||
mode = cfg.bouncer.mode;
|
||||
update_frequency = "10s";
|
||||
api_url = "http://${cfg.api.listenAddr}:${toString cfg.api.listenPort}/";
|
||||
api_key = "\${BOUNCER_API_KEY}";
|
||||
disable_ipv6 = false;
|
||||
deny_action = cfg.bouncer.denyAction;
|
||||
deny_log = cfg.bouncer.denyLog;
|
||||
deny_log_prefix = cfg.bouncer.denyLogPrefix;
|
||||
} // lib.optionalAttrs (cfg.bouncer.mode == "nftables") {
|
||||
nftables = {
|
||||
ipv4 = {
|
||||
enabled = true;
|
||||
set-only = useNftablesIntegration;
|
||||
table = "crowdsec";
|
||||
chain = "crowdsec-chain";
|
||||
set = "crowdsec-blocklist";
|
||||
};
|
||||
ipv6 = {
|
||||
enabled = true;
|
||||
set-only = useNftablesIntegration;
|
||||
table = "crowdsec6";
|
||||
chain = "crowdsec6-chain";
|
||||
set = "crowdsec6-blocklist";
|
||||
};
|
||||
};
|
||||
} // lib.optionalAttrs (cfg.bouncer.mode == "iptables") {
|
||||
iptables_chains = [ "INPUT" "FORWARD" ];
|
||||
} // lib.optionalAttrs (cfg.bouncer.mode == "ipset") {
|
||||
ipset_type = "nethash";
|
||||
ipset = "crowdsec-blocklist";
|
||||
ipset6 = "crowdsec6-blocklist";
|
||||
});
|
||||
|
||||
bouncerRegisterScript = pkgs.writeShellScript "crowdsec-bouncer-register" ''
|
||||
set -e
|
||||
export PATH="${lib.makeBinPath [ cfg.package pkgs.coreutils pkgs.gnugrep pkgs.gnused ]}:$PATH"
|
||||
|
||||
CONFIG_DIR="${stateDir}/config"
|
||||
KEY_FILE="/var/lib/crowdsec-firewall-bouncer/api_key"
|
||||
|
||||
# Wait for CrowdSec API to be ready
|
||||
for i in $(seq 1 60); do
|
||||
if cscli -c "$CONFIG_DIR/config.yaml" bouncers list >/dev/null 2>&1; then
|
||||
break
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
|
||||
# Check if bouncer already registered
|
||||
if ! cscli -c "$CONFIG_DIR/config.yaml" bouncers list 2>/dev/null | grep -q "firewall-bouncer"; then
|
||||
# Register new bouncer and save key
|
||||
KEY=$(cscli -c "$CONFIG_DIR/config.yaml" bouncers add firewall-bouncer -o raw 2>/dev/null || echo "")
|
||||
if [ -n "$KEY" ]; then
|
||||
echo "$KEY" > "$KEY_FILE"
|
||||
chmod 600 "$KEY_FILE"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Read existing key
|
||||
if [ -f "$KEY_FILE" ]; then
|
||||
export BOUNCER_API_KEY=$(cat "$KEY_FILE")
|
||||
fi
|
||||
|
||||
# Generate config with key substituted
|
||||
# Use | as sed delimiter since API keys may contain /
|
||||
if [ -n "$BOUNCER_API_KEY" ]; then
|
||||
sed "s|\''${BOUNCER_API_KEY}|$BOUNCER_API_KEY|g" ${bouncerConfigFile} > /var/lib/crowdsec-firewall-bouncer/config.yaml
|
||||
fi
|
||||
'';
|
||||
|
||||
in lib.mkMerge [
|
||||
# Assertions
|
||||
{
|
||||
assertions = [
|
||||
{
|
||||
assertion = cfg.bouncer.package != null;
|
||||
message = ''
|
||||
CrowdSec firewall bouncer is enabled but no package is configured.
|
||||
|
||||
The bouncer package should be available as pkgs.crowdsec-firewall-bouncer
|
||||
on NixOS 25.11+. If using an older NixOS version, you may need to:
|
||||
|
||||
1. Upgrade to NixOS 25.11+
|
||||
2. Set infrastructure.crowdsec.features.firewallBouncer = false
|
||||
3. Provide the package from an external source
|
||||
'';
|
||||
}
|
||||
];
|
||||
|
||||
# Install CLI tools based on mode
|
||||
environment.systemPackages =
|
||||
lib.optionals (cfg.bouncer.mode == "nftables") [ pkgs.nftables ]
|
||||
++ lib.optionals (cfg.bouncer.mode == "iptables") [ pkgs.iptables ]
|
||||
++ lib.optionals (cfg.bouncer.mode == "ipset") [ pkgs.ipset ];
|
||||
}
|
||||
|
||||
# Declarative nftables Integration
|
||||
(lib.mkIf useNftablesIntegration {
|
||||
networking.nftables.enable = true;
|
||||
|
||||
networking.nftables.tables = {
|
||||
# IPv4 CrowdSec table
|
||||
crowdsec = {
|
||||
family = "ip";
|
||||
content = ''
|
||||
set crowdsec-blocklist {
|
||||
type ipv4_addr
|
||||
flags timeout
|
||||
}
|
||||
|
||||
chain crowdsec-chain {
|
||||
type filter hook input priority -1; policy accept;
|
||||
${lib.optionalString cfg.bouncer.denyLog ''
|
||||
ip saddr @crowdsec-blocklist log prefix "${cfg.bouncer.denyLogPrefix}"
|
||||
''}
|
||||
ip saddr @crowdsec-blocklist ${lib.toLower cfg.bouncer.denyAction}
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
# IPv6 CrowdSec table
|
||||
crowdsec6 = {
|
||||
family = "ip6";
|
||||
content = ''
|
||||
set crowdsec6-blocklist {
|
||||
type ipv6_addr
|
||||
flags timeout
|
||||
}
|
||||
|
||||
chain crowdsec6-chain {
|
||||
type filter hook input priority -1; policy accept;
|
||||
${lib.optionalString cfg.bouncer.denyLog ''
|
||||
ip6 saddr @crowdsec6-blocklist log prefix "${cfg.bouncer.denyLogPrefix}"
|
||||
''}
|
||||
ip6 saddr @crowdsec6-blocklist ${lib.toLower cfg.bouncer.denyAction}
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
})
|
||||
|
||||
# Tmpfiles and service
|
||||
{
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /var/lib/crowdsec-firewall-bouncer 0750 root root - -"
|
||||
];
|
||||
|
||||
# Firewall bouncer service
|
||||
systemd.services.crowdsec-firewall-bouncer = {
|
||||
description = "CrowdSec Firewall Bouncer";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" "crowdsec.service" ];
|
||||
requires = [ "crowdsec.service" ];
|
||||
|
||||
path = lib.optionals (cfg.bouncer.mode == "iptables") [ pkgs.iptables pkgs.ipset ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
ExecStartPre = "${bouncerRegisterScript}";
|
||||
ExecStart = "${cfg.bouncer.package}/bin/cs-firewall-bouncer -c /var/lib/crowdsec-firewall-bouncer/config.yaml";
|
||||
Restart = "always";
|
||||
RestartSec = "10s";
|
||||
};
|
||||
};
|
||||
}
|
||||
]
|
||||
);
|
||||
}
|
||||
@@ -0,0 +1,181 @@
|
||||
# CrowdSec HAProxy SPOA Bouncer Module
|
||||
# Provides application-layer protection via HAProxy Stream Processing Offload API
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
appName = "crowdsec";
|
||||
cfg = config.infrastructure.${appName};
|
||||
stateDir = "/var/lib/crowdsec";
|
||||
yamlFormat = pkgs.formats.yaml {};
|
||||
in
|
||||
{
|
||||
# ==========================================================================
|
||||
# Options
|
||||
# ==========================================================================
|
||||
options.infrastructure.${appName} = {
|
||||
features.haproxyProtection = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Enable HAProxy security integration via SPOA (Stream Processing Offload API).
|
||||
|
||||
The cs-haproxy-spoa-bouncer acts as a stream processing agent that checks
|
||||
each connection in real-time against CrowdSec's decision database before
|
||||
allowing traffic to reach your application servers.
|
||||
|
||||
This provides layer 7 application-level protection, complementing the
|
||||
layer 3/4 protection from the firewall bouncer.
|
||||
|
||||
[NIS2 COMPLIANCE]
|
||||
Article 21(2)(d) - Network Security: Provides application-layer protection
|
||||
for HTTP/HTTPS traffic through HAProxy integration.
|
||||
|
||||
Article 21(2)(e) - Supply Chain Security: Protects web applications that
|
||||
may be part of the digital supply chain.
|
||||
'';
|
||||
default = false;
|
||||
};
|
||||
|
||||
haproxy = {
|
||||
package = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.package;
|
||||
description = ''
|
||||
CrowdSec HAProxy SPOA bouncer package to use.
|
||||
|
||||
The package should be available as pkgs.cs-haproxy-spoa-bouncer.
|
||||
Set to null to disable the bouncer even when features.haproxyProtection
|
||||
is enabled.
|
||||
'';
|
||||
default = pkgs.cs-haproxy-spoa-bouncer or null;
|
||||
defaultText = lib.literalExpression "pkgs.cs-haproxy-spoa-bouncer";
|
||||
example = lib.literalExpression "pkgs.cs-haproxy-spoa-bouncer";
|
||||
};
|
||||
|
||||
listenAddr = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Address for the SPOA bouncer to listen on.
|
||||
HAProxy will connect to this address to check decisions.
|
||||
'';
|
||||
default = "127.0.0.1";
|
||||
example = "0.0.0.0";
|
||||
};
|
||||
|
||||
listenPort = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
description = "Port for the SPOA bouncer to listen on.";
|
||||
default = 3000;
|
||||
example = 3000;
|
||||
};
|
||||
|
||||
action = lib.mkOption {
|
||||
type = lib.types.enum [ "deny" "tarpit" ];
|
||||
description = ''
|
||||
Action to take for blocked requests in HAProxy.
|
||||
|
||||
- "deny": Immediately reject the connection
|
||||
- "tarpit": Slow down the connection (tar pit)
|
||||
'';
|
||||
default = "deny";
|
||||
};
|
||||
|
||||
logLevel = lib.mkOption {
|
||||
type = lib.types.enum [ "error" "warning" "info" "debug" ];
|
||||
description = "Log level for the SPOA bouncer.";
|
||||
default = "info";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Configuration
|
||||
# ==========================================================================
|
||||
config = lib.mkIf (cfg.enable && cfg.features.haproxyProtection && cfg.haproxy.package != null) (
|
||||
let
|
||||
# HAProxy SPOA bouncer config file
|
||||
haproxyBouncerConfigFile = yamlFormat.generate "crowdsec-haproxy-spoa-bouncer.yaml" {
|
||||
lapi_url = "http://${cfg.api.listenAddr}:${toString cfg.api.listenPort}";
|
||||
lapi_key = "\${HAPROXY_SPOA_API_KEY}";
|
||||
action = cfg.haproxy.action;
|
||||
log_level = cfg.haproxy.logLevel;
|
||||
listen_addr = cfg.haproxy.listenAddr;
|
||||
listen_port = cfg.haproxy.listenPort;
|
||||
update_frequency = "10s";
|
||||
};
|
||||
|
||||
haproxyBouncerRegisterScript = pkgs.writeShellScript "crowdsec-haproxy-bouncer-register" ''
|
||||
set -e
|
||||
export PATH="${lib.makeBinPath [ cfg.package pkgs.coreutils pkgs.gnugrep pkgs.gnused ]}:$PATH"
|
||||
|
||||
CONFIG_DIR="${stateDir}/config"
|
||||
KEY_FILE="/var/lib/crowdsec-haproxy-bouncer/api_key"
|
||||
|
||||
# Wait for CrowdSec API to be ready
|
||||
for i in $(seq 1 60); do
|
||||
if cscli -c "$CONFIG_DIR/config.yaml" bouncers list >/dev/null 2>&1; then
|
||||
break
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
|
||||
# Check if bouncer already registered
|
||||
if ! cscli -c "$CONFIG_DIR/config.yaml" bouncers list 2>/dev/null | grep -q "haproxy-spoa-bouncer"; then
|
||||
# Register new bouncer and save key
|
||||
KEY=$(cscli -c "$CONFIG_DIR/config.yaml" bouncers add haproxy-spoa-bouncer -o raw 2>/dev/null || echo "")
|
||||
if [ -n "$KEY" ]; then
|
||||
echo "$KEY" > "$KEY_FILE"
|
||||
chmod 600 "$KEY_FILE"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Read existing key
|
||||
if [ -f "$KEY_FILE" ]; then
|
||||
export HAPROXY_SPOA_API_KEY=$(cat "$KEY_FILE")
|
||||
fi
|
||||
|
||||
# Generate config with key substituted
|
||||
# Use | as sed delimiter since API keys may contain /
|
||||
if [ -n "$HAPROXY_SPOA_API_KEY" ]; then
|
||||
sed "s|\''${HAPROXY_SPOA_API_KEY}|$HAPROXY_SPOA_API_KEY|g" ${haproxyBouncerConfigFile} > /var/lib/crowdsec-haproxy-bouncer/config.yaml
|
||||
fi
|
||||
'';
|
||||
|
||||
in {
|
||||
# Assertions
|
||||
assertions = [
|
||||
{
|
||||
assertion = cfg.haproxy.package != null;
|
||||
message = ''
|
||||
CrowdSec HAProxy SPOA bouncer is enabled but no package is configured.
|
||||
|
||||
The bouncer package should be available as pkgs.cs-haproxy-spoa-bouncer.
|
||||
If the package is not available, you may need to:
|
||||
|
||||
1. Set infrastructure.crowdsec.features.haproxyProtection = false
|
||||
2. Provide the package from an external source
|
||||
'';
|
||||
}
|
||||
];
|
||||
|
||||
# Tmpfiles
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /var/lib/crowdsec-haproxy-bouncer 0750 root root - -"
|
||||
];
|
||||
|
||||
# HAProxy SPOA bouncer service
|
||||
systemd.services.crowdsec-haproxy-bouncer = {
|
||||
description = "CrowdSec HAProxy SPOA Bouncer";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" "crowdsec.service" ];
|
||||
requires = [ "crowdsec.service" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
ExecStartPre = "${haproxyBouncerRegisterScript}";
|
||||
ExecStart = "${cfg.haproxy.package}/bin/cs-haproxy-spoa-bouncer -c /var/lib/crowdsec-haproxy-bouncer/config.yaml";
|
||||
Restart = "always";
|
||||
RestartSec = "10s";
|
||||
};
|
||||
};
|
||||
}
|
||||
);
|
||||
}
|
||||
@@ -0,0 +1,313 @@
|
||||
# CrowdSec Python Bouncer Module
|
||||
# Provides API key registration for pycrowdsec and python-capi-sdk integration
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
appName = "crowdsec";
|
||||
cfg = config.infrastructure.${appName};
|
||||
stateDir = "/var/lib/crowdsec";
|
||||
in
|
||||
{
|
||||
# ==========================================================================
|
||||
# Options
|
||||
# ==========================================================================
|
||||
options.infrastructure.${appName}.python = {
|
||||
enable = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Enable Python bouncer registration for use with pycrowdsec.
|
||||
|
||||
This registers a bouncer with CrowdSec and stores the API key in a
|
||||
configurable location so Python applications can use the pycrowdsec
|
||||
library to check IPs against CrowdSec decisions.
|
||||
|
||||
Python applications should use the StreamClient or QueryClient from
|
||||
pycrowdsec to query decisions:
|
||||
|
||||
```python
|
||||
from pycrowdsec.client import StreamClient
|
||||
client = StreamClient(
|
||||
api_key=open("/run/crowdsec-python-bouncer/api_key").read().strip(),
|
||||
lapi_url="http://127.0.0.1:8080/"
|
||||
)
|
||||
client.run()
|
||||
action = client.get_action_for("1.2.3.4") # Returns "ban", "captcha", etc.
|
||||
```
|
||||
|
||||
For Flask/Django integration, configure the middleware to read the API key
|
||||
from the configured apiKeyFile path.
|
||||
|
||||
[NIS2 COMPLIANCE]
|
||||
Article 21(2)(d) - Network Security: Provides application-layer protection
|
||||
for Python web applications through CrowdSec integration.
|
||||
'';
|
||||
default = false;
|
||||
};
|
||||
|
||||
bouncerName = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Name to register the Python bouncer with in CrowdSec.";
|
||||
default = "python-bouncer";
|
||||
example = "my-flask-app-bouncer";
|
||||
};
|
||||
|
||||
apiKeyFile = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Path where the bouncer API key will be stored.
|
||||
|
||||
This file will be readable by the configured group (default: root).
|
||||
Python applications need read access to this file to authenticate
|
||||
with the CrowdSec Local API.
|
||||
'';
|
||||
default = "/run/crowdsec-python-bouncer/api_key";
|
||||
example = "/run/secrets/crowdsec-python-api-key";
|
||||
};
|
||||
|
||||
apiKeyFileGroup = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Group that should have read access to the API key file.
|
||||
|
||||
Set this to match the group your Python application runs as.
|
||||
For example, if your Flask app runs as user "flask" in group "flask",
|
||||
set this to "flask".
|
||||
'';
|
||||
default = "root";
|
||||
example = "www-data";
|
||||
};
|
||||
|
||||
enableCapi = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Enable Central API (CAPI) credentials for signal sharing with python-capi-sdk.
|
||||
|
||||
When enabled, this generates machine credentials that can be used with
|
||||
the python-capi-sdk to send attack signals to CrowdSec's central infrastructure
|
||||
and receive community blocklists.
|
||||
|
||||
The credentials are stored in the capiCredentialsFile location.
|
||||
|
||||
Example usage with python-capi-sdk:
|
||||
|
||||
```python
|
||||
from cscapi.client import CAPIClient, CAPIClientConfig
|
||||
from cscapi.sql_storage import SQLStorage
|
||||
import yaml
|
||||
|
||||
# Load credentials generated by this module
|
||||
with open("/run/crowdsec-python-bouncer/capi_credentials.yaml") as f:
|
||||
creds = yaml.safe_load(f)
|
||||
|
||||
client = CAPIClient(
|
||||
storage=SQLStorage(connection_string="sqlite:///signals.db"),
|
||||
config=CAPIClientConfig(scenarios=["crowdsecurity/ssh-bf"])
|
||||
)
|
||||
```
|
||||
|
||||
[NIS2 COMPLIANCE]
|
||||
Article 14 - Information Sharing: Enables participation in threat
|
||||
intelligence sharing through the CrowdSec community network.
|
||||
'';
|
||||
default = false;
|
||||
};
|
||||
|
||||
capiCredentialsFile = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Path where CAPI credentials will be stored for python-capi-sdk.
|
||||
|
||||
This file contains machine_id and password for authenticating
|
||||
with CrowdSec's Central API.
|
||||
'';
|
||||
default = "/run/crowdsec-python-bouncer/capi_credentials.yaml";
|
||||
example = "/run/secrets/crowdsec-capi-credentials.yaml";
|
||||
};
|
||||
|
||||
capiScenarios = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
description = ''
|
||||
Scenarios that your Python application will report signals for.
|
||||
|
||||
These should match the attack patterns your application detects.
|
||||
Common scenarios include:
|
||||
- crowdsecurity/ssh-bf (SSH brute force)
|
||||
- crowdsecurity/http-bf (HTTP brute force)
|
||||
- crowdsecurity/http-crawl-non_statics (Web crawling)
|
||||
'';
|
||||
default = [];
|
||||
example = [ "crowdsecurity/http-bf" "crowdsecurity/http-crawl-non_statics" ];
|
||||
};
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Configuration
|
||||
# ==========================================================================
|
||||
config = lib.mkIf (cfg.enable && cfg.python.enable) (
|
||||
let
|
||||
# Get the directory from the apiKeyFile path
|
||||
pythonBouncerDir = builtins.dirOf cfg.python.apiKeyFile;
|
||||
pythonCapiDir = builtins.dirOf cfg.python.capiCredentialsFile;
|
||||
|
||||
# Python bouncer registration script
|
||||
pythonBouncerRegisterScript = pkgs.writeShellScript "crowdsec-python-bouncer-register" ''
|
||||
set -e
|
||||
export PATH="${lib.makeBinPath [ cfg.package pkgs.coreutils pkgs.gnugrep pkgs.gnused ]}:$PATH"
|
||||
|
||||
CONFIG_DIR="${stateDir}/config"
|
||||
KEY_FILE="${cfg.python.apiKeyFile}"
|
||||
KEY_DIR="${pythonBouncerDir}"
|
||||
BOUNCER_NAME="${cfg.python.bouncerName}"
|
||||
KEY_GROUP="${cfg.python.apiKeyFileGroup}"
|
||||
|
||||
# Create directory if it doesn't exist
|
||||
mkdir -p "$KEY_DIR"
|
||||
|
||||
# Wait for CrowdSec API to be ready
|
||||
for i in $(seq 1 60); do
|
||||
if cscli -c "$CONFIG_DIR/config.yaml" bouncers list >/dev/null 2>&1; then
|
||||
break
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
|
||||
# Check if bouncer already registered
|
||||
if ! cscli -c "$CONFIG_DIR/config.yaml" bouncers list 2>/dev/null | grep -q "$BOUNCER_NAME"; then
|
||||
# Register new bouncer and save key
|
||||
KEY=$(cscli -c "$CONFIG_DIR/config.yaml" bouncers add "$BOUNCER_NAME" -o raw 2>/dev/null || echo "")
|
||||
if [ -n "$KEY" ]; then
|
||||
echo "$KEY" > "$KEY_FILE"
|
||||
# Set permissions: owner read/write, group read
|
||||
chmod 640 "$KEY_FILE"
|
||||
chown root:"$KEY_GROUP" "$KEY_FILE"
|
||||
echo "Python bouncer '$BOUNCER_NAME' registered successfully"
|
||||
echo "API key stored at: $KEY_FILE"
|
||||
fi
|
||||
else
|
||||
echo "Python bouncer '$BOUNCER_NAME' already registered"
|
||||
fi
|
||||
|
||||
# Create a helper config file for Python applications
|
||||
LAPI_URL="http://${cfg.api.listenAddr}:${toString cfg.api.listenPort}/"
|
||||
cat > "$KEY_DIR/config.yaml" << EOF
|
||||
# CrowdSec Python Bouncer Configuration
|
||||
# Generated by NixOS infrastructure.crowdsec module
|
||||
#
|
||||
# Usage with pycrowdsec:
|
||||
# from pycrowdsec.client import StreamClient
|
||||
# import yaml
|
||||
#
|
||||
# with open('${pythonBouncerDir}/config.yaml') as f:
|
||||
# config = yaml.safe_load(f)
|
||||
#
|
||||
# client = StreamClient(
|
||||
# api_key=open(config['api_key_file']).read().strip(),
|
||||
# lapi_url=config['lapi_url']
|
||||
# )
|
||||
# client.run()
|
||||
|
||||
lapi_url: "$LAPI_URL"
|
||||
api_key_file: "$KEY_FILE"
|
||||
bouncer_name: "$BOUNCER_NAME"
|
||||
EOF
|
||||
chmod 644 "$KEY_DIR/config.yaml"
|
||||
chown root:"$KEY_GROUP" "$KEY_DIR/config.yaml"
|
||||
'';
|
||||
|
||||
# Python CAPI credentials script (for python-capi-sdk signal sharing)
|
||||
pythonCapiRegisterScript = pkgs.writeShellScript "crowdsec-python-capi-register" ''
|
||||
set -e
|
||||
export PATH="${lib.makeBinPath [ cfg.package pkgs.coreutils pkgs.gnugrep pkgs.gnused pkgs.openssl ]}:$PATH"
|
||||
|
||||
CONFIG_DIR="${stateDir}/config"
|
||||
CAPI_FILE="${cfg.python.capiCredentialsFile}"
|
||||
CAPI_DIR="${pythonCapiDir}"
|
||||
KEY_GROUP="${cfg.python.apiKeyFileGroup}"
|
||||
|
||||
# Create directory if it doesn't exist
|
||||
mkdir -p "$CAPI_DIR"
|
||||
|
||||
# Generate unique machine ID based on hostname and a random component
|
||||
MACHINE_ID="python-$(hostname)-$(openssl rand -hex 4)"
|
||||
|
||||
# Generate a secure password
|
||||
MACHINE_PASSWORD=$(openssl rand -base64 32)
|
||||
|
||||
# Check if credentials already exist
|
||||
if [ -f "$CAPI_FILE" ]; then
|
||||
echo "CAPI credentials already exist at $CAPI_FILE"
|
||||
else
|
||||
# Create credentials file for python-capi-sdk
|
||||
cat > "$CAPI_FILE" << EOF
|
||||
# CrowdSec Central API Credentials for python-capi-sdk
|
||||
# Generated by NixOS infrastructure.crowdsec module
|
||||
#
|
||||
# Usage with python-capi-sdk:
|
||||
# from cscapi.client import CAPIClient, CAPIClientConfig
|
||||
# from cscapi.sql_storage import SQLStorage
|
||||
# from cscapi.utils import generate_machine_id_from_key
|
||||
# import yaml
|
||||
#
|
||||
# with open('${cfg.python.capiCredentialsFile}') as f:
|
||||
# creds = yaml.safe_load(f)
|
||||
#
|
||||
# client = CAPIClient(
|
||||
# storage=SQLStorage(connection_string="sqlite:///signals.db"),
|
||||
# config=CAPIClientConfig(
|
||||
# scenarios=${builtins.toJSON cfg.python.capiScenarios}
|
||||
# )
|
||||
# )
|
||||
#
|
||||
# # Note: Machine enrollment with CrowdSec CAPI requires manual approval
|
||||
# # Contact CrowdSec for signal sharing partnership details
|
||||
|
||||
machine_id: "$MACHINE_ID"
|
||||
password: "$MACHINE_PASSWORD"
|
||||
scenarios: ${builtins.toJSON cfg.python.capiScenarios}
|
||||
capi_url: "https://api.crowdsec.net/"
|
||||
|
||||
# Local API connection (for reading decisions)
|
||||
lapi_url: "http://${cfg.api.listenAddr}:${toString cfg.api.listenPort}/"
|
||||
EOF
|
||||
chmod 640 "$CAPI_FILE"
|
||||
chown root:"$KEY_GROUP" "$CAPI_FILE"
|
||||
echo "CAPI credentials generated at $CAPI_FILE"
|
||||
echo ""
|
||||
echo "NOTE: To share signals with CrowdSec CAPI, you need to:"
|
||||
echo "1. Contact CrowdSec for signal sharing partnership enrollment"
|
||||
echo "2. Use the machine_id from this file when enrolling"
|
||||
echo "3. Update your application to use the python-capi-sdk"
|
||||
fi
|
||||
'';
|
||||
|
||||
in {
|
||||
# Python bouncer registration service (oneshot - registers bouncer and stores API key)
|
||||
systemd.services.crowdsec-python-bouncer = {
|
||||
description = "CrowdSec Python Bouncer Registration";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" "crowdsec.service" ];
|
||||
requires = [ "crowdsec.service" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
ExecStart = "${pythonBouncerRegisterScript}";
|
||||
};
|
||||
};
|
||||
|
||||
# Python CAPI credentials service (oneshot - generates CAPI credentials for signal sharing)
|
||||
systemd.services.crowdsec-python-capi = lib.mkIf cfg.python.enableCapi {
|
||||
description = "CrowdSec Python CAPI Credentials Generation";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" "crowdsec.service" "crowdsec-python-bouncer.service" ];
|
||||
requires = [ "crowdsec.service" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
ExecStart = "${pythonCapiRegisterScript}";
|
||||
};
|
||||
};
|
||||
}
|
||||
);
|
||||
}
|
||||
@@ -0,0 +1,730 @@
|
||||
# CrowdSec - Collaborative Intrusion Prevention System
|
||||
#
|
||||
# This module provides simplified boolean feature toggles for common use cases
|
||||
# and can use either a custom implementation or the native NixOS module.
|
||||
#
|
||||
# Module structure:
|
||||
# - default.nix: Core CrowdSec engine and detection features
|
||||
# - bouncers/: Response modules (firewall, haproxy, python)
|
||||
# - integrations/: External system integrations (auditd, console)
|
||||
{ config, pkgs, lib, options, ... }:
|
||||
|
||||
let
|
||||
appName = "crowdsec";
|
||||
cfg = config.infrastructure.${appName};
|
||||
|
||||
# ==========================================================================
|
||||
# Version Detection (must not depend on cfg to avoid recursion)
|
||||
# ==========================================================================
|
||||
# Check if the native services.crowdsec module exists (NixOS 25.11+)
|
||||
hasNativeCrowdsecModule = options ? services && options.services ? crowdsec;
|
||||
|
||||
# The native module in NixOS 25.11 has multiple bugs that make it unusable:
|
||||
# - #445342: Missing sensible defaults, API server disabled by default
|
||||
# - #446764: Console enrollment broken
|
||||
# - #459224: Cannot enable local API
|
||||
# - Missing hub.postoverflows, hub.scenarios, hub.parsers options
|
||||
# - Null coercion errors in systemd service generation
|
||||
#
|
||||
# We mark the native module as unstable until these are fixed.
|
||||
# Users can override with implementation = "native" to test.
|
||||
nativeModuleIsStable = false;
|
||||
|
||||
# State directory for CrowdSec
|
||||
stateDir = "/var/lib/crowdsec";
|
||||
|
||||
# Helper to generate YAML format
|
||||
yamlFormat = pkgs.formats.yaml {};
|
||||
|
||||
in
|
||||
{
|
||||
# ==========================================================================
|
||||
# Import Sub-Modules
|
||||
# ==========================================================================
|
||||
imports = [
|
||||
# Bouncers - Response mechanisms
|
||||
./bouncers/firewall.nix
|
||||
./bouncers/haproxy.nix
|
||||
./bouncers/python.nix
|
||||
# Integrations - External system connections
|
||||
./integrations/auditd.nix
|
||||
./integrations/console.nix
|
||||
];
|
||||
|
||||
# ==========================================================================
|
||||
# Options
|
||||
# ==========================================================================
|
||||
options.infrastructure.${appName} = {
|
||||
enable = lib.mkEnableOption ''
|
||||
CrowdSec - Collaborative Intrusion Prevention System.
|
||||
|
||||
CrowdSec is an open-source security automation tool that detects and blocks
|
||||
malicious behavior by analyzing logs and sharing threat intelligence with
|
||||
the community.
|
||||
|
||||
This module provides simplified boolean feature toggles for common use cases
|
||||
and can use either a custom implementation or the native NixOS module.
|
||||
|
||||
[NIS2 COMPLIANCE]
|
||||
Article 21(2)(b) - Incident Handling: CrowdSec provides automated threat
|
||||
detection and response capabilities, helping organizations meet requirements
|
||||
for detecting, analyzing, and responding to cybersecurity incidents.
|
||||
|
||||
Article 21(2)(d) - Network Security: Acts as an Intrusion Detection/Prevention
|
||||
System (IDS/IPS), a core requirement for protecting network infrastructure.
|
||||
'';
|
||||
|
||||
implementation = lib.mkOption {
|
||||
type = lib.types.enum [ "auto" "native" "custom" ];
|
||||
description = ''
|
||||
Which implementation to use for CrowdSec.
|
||||
|
||||
- "auto": Automatically select based on NixOS version and module stability.
|
||||
Currently defaults to "custom" because the native module has bugs.
|
||||
- "native": Force use of NixOS's native services.crowdsec module.
|
||||
Requires NixOS 25.11+. May have bugs - use for testing only.
|
||||
- "custom": Use the custom implementation that manages its own systemd
|
||||
service. Works on all NixOS versions with the crowdsec package.
|
||||
|
||||
The native module in NixOS 25.11 has several known issues:
|
||||
- #445342: Missing sensible defaults
|
||||
- #446764: Console enrollment broken
|
||||
- #459224: Cannot enable local API
|
||||
|
||||
When these are fixed, "auto" will switch to using the native module.
|
||||
'';
|
||||
default = "auto";
|
||||
example = "custom";
|
||||
};
|
||||
|
||||
package = lib.mkOption {
|
||||
type = lib.types.package;
|
||||
description = "CrowdSec package to use.";
|
||||
default = pkgs.crowdsec;
|
||||
defaultText = lib.literalExpression "pkgs.crowdsec";
|
||||
};
|
||||
|
||||
logLevel = lib.mkOption {
|
||||
type = lib.types.enum [ "trace" "debug" "info" "warning" "error" "fatal" ];
|
||||
description = ''
|
||||
Log level for CrowdSec.
|
||||
|
||||
[NIS2 COMPLIANCE]
|
||||
Article 21(2)(g) - Security Monitoring: Appropriate logging level
|
||||
enables proper security event monitoring and incident investigation.
|
||||
'';
|
||||
default = "info";
|
||||
example = "debug";
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# API Configuration
|
||||
# ==========================================================================
|
||||
|
||||
api = {
|
||||
listenAddr = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Address for the CrowdSec Local API (LAPI) to listen on.
|
||||
Use "127.0.0.1" for local-only access or "0.0.0.0" for network access.
|
||||
'';
|
||||
default = "127.0.0.1";
|
||||
example = "0.0.0.0";
|
||||
};
|
||||
|
||||
listenPort = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
description = "Port for the CrowdSec Local API (LAPI) to listen on.";
|
||||
default = 8080;
|
||||
example = 8080;
|
||||
};
|
||||
|
||||
openFirewall = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Whether to open the firewall port for the CrowdSec API.
|
||||
Only needed if bouncers from other machines need to connect.
|
||||
'';
|
||||
default = false;
|
||||
};
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Detection Features (Simple Boolean Options)
|
||||
# ==========================================================================
|
||||
|
||||
features = {
|
||||
sshProtection = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Enable SSH brute-force detection and prevention.
|
||||
|
||||
Monitors SSH authentication logs to detect and block IP addresses
|
||||
attempting password guessing or credential stuffing attacks.
|
||||
|
||||
[NIS2 COMPLIANCE]
|
||||
Article 21(2)(i) - Human Resources Security: Protects authentication
|
||||
systems and helps prevent unauthorized access attempts.
|
||||
|
||||
Article 21(2)(j) - Access Control: Provides automated protection
|
||||
against credential-based attacks on administrative interfaces.
|
||||
'';
|
||||
default = true;
|
||||
};
|
||||
|
||||
nginxProtection = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Enable nginx/web server attack detection.
|
||||
|
||||
Monitors nginx access and error logs to detect web-based attacks
|
||||
including SQL injection, XSS, path traversal, and more.
|
||||
|
||||
[NIS2 COMPLIANCE]
|
||||
Article 21(2)(d) - Network Security: Provides web application
|
||||
firewall (WAF) capabilities to protect public-facing services.
|
||||
|
||||
Article 21(2)(e) - Supply Chain Security: Helps protect web
|
||||
services that may be part of the digital supply chain.
|
||||
'';
|
||||
default = false;
|
||||
};
|
||||
|
||||
nginxLogPaths = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
description = "Paths to nginx log files to monitor.";
|
||||
default = [ "/var/log/nginx/*.log" ];
|
||||
example = [ "/var/log/nginx/access.log" "/var/log/nginx/error.log" ];
|
||||
};
|
||||
|
||||
systemProtection = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Enable system/kernel-level threat detection.
|
||||
|
||||
Monitors kernel and system logs for suspicious activity including
|
||||
privilege escalation attempts and system abuse.
|
||||
|
||||
[NIS2 COMPLIANCE]
|
||||
Article 21(2)(a) - Risk Analysis: Provides continuous monitoring
|
||||
to identify and respond to system-level threats.
|
||||
|
||||
Article 21(2)(g) - Security Monitoring: Implements comprehensive
|
||||
security monitoring across the system infrastructure.
|
||||
'';
|
||||
default = false;
|
||||
};
|
||||
|
||||
communityBlocklists = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Enable community-contributed IP blocklists.
|
||||
|
||||
When enrolled in the CrowdSec Console, your instance can receive
|
||||
curated blocklists of known malicious IPs from the community.
|
||||
|
||||
[NIS2 COMPLIANCE]
|
||||
Article 21(2)(d) - Network Security: Leverages collective threat
|
||||
intelligence to proactively block known attackers.
|
||||
|
||||
Article 14 - Information Sharing: Participates in cybersecurity
|
||||
information sharing to improve collective defense.
|
||||
'';
|
||||
default = true;
|
||||
};
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Hub Configuration (Parsers, Scenarios, Collections)
|
||||
# ==========================================================================
|
||||
|
||||
hub = {
|
||||
collections = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
description = ''
|
||||
Additional CrowdSec Hub collections to install.
|
||||
|
||||
Collections bundle related parsers and scenarios together.
|
||||
Browse available collections at: https://hub.crowdsec.net/
|
||||
'';
|
||||
default = [];
|
||||
example = [ "crowdsecurity/apache2" "crowdsecurity/postfix" ];
|
||||
};
|
||||
|
||||
scenarios = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
description = ''
|
||||
Additional CrowdSec Hub scenarios to install.
|
||||
|
||||
Scenarios define detection rules for specific attack patterns.
|
||||
'';
|
||||
default = [];
|
||||
example = [ "crowdsecurity/http-bf-wordpress_bf" ];
|
||||
};
|
||||
|
||||
parsers = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
description = ''
|
||||
Additional CrowdSec Hub parsers to install.
|
||||
|
||||
Parsers extract structured data from log files.
|
||||
'';
|
||||
default = [];
|
||||
example = [ "crowdsecurity/docker-logs" ];
|
||||
};
|
||||
|
||||
postoverflows = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
description = "Additional post-overflow parsers to install.";
|
||||
default = [];
|
||||
example = [ "crowdsecurity/cdn-whitelist" ];
|
||||
};
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Custom Acquisitions
|
||||
# ==========================================================================
|
||||
|
||||
acquisitions = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.attrs;
|
||||
description = ''
|
||||
Additional log sources for CrowdSec to monitor.
|
||||
|
||||
Each acquisition defines a log source (file, journalctl, etc.)
|
||||
and the parser type to use.
|
||||
|
||||
[NIS2 COMPLIANCE]
|
||||
Article 21(2)(g) - Security Monitoring: Enables comprehensive
|
||||
log collection and monitoring across all systems.
|
||||
'';
|
||||
default = [];
|
||||
example = lib.literalExpression ''
|
||||
[
|
||||
{
|
||||
source = "journalctl";
|
||||
journalctl_filter = [ "_SYSTEMD_UNIT=postgresql.service" ];
|
||||
labels.type = "syslog";
|
||||
}
|
||||
{
|
||||
filenames = [ "/var/log/myapp/*.log" ];
|
||||
labels.type = "syslog";
|
||||
}
|
||||
]
|
||||
'';
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Pass-through Configuration
|
||||
# ==========================================================================
|
||||
|
||||
extraSettings = lib.mkOption {
|
||||
type = lib.types.attrsOf lib.types.anything;
|
||||
description = ''
|
||||
Extra settings merged into the CrowdSec configuration.
|
||||
For native implementation: merged into services.crowdsec.settings.
|
||||
For custom implementation: merged into the generated config.yaml.
|
||||
'';
|
||||
default = {};
|
||||
};
|
||||
|
||||
extraLocalConfig = lib.mkOption {
|
||||
type = lib.types.attrsOf lib.types.anything;
|
||||
description = ''
|
||||
Extra settings merged into the local configuration.
|
||||
For native implementation: merged into services.crowdsec.localConfig.
|
||||
For custom implementation: not currently used.
|
||||
'';
|
||||
default = {};
|
||||
};
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Configuration
|
||||
# ==========================================================================
|
||||
config = lib.mkIf cfg.enable (
|
||||
let
|
||||
# ========================================================================
|
||||
# All cfg-dependent values MUST be defined inside this let block
|
||||
# to avoid infinite recursion during module evaluation
|
||||
# ========================================================================
|
||||
|
||||
# Determine which implementation to use
|
||||
useNativeImplementation =
|
||||
if cfg.implementation == "native" then true
|
||||
else if cfg.implementation == "custom" then false
|
||||
else if cfg.implementation == "auto" then
|
||||
hasNativeCrowdsecModule && nativeModuleIsStable
|
||||
else false;
|
||||
|
||||
# Build acquisitions list based on enabled features
|
||||
acquisitions = lib.flatten [
|
||||
# SSH acquisition (journalctl-based)
|
||||
(lib.optional cfg.features.sshProtection {
|
||||
source = "journalctl";
|
||||
journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
|
||||
labels.type = "syslog";
|
||||
})
|
||||
# Nginx acquisition (log file-based)
|
||||
(lib.optional cfg.features.nginxProtection {
|
||||
filenames = cfg.features.nginxLogPaths;
|
||||
labels.type = "nginx";
|
||||
})
|
||||
# System/kernel logs acquisition
|
||||
(lib.optional cfg.features.systemProtection {
|
||||
source = "journalctl";
|
||||
journalctl_filter = [ "_TRANSPORT=kernel" ];
|
||||
labels.type = "syslog";
|
||||
})
|
||||
# Custom acquisitions from user
|
||||
cfg.acquisitions
|
||||
];
|
||||
|
||||
# Build hub collections list based on enabled features
|
||||
hubCollections = lib.flatten [
|
||||
(lib.optional cfg.features.sshProtection "crowdsecurity/sshd")
|
||||
(lib.optional cfg.features.nginxProtection "crowdsecurity/nginx")
|
||||
(lib.optional cfg.features.systemProtection "crowdsecurity/linux")
|
||||
cfg.hub.collections
|
||||
];
|
||||
|
||||
# ========================================================================
|
||||
# Custom Implementation: Configuration Files
|
||||
# ========================================================================
|
||||
|
||||
# Generate acquisitions file as multi-document YAML
|
||||
# CrowdSec expects each acquisition as a separate YAML document (separated by ---)
|
||||
# We use yamlFormat.generate for each acquisition and concatenate them
|
||||
acquisitionsFile = pkgs.writeText "acquisitions.yaml" (
|
||||
lib.concatMapStringsSep "\n---\n" (acq:
|
||||
builtins.readFile (yamlFormat.generate "acq.yaml" acq)
|
||||
) acquisitions
|
||||
);
|
||||
|
||||
# Generate simulation file (CrowdSec requires this)
|
||||
simulationFile = yamlFormat.generate "simulation.yaml" {
|
||||
simulation = false;
|
||||
exclusions = [];
|
||||
};
|
||||
|
||||
# Generate main config file (compatible with CrowdSec 1.7.x)
|
||||
configFile = yamlFormat.generate "config.yaml" {
|
||||
common = {
|
||||
daemonize = false;
|
||||
log_media = "stdout";
|
||||
log_level = cfg.logLevel;
|
||||
};
|
||||
config_paths = {
|
||||
config_dir = "${stateDir}/config";
|
||||
data_dir = "${stateDir}/data";
|
||||
hub_dir = "${stateDir}/hub";
|
||||
simulation_path = "${stateDir}/config/simulation.yaml";
|
||||
};
|
||||
crowdsec_service = {
|
||||
acquisition_path = "${stateDir}/config/acquisitions.yaml";
|
||||
parser_routines = 1;
|
||||
};
|
||||
cscli = {
|
||||
output = "human";
|
||||
};
|
||||
api = {
|
||||
client = {
|
||||
insecure_skip_verify = false;
|
||||
credentials_path = "${stateDir}/config/local_api_credentials.yaml";
|
||||
};
|
||||
server = {
|
||||
enable = true;
|
||||
listen_uri = "${cfg.api.listenAddr}:${toString cfg.api.listenPort}";
|
||||
profiles_path = "${stateDir}/config/profiles.yaml";
|
||||
online_client = {
|
||||
credentials_path = "${stateDir}/config/online_api_credentials.yaml";
|
||||
};
|
||||
};
|
||||
};
|
||||
db_config = {
|
||||
type = "sqlite";
|
||||
db_path = "${stateDir}/data/crowdsec.db";
|
||||
use_wal = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Generate profiles file (CrowdSec expects multi-document YAML format)
|
||||
# Use bouncer.banDuration if available, otherwise default to 4h
|
||||
banDuration = cfg.bouncer.banDuration or "4h";
|
||||
profilesFile = pkgs.writeText "profiles.yaml" ''
|
||||
name: default_ip_remediation
|
||||
filters:
|
||||
- Alert.Remediation == true && Alert.GetScope() == "Ip"
|
||||
decisions:
|
||||
- type: ban
|
||||
duration: ${banDuration}
|
||||
on_success: break
|
||||
'';
|
||||
|
||||
# Initialization script - sets up CrowdSec on first run
|
||||
initScript = pkgs.writeShellScript "crowdsec-init" ''
|
||||
set -e
|
||||
export PATH="${lib.makeBinPath [ cfg.package pkgs.coreutils pkgs.gnugrep pkgs.nettools pkgs.findutils ]}:$PATH"
|
||||
|
||||
STATE_DIR="${stateDir}"
|
||||
CONFIG_DIR="$STATE_DIR/config"
|
||||
DATA_DIR="$STATE_DIR/data"
|
||||
HUB_DIR="$STATE_DIR/hub"
|
||||
PACKAGE="${cfg.package}"
|
||||
|
||||
# Create directories
|
||||
mkdir -p "$CONFIG_DIR" "$DATA_DIR" "$HUB_DIR"
|
||||
|
||||
# Copy configuration files
|
||||
cp -f ${configFile} "$CONFIG_DIR/config.yaml"
|
||||
cp -f ${profilesFile} "$CONFIG_DIR/profiles.yaml"
|
||||
cp -f ${acquisitionsFile} "$CONFIG_DIR/acquisitions.yaml"
|
||||
cp -f ${simulationFile} "$CONFIG_DIR/simulation.yaml"
|
||||
|
||||
# Debug: Show acquisitions file content
|
||||
echo "Generated acquisitions.yaml:"
|
||||
cat "$CONFIG_DIR/acquisitions.yaml"
|
||||
echo ""
|
||||
|
||||
# Copy patterns directory from package (required for parser grok patterns)
|
||||
echo "Looking for patterns directory..."
|
||||
|
||||
# Try common locations
|
||||
PATTERNS_FOUND=0
|
||||
for PATTERNS_PATH in \
|
||||
"$PACKAGE/share/crowdsec/config/patterns" \
|
||||
"$PACKAGE/share/crowdsec/patterns" \
|
||||
"$PACKAGE/etc/crowdsec/patterns" \
|
||||
; do
|
||||
if [ -d "$PATTERNS_PATH" ]; then
|
||||
echo "Found patterns at: $PATTERNS_PATH"
|
||||
rm -rf "$CONFIG_DIR/patterns"
|
||||
cp -r "$PATTERNS_PATH" "$CONFIG_DIR/patterns"
|
||||
PATTERNS_FOUND=1
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
# If not found in common locations, search the entire package
|
||||
if [ "$PATTERNS_FOUND" = "0" ]; then
|
||||
echo "Searching for patterns directory in package..."
|
||||
PATTERNS_PATH=$(find "$PACKAGE" -type d -name "patterns" 2>/dev/null | head -1)
|
||||
if [ -n "$PATTERNS_PATH" ]; then
|
||||
echo "Found patterns at: $PATTERNS_PATH"
|
||||
rm -rf "$CONFIG_DIR/patterns"
|
||||
cp -r "$PATTERNS_PATH" "$CONFIG_DIR/patterns"
|
||||
PATTERNS_FOUND=1
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$PATTERNS_FOUND" = "0" ]; then
|
||||
echo "WARNING: Could not find patterns directory!"
|
||||
echo "Package contents:"
|
||||
ls -la "$PACKAGE/" || true
|
||||
ls -la "$PACKAGE/share/" || true
|
||||
ls -la "$PACKAGE/share/crowdsec/" 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# Initialize database if it doesn't exist
|
||||
if [ ! -f "$DATA_DIR/crowdsec.db" ]; then
|
||||
echo "Initializing CrowdSec database..."
|
||||
touch "$CONFIG_DIR/local_api_credentials.yaml"
|
||||
touch "$CONFIG_DIR/online_api_credentials.yaml"
|
||||
chmod 640 "$CONFIG_DIR/local_api_credentials.yaml"
|
||||
chmod 640 "$CONFIG_DIR/online_api_credentials.yaml"
|
||||
fi
|
||||
|
||||
# Generate machine ID if it doesn't exist
|
||||
if [ ! -f "$CONFIG_DIR/local_api_credentials.yaml" ] || [ ! -s "$CONFIG_DIR/local_api_credentials.yaml" ]; then
|
||||
echo "Registering local machine..."
|
||||
cscli -c "$CONFIG_DIR/config.yaml" machines add "$(hostname)" --auto --force || true
|
||||
fi
|
||||
|
||||
# Update hub index
|
||||
echo "Updating hub index..."
|
||||
cscli -c "$CONFIG_DIR/config.yaml" hub update || true
|
||||
|
||||
# Set correct ownership
|
||||
chown -R crowdsec:crowdsec "$STATE_DIR"
|
||||
'';
|
||||
|
||||
# Hub installation script (runs after service is started)
|
||||
hubInstallScript = pkgs.writeShellScript "crowdsec-hub-install" ''
|
||||
set -e
|
||||
export PATH="${lib.makeBinPath [ cfg.package pkgs.coreutils pkgs.gnugrep ]}:$PATH"
|
||||
|
||||
CONFIG_DIR="${stateDir}/config"
|
||||
|
||||
# Wait for API to be ready
|
||||
for i in $(seq 1 30); do
|
||||
if cscli -c "$CONFIG_DIR/config.yaml" hub list >/dev/null 2>&1; then
|
||||
break
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
|
||||
# Install collections
|
||||
${lib.concatMapStringsSep "\n" (c: ''
|
||||
if ! cscli -c "$CONFIG_DIR/config.yaml" collections list 2>/dev/null | grep -q "${c}"; then
|
||||
cscli -c "$CONFIG_DIR/config.yaml" collections install ${c} || true
|
||||
fi
|
||||
'') hubCollections}
|
||||
|
||||
# Install additional scenarios
|
||||
${lib.concatMapStringsSep "\n" (s: ''
|
||||
if ! cscli -c "$CONFIG_DIR/config.yaml" scenarios list 2>/dev/null | grep -q "${s}"; then
|
||||
cscli -c "$CONFIG_DIR/config.yaml" scenarios install ${s} || true
|
||||
fi
|
||||
'') cfg.hub.scenarios}
|
||||
|
||||
# Install additional parsers
|
||||
${lib.concatMapStringsSep "\n" (p: ''
|
||||
if ! cscli -c "$CONFIG_DIR/config.yaml" parsers list 2>/dev/null | grep -q "${p}"; then
|
||||
cscli -c "$CONFIG_DIR/config.yaml" parsers install ${p} || true
|
||||
fi
|
||||
'') cfg.hub.parsers}
|
||||
'';
|
||||
|
||||
in lib.mkMerge [
|
||||
|
||||
# ==========================================================================
|
||||
# Common Configuration (both implementations)
|
||||
# ==========================================================================
|
||||
{
|
||||
# Assertions
|
||||
assertions = [
|
||||
{
|
||||
assertion = acquisitions != [];
|
||||
message = ''
|
||||
CrowdSec requires at least one acquisition source.
|
||||
|
||||
Enable at least one of:
|
||||
- infrastructure.crowdsec.features.sshProtection = true
|
||||
- infrastructure.crowdsec.features.nginxProtection = true
|
||||
- infrastructure.crowdsec.features.systemProtection = true
|
||||
|
||||
Or add custom acquisitions via infrastructure.crowdsec.acquisitions
|
||||
'';
|
||||
}
|
||||
{
|
||||
assertion = cfg.implementation != "native" || hasNativeCrowdsecModule;
|
||||
message = ''
|
||||
CrowdSec native implementation requires NixOS 25.11 or later.
|
||||
|
||||
Either:
|
||||
1. Upgrade to NixOS 25.11+
|
||||
2. Set infrastructure.crowdsec.implementation = "custom"
|
||||
3. Set infrastructure.crowdsec.implementation = "auto" (recommended)
|
||||
'';
|
||||
}
|
||||
];
|
||||
|
||||
# Open firewall for LAPI if configured
|
||||
networking.firewall.allowedTCPPorts =
|
||||
lib.mkIf cfg.api.openFirewall [ cfg.api.listenPort ];
|
||||
|
||||
# Install useful CLI tools
|
||||
environment.systemPackages = [
|
||||
cfg.package # Includes cscli
|
||||
];
|
||||
}
|
||||
|
||||
# ==========================================================================
|
||||
# Custom Implementation
|
||||
# ==========================================================================
|
||||
(lib.mkIf (!useNativeImplementation) {
|
||||
# Create crowdsec user and group
|
||||
users.users.crowdsec = {
|
||||
isSystemUser = true;
|
||||
group = "crowdsec";
|
||||
home = stateDir;
|
||||
description = "CrowdSec daemon user";
|
||||
};
|
||||
users.groups.crowdsec = {};
|
||||
|
||||
# Ensure data directories exist and create config symlink for cscli
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${stateDir} 0755 crowdsec crowdsec - -"
|
||||
"d ${stateDir}/config 0755 crowdsec crowdsec - -"
|
||||
"d ${stateDir}/data 0755 crowdsec crowdsec - -"
|
||||
"d ${stateDir}/hub 0755 crowdsec crowdsec - -"
|
||||
# Create /etc/crowdsec directory and symlink for cscli default config path
|
||||
"L+ /etc/crowdsec/config.yaml - - - - ${stateDir}/config/config.yaml"
|
||||
];
|
||||
|
||||
# Main CrowdSec service
|
||||
systemd.services.crowdsec = {
|
||||
description = "CrowdSec Security Engine";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" "local-fs.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
User = "crowdsec";
|
||||
Group = "crowdsec";
|
||||
ExecStartPre = [
|
||||
"+${initScript}" # Run as root for permissions
|
||||
];
|
||||
ExecStart = "${cfg.package}/bin/crowdsec -c ${stateDir}/config/config.yaml";
|
||||
ExecStartPost = "${hubInstallScript}";
|
||||
Restart = "always";
|
||||
RestartSec = "10s";
|
||||
|
||||
# Security hardening
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
PrivateTmp = true;
|
||||
NoNewPrivileges = true;
|
||||
ReadWritePaths = [ stateDir ];
|
||||
|
||||
# Allow journal access for systemd log sources
|
||||
SupplementaryGroups = lib.optional (cfg.features.sshProtection || cfg.features.systemProtection) "systemd-journal";
|
||||
};
|
||||
};
|
||||
})
|
||||
|
||||
# ==========================================================================
|
||||
# Native Implementation (NixOS 25.11+)
|
||||
# ==========================================================================
|
||||
(lib.mkIf (useNativeImplementation && hasNativeCrowdsecModule) {
|
||||
# Workarounds for native module bugs
|
||||
systemd.tmpfiles.rules = [
|
||||
# WORKAROUND #445342: Create state directory
|
||||
# WORKAROUND #446764: Create online_api_credentials.yaml
|
||||
"f /var/lib/crowdsec/online_api_credentials.yaml 0640 crowdsec crowdsec - -"
|
||||
];
|
||||
|
||||
services.crowdsec = {
|
||||
enable = true;
|
||||
package = cfg.package;
|
||||
|
||||
# Hub items to install (only collections - other options may not exist)
|
||||
hub = {
|
||||
collections = hubCollections;
|
||||
};
|
||||
|
||||
# Local configuration (acquisitions)
|
||||
localConfig = {
|
||||
inherit acquisitions;
|
||||
} // cfg.extraLocalConfig;
|
||||
|
||||
# Main settings
|
||||
settings = lib.mkMerge [
|
||||
{
|
||||
# WORKAROUND: BUG #445342 - Enable API server by default
|
||||
general.api.server.enable = true;
|
||||
}
|
||||
|
||||
# Console enrollment (if configured)
|
||||
# Note: console options are defined in integrations/console.nix
|
||||
(lib.mkIf (cfg.console.enrollKeyFile != null) {
|
||||
console.tokenFile = cfg.console.enrollKeyFile;
|
||||
})
|
||||
|
||||
# User's extra settings
|
||||
cfg.extraSettings
|
||||
];
|
||||
};
|
||||
})
|
||||
]
|
||||
);
|
||||
}
|
||||
@@ -0,0 +1,87 @@
|
||||
# CrowdSec Auditd Integration Module
|
||||
# Provides kernel-level security event monitoring via Linux Audit Framework
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
appName = "crowdsec";
|
||||
cfg = config.infrastructure.${appName};
|
||||
in
|
||||
{
|
||||
# ==========================================================================
|
||||
# Options
|
||||
# ==========================================================================
|
||||
options.infrastructure.${appName}.auditd = {
|
||||
enable = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Enable auditd integration with CrowdSec.
|
||||
|
||||
When enabled, configures auditd to send audit events to CrowdSec
|
||||
for analysis. This enables detection of:
|
||||
- Privilege escalation attempts
|
||||
- Unauthorized file access
|
||||
- System call anomalies
|
||||
- User authentication events
|
||||
|
||||
[NIS2 COMPLIANCE]
|
||||
Article 21(2)(g) - Security Monitoring: Provides kernel-level
|
||||
visibility into security events and potential threats.
|
||||
'';
|
||||
default = false;
|
||||
};
|
||||
|
||||
rules = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
description = ''
|
||||
Additional auditd rules to configure for CrowdSec monitoring.
|
||||
|
||||
These rules are added to the system's auditd configuration.
|
||||
|
||||
Common rules for security monitoring:
|
||||
- File integrity: "-w /etc/passwd -p wa -k identity"
|
||||
- Privilege escalation: "-w /usr/bin/sudo -p x -k privilege"
|
||||
- Network configuration: "-w /etc/hosts -p wa -k network"
|
||||
'';
|
||||
default = [];
|
||||
example = [
|
||||
"-w /etc/passwd -p wa -k identity"
|
||||
"-w /etc/shadow -p wa -k identity"
|
||||
"-w /etc/sudoers -p wa -k privilege"
|
||||
];
|
||||
};
|
||||
|
||||
nixWrappersWhitelistProcess = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
description = ''
|
||||
List of process names to whitelist from auditd monitoring.
|
||||
|
||||
NOTE: This feature is currently disabled due to compatibility issues
|
||||
with the 'comm' field filter in some versions of auditd. The option
|
||||
is preserved for future use when auditd compatibility is resolved.
|
||||
|
||||
NixOS uses wrapper scripts in /run/wrappers/bin for setuid/setgid
|
||||
programs (like sudo, ping, etc.). These wrappers can generate a lot
|
||||
of noise in auditd logs.
|
||||
|
||||
[NIS2 COMPLIANCE]
|
||||
Article 21(2)(g) - Security Monitoring: Reduces audit log noise
|
||||
while maintaining security visibility on critical processes.
|
||||
'';
|
||||
default = [];
|
||||
example = [ "sshd" "systemd" "sudo" ];
|
||||
};
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Configuration
|
||||
# ==========================================================================
|
||||
config = lib.mkIf (cfg.enable && cfg.auditd.enable) {
|
||||
# Enable the Linux Audit daemon
|
||||
security.auditd.enable = true;
|
||||
|
||||
# Add user-defined audit rules
|
||||
# Note: The nixWrappersWhitelistProcess feature is currently disabled
|
||||
# due to auditd compatibility issues with the 'comm' field filter
|
||||
security.audit.rules = cfg.auditd.rules;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,97 @@
|
||||
# CrowdSec Console Integration Module
|
||||
# Provides cloud enrollment and community threat intelligence sharing
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
appName = "crowdsec";
|
||||
cfg = config.infrastructure.${appName};
|
||||
in
|
||||
{
|
||||
# ==========================================================================
|
||||
# Options
|
||||
# ==========================================================================
|
||||
options.infrastructure.${appName}.console = {
|
||||
enrollKeyFile = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
description = ''
|
||||
Path to file containing the CrowdSec Console enrollment key.
|
||||
|
||||
Enrolling connects your instance to the CrowdSec Console for:
|
||||
- Centralized monitoring and management
|
||||
- Access to community and commercial blocklists
|
||||
- Threat intelligence dashboards
|
||||
- Alert visualization and analytics
|
||||
|
||||
Get your enrollment key from: https://app.crowdsec.net/
|
||||
|
||||
The enrollment key should be stored securely, for example using
|
||||
agenix or sops-nix for secrets management.
|
||||
|
||||
[NIS2 COMPLIANCE]
|
||||
Article 21(2)(g) - Security Monitoring: Provides centralized
|
||||
visibility into security events across infrastructure.
|
||||
|
||||
Article 23 - Reporting: Facilitates incident documentation
|
||||
and reporting through centralized logging.
|
||||
'';
|
||||
default = null;
|
||||
example = "/run/secrets/crowdsec-enroll-key";
|
||||
};
|
||||
|
||||
shareDecisions = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Share your detected threats with the CrowdSec community.
|
||||
|
||||
When enabled, anonymized attack signals are shared to improve
|
||||
collective threat intelligence for all CrowdSec users. This is
|
||||
a key part of CrowdSec's collaborative security model.
|
||||
|
||||
Shared data includes:
|
||||
- Source IP addresses of attacks
|
||||
- Attack type/scenario that triggered
|
||||
- Timestamp of the attack
|
||||
|
||||
Personal data and log contents are NOT shared.
|
||||
|
||||
[NIS2 COMPLIANCE]
|
||||
Article 14 - Information Sharing: Contributes to EU-wide
|
||||
cybersecurity by participating in threat intelligence sharing.
|
||||
'';
|
||||
default = true;
|
||||
};
|
||||
|
||||
name = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
description = ''
|
||||
Custom name for this instance in the CrowdSec Console.
|
||||
|
||||
If not set, the hostname will be used. Useful for identifying
|
||||
machines in multi-server deployments.
|
||||
'';
|
||||
default = null;
|
||||
example = "web-server-01";
|
||||
};
|
||||
|
||||
tags = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
description = ''
|
||||
Tags to apply to this instance in the CrowdSec Console.
|
||||
|
||||
Tags help organize and filter machines in the console dashboard.
|
||||
'';
|
||||
default = [];
|
||||
example = [ "production" "web-tier" "eu-west" ];
|
||||
};
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Configuration
|
||||
# ==========================================================================
|
||||
# Note: The actual console enrollment is handled by the main module
|
||||
# since it requires integration with both native and custom implementations.
|
||||
# This module only defines the options.
|
||||
#
|
||||
# For native implementation: settings are passed to services.crowdsec.settings
|
||||
# For custom implementation: enrollment is done via cscli in the init script
|
||||
}
|
||||
@@ -0,0 +1,423 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
appName = "n8n";
|
||||
defaultPort = 5678;
|
||||
|
||||
cfg = config.infrastructure.${appName};
|
||||
|
||||
# Build the custom n8n package with version selection
|
||||
n8nPackage = if cfg.package != null then cfg.package else
|
||||
pkgs.callPackage ./package.nix {
|
||||
version = cfg.version;
|
||||
buildMemoryMB = cfg.buildMemoryMB;
|
||||
};
|
||||
|
||||
# Environment variables for n8n configuration
|
||||
n8nEnvironment = {
|
||||
# Network settings
|
||||
N8N_PORT = toString cfg.bindToPort;
|
||||
N8N_LISTEN_ADDRESS = cfg.bindToIp;
|
||||
|
||||
# Execution settings
|
||||
EXECUTIONS_DATA_PRUNE = if cfg.executions.pruneData then "true" else "false";
|
||||
EXECUTIONS_DATA_MAX_AGE = toString cfg.executions.pruneDataMaxAge;
|
||||
EXECUTIONS_DATA_PRUNE_MAX_COUNT = toString cfg.executions.pruneDataMaxCount;
|
||||
} // (lib.optionalAttrs (cfg.webhookUrl != "") {
|
||||
# Webhook URL (if specified)
|
||||
WEBHOOK_URL = cfg.webhookUrl;
|
||||
}) // (lib.optionalAttrs (cfg.database.type == "postgresdb") {
|
||||
# Database settings (only set if using PostgreSQL)
|
||||
DB_TYPE = "postgresdb";
|
||||
DB_POSTGRESDB_HOST = cfg.database.postgresdb.host;
|
||||
DB_POSTGRESDB_PORT = toString cfg.database.postgresdb.port;
|
||||
DB_POSTGRESDB_DATABASE = cfg.database.postgresdb.database;
|
||||
DB_POSTGRESDB_USER = cfg.database.postgresdb.user;
|
||||
}) // (lib.optionalAttrs (cfg.database.type == "postgresdb" && cfg.database.postgresdb.ssl) {
|
||||
DB_POSTGRESDB_SSL_ENABLED = "true";
|
||||
}) // cfg.settings;
|
||||
in
|
||||
{
|
||||
options.infrastructure.${appName} = {
|
||||
enable = lib.mkEnableOption "infrastructure.n8n";
|
||||
|
||||
# ==========================================================================
|
||||
# Package and Version Configuration
|
||||
# ==========================================================================
|
||||
|
||||
version = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
n8n version to install.
|
||||
|
||||
Supported versions are defined in package.nix. To add a new version,
|
||||
you need to compute the source and pnpm dependency hashes.
|
||||
|
||||
See package.nix for instructions on adding new versions.
|
||||
'';
|
||||
default = "2.1.5";
|
||||
example = "1.120.4";
|
||||
};
|
||||
|
||||
package = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.package;
|
||||
description = ''
|
||||
Custom n8n package to use. If null, the package will be built
|
||||
using the version specified in 'version' option.
|
||||
|
||||
Use this to provide a completely custom n8n build.
|
||||
'';
|
||||
default = null;
|
||||
example = lib.literalExpression "pkgs.n8n";
|
||||
};
|
||||
|
||||
buildMemoryMB = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
description = ''
|
||||
Maximum Node.js heap size in MB for building n8n.
|
||||
Increase this if you encounter "JavaScript heap out of memory" errors during build.
|
||||
'';
|
||||
default = 4096;
|
||||
example = 8192;
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Network Configuration
|
||||
# ==========================================================================
|
||||
|
||||
bindToIp = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "IP address to bind n8n to.";
|
||||
default = "127.0.0.1";
|
||||
example = "0.0.0.0";
|
||||
};
|
||||
|
||||
bindToPort = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
description = "Port for n8n web interface.";
|
||||
default = defaultPort;
|
||||
};
|
||||
|
||||
openFirewall = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = "Open firewall for n8n.";
|
||||
default = false;
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Webhook Configuration
|
||||
# ==========================================================================
|
||||
|
||||
webhookUrl = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
WEBHOOK_URL for n8n, used when running behind a reverse proxy.
|
||||
This is the external URL where webhooks can reach n8n.
|
||||
'';
|
||||
default = "";
|
||||
example = "https://n8n.example.com/";
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Data Directory
|
||||
# ==========================================================================
|
||||
|
||||
dataDir = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "Directory where n8n data is stored.";
|
||||
default = "/var/lib/n8n";
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Database Configuration
|
||||
# ==========================================================================
|
||||
database = {
|
||||
type = lib.mkOption {
|
||||
type = lib.types.enum [ "sqlite" "postgresdb" ];
|
||||
description = "Database type to use. SQLite is default, PostgreSQL recommended for production.";
|
||||
default = "sqlite";
|
||||
};
|
||||
|
||||
postgresdb = {
|
||||
host = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "PostgreSQL host.";
|
||||
default = "localhost";
|
||||
example = "/run/postgresql";
|
||||
};
|
||||
|
||||
port = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
description = "PostgreSQL port.";
|
||||
default = 5432;
|
||||
};
|
||||
|
||||
database = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "PostgreSQL database name.";
|
||||
default = "n8n";
|
||||
};
|
||||
|
||||
user = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "PostgreSQL user.";
|
||||
default = "n8n";
|
||||
};
|
||||
|
||||
passwordSecretName = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
description = ''
|
||||
Name of the secret containing the PostgreSQL password.
|
||||
The secret should be placed at /run/secrets/<n>.
|
||||
If null, peer/socket authentication is assumed.
|
||||
'';
|
||||
default = null;
|
||||
example = "n8n-db-password";
|
||||
};
|
||||
|
||||
ssl = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = "Enable SSL for PostgreSQL connection.";
|
||||
default = false;
|
||||
};
|
||||
|
||||
createLocally = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Whether to create the database user locally.
|
||||
This requires PostgreSQL to be running locally with trust or peer authentication.
|
||||
The database itself should be created via infrastructure.postgresql.initialDatabases.
|
||||
'';
|
||||
default = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
# ==========================================================================
|
||||
# Execution Configuration
|
||||
# ==========================================================================
|
||||
|
||||
executions = {
|
||||
pruneData = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = "Enable automatic pruning of old execution data.";
|
||||
default = true;
|
||||
};
|
||||
|
||||
pruneDataMaxAge = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
description = "Maximum age of execution data in hours before pruning.";
|
||||
default = 336; # 14 days
|
||||
};
|
||||
|
||||
pruneDataMaxCount = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
description = "Maximum number of executions to keep.";
|
||||
default = 10000;
|
||||
};
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# n8n Settings (pass-through as environment variables)
|
||||
# ==========================================================================
|
||||
|
||||
settings = lib.mkOption {
|
||||
type = lib.types.attrsOf lib.types.anything;
|
||||
description = ''
|
||||
Additional n8n configuration as environment variables.
|
||||
These are passed directly to the n8n service.
|
||||
See https://docs.n8n.io/hosting/environment-variables/environment-variables/
|
||||
'';
|
||||
default = {};
|
||||
example = lib.literalExpression ''
|
||||
{
|
||||
GENERIC_TIMEZONE = "Europe/London";
|
||||
WORKFLOWS_DEFAULT_NAME = "My Workflow";
|
||||
N8N_METRICS = "true";
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
|
||||
# ==========================================================================
|
||||
# Reverse Proxy Configuration
|
||||
# ==========================================================================
|
||||
|
||||
reverseProxy = {
|
||||
enable = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = "Enable nginx reverse proxy for n8n.";
|
||||
default = false;
|
||||
};
|
||||
|
||||
hostName = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Hostname for the reverse proxy.";
|
||||
default = "localhost";
|
||||
example = "n8n.example.com";
|
||||
};
|
||||
|
||||
ssl = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
description = "Enable SSL/HTTPS for the reverse proxy.";
|
||||
default = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# ==========================================================================
|
||||
# Disable the native n8n service (we'll configure our own systemd service)
|
||||
# ==========================================================================
|
||||
|
||||
# Do NOT enable services.n8n - we create our own service to have full control
|
||||
|
||||
# ==========================================================================
|
||||
# n8n User and Group
|
||||
# ==========================================================================
|
||||
|
||||
users.users.n8n = {
|
||||
isSystemUser = true;
|
||||
group = "n8n";
|
||||
home = cfg.dataDir;
|
||||
createHome = true;
|
||||
description = "n8n service user";
|
||||
};
|
||||
|
||||
users.groups.n8n = {};
|
||||
|
||||
# ==========================================================================
|
||||
# n8n Systemd Service
|
||||
# ==========================================================================
|
||||
|
||||
systemd.services.n8n = {
|
||||
description = "n8n - Workflow Automation";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ] ++
|
||||
lib.optionals cfg.reverseProxy.enable [ "nginx.service" ] ++
|
||||
lib.optionals (cfg.database.type == "postgresdb" && cfg.database.postgresdb.createLocally) [
|
||||
"postgresql.service"
|
||||
"n8n-db-setup.service"
|
||||
];
|
||||
wants = lib.optionals (cfg.database.type == "postgresdb" && cfg.database.postgresdb.createLocally) [
|
||||
"n8n-db-setup.service"
|
||||
];
|
||||
requires = lib.optionals (cfg.database.type == "postgresdb" && cfg.database.postgresdb.createLocally) [
|
||||
"postgresql.service"
|
||||
];
|
||||
|
||||
environment = n8nEnvironment;
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
User = "n8n";
|
||||
Group = "n8n";
|
||||
WorkingDirectory = cfg.dataDir;
|
||||
ExecStart = "${n8nPackage}/bin/n8n";
|
||||
Restart = "on-failure";
|
||||
RestartSec = "5s";
|
||||
|
||||
# Hardening
|
||||
NoNewPrivileges = true;
|
||||
PrivateTmp = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
ReadWritePaths = [ cfg.dataDir ];
|
||||
};
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Nginx Reverse Proxy (Optional)
|
||||
# ==========================================================================
|
||||
|
||||
services.nginx = lib.mkIf cfg.reverseProxy.enable {
|
||||
enable = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = cfg.reverseProxy.ssl;
|
||||
|
||||
virtualHosts.${cfg.reverseProxy.hostName} = {
|
||||
forceSSL = cfg.reverseProxy.ssl;
|
||||
enableACME = cfg.reverseProxy.ssl;
|
||||
|
||||
locations."/" = {
|
||||
proxyPass = "http://${cfg.bindToIp}:${toString cfg.bindToPort}";
|
||||
proxyWebsockets = true;
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_buffering off;
|
||||
chunked_transfer_encoding off;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# Firewall Configuration
|
||||
# ==========================================================================
|
||||
|
||||
networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall (
|
||||
[ cfg.bindToPort ] ++
|
||||
(lib.optionals cfg.reverseProxy.enable [ 80 443 ])
|
||||
);
|
||||
|
||||
# ==========================================================================
|
||||
# Service Dependencies
|
||||
# ==========================================================================
|
||||
|
||||
systemd.services.nginx = lib.mkIf cfg.reverseProxy.enable {
|
||||
wants = [ "n8n.service" ];
|
||||
};
|
||||
|
||||
# ==========================================================================
|
||||
# PostgreSQL Database Setup (Optional)
|
||||
# ==========================================================================
|
||||
|
||||
systemd.services.n8n-db-setup = lib.mkIf (cfg.database.type == "postgresdb" && cfg.database.postgresdb.createLocally) {
|
||||
description = "Create n8n database user";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "postgresql.service" ];
|
||||
requires = [ "postgresql.service" ];
|
||||
before = [ "n8n.service" ];
|
||||
requiredBy = [ "n8n.service" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
User = "postgres";
|
||||
};
|
||||
script = let
|
||||
dbUser = cfg.database.postgresdb.user;
|
||||
dbName = cfg.database.postgresdb.database;
|
||||
dbHost = cfg.database.postgresdb.host;
|
||||
dbPort = toString cfg.database.postgresdb.port;
|
||||
in ''
|
||||
# Wait for PostgreSQL to be ready
|
||||
until ${pkgs.postgresql}/bin/pg_isready -h ${dbHost} -p ${dbPort}; do
|
||||
sleep 1
|
||||
done
|
||||
|
||||
# Create database user if it doesn't exist
|
||||
${pkgs.postgresql}/bin/psql -h ${dbHost} -p ${dbPort} -c "SELECT 1 FROM pg_roles WHERE rolname='${dbUser}'" | grep -q 1 || \
|
||||
${pkgs.postgresql}/bin/psql -h ${dbHost} -p ${dbPort} -c "CREATE USER ${dbUser}"
|
||||
|
||||
# Grant privileges on database
|
||||
${pkgs.postgresql}/bin/psql -h ${dbHost} -p ${dbPort} -c "GRANT ALL PRIVILEGES ON DATABASE ${dbName} TO ${dbUser}"
|
||||
${pkgs.postgresql}/bin/psql -h ${dbHost} -p ${dbPort} -d ${dbName} -c "GRANT ALL ON SCHEMA public TO ${dbUser}"
|
||||
'';
|
||||
};
|
||||
|
||||
|
||||
# ==========================================================================
|
||||
# Utilities
|
||||
# ==========================================================================
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
curl
|
||||
jq
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,176 @@
|
||||
# Custom n8n package with version selection
|
||||
# Based on: https://github.com/NixOS/nixpkgs/blob/nixos-25.11/pkgs/by-name/n8/n8n/package.nix
|
||||
#
|
||||
# To add a new version:
|
||||
# 1. Get the source hash:
|
||||
# nix-prefetch-url --unpack https://github.com/n8n-io/n8n/archive/refs/tags/n8n@VERSION.tar.gz
|
||||
# 2. Get the pnpm deps hash by running a build with lib.fakeHash and copying the correct hash from error
|
||||
# 3. Add entry to versionHashes below
|
||||
|
||||
{
|
||||
lib,
|
||||
stdenv,
|
||||
fetchFromGitHub,
|
||||
nodejs,
|
||||
pnpm_10,
|
||||
fetchPnpmDeps,
|
||||
pnpmConfigHook,
|
||||
python3,
|
||||
node-gyp,
|
||||
cctools,
|
||||
xcbuild,
|
||||
libkrb5,
|
||||
libmongocrypt,
|
||||
libpq,
|
||||
makeWrapper,
|
||||
# Custom parameters
|
||||
version ? "2.1.5",
|
||||
buildMemoryMB ? 4096,
|
||||
}:
|
||||
|
||||
let
|
||||
# Known version hashes
|
||||
# To add a new version, run:
|
||||
# nix-prefetch-url --unpack https://github.com/n8n-io/n8n/archive/refs/tags/n8n@VERSION.tar.gz
|
||||
# Then build with lib.fakeHash for pnpmDepsHash to get the correct hash
|
||||
versionHashes = {
|
||||
"2.1.5" = {
|
||||
srcHash = "sha256-/MPY3j/2I3CgX5rRhzj3v7bHjaQEDMNnkVfk3taCrYA=";
|
||||
pnpmDepsHash = "sha256-FRoZIINONy0kFPQAJhOwnCUv7HHwdgqm3r5SJmq4UYk=";
|
||||
};
|
||||
"2.1.4" = {
|
||||
srcHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
|
||||
pnpmDepsHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
|
||||
};
|
||||
"2.0.0" = {
|
||||
srcHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
|
||||
pnpmDepsHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
|
||||
};
|
||||
"1.120.4" = {
|
||||
srcHash = "sha256-gUqQM/eA7GnvFYiduSGkj/MCvgWNQPhDLExAJz67bHg=";
|
||||
pnpmDepsHash = "sha256-UWiN3NvI8We16KwY5JspyX0ok1PJWVg0T5zw+0SnrWk=";
|
||||
};
|
||||
"1.91.3" = {
|
||||
srcHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
|
||||
pnpmDepsHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
|
||||
};
|
||||
};
|
||||
|
||||
# Get hashes for the requested version
|
||||
hashes = versionHashes.${version} or (throw ''
|
||||
n8n version ${version} is not supported.
|
||||
|
||||
Supported versions: ${builtins.concatStringsSep ", " (builtins.attrNames versionHashes)}
|
||||
|
||||
To add support for version ${version}:
|
||||
1. Get source hash: nix-prefetch-url --unpack https://github.com/n8n-io/n8n/archive/refs/tags/n8n@${version}.tar.gz
|
||||
2. Add entry to versionHashes in app_modules/_unstable/n8n/package.nix
|
||||
3. Build once with placeholder pnpmDepsHash to get the correct hash from the error message
|
||||
'');
|
||||
|
||||
in
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "n8n";
|
||||
inherit version;
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "n8n-io";
|
||||
repo = "n8n";
|
||||
tag = "n8n@${finalAttrs.version}";
|
||||
hash = hashes.srcHash;
|
||||
};
|
||||
|
||||
pnpmDeps = fetchPnpmDeps {
|
||||
inherit (finalAttrs) pname version src;
|
||||
pnpm = pnpm_10;
|
||||
fetcherVersion = 2;
|
||||
hash = hashes.pnpmDepsHash;
|
||||
};
|
||||
|
||||
nativeBuildInputs = [
|
||||
pnpmConfigHook
|
||||
pnpm_10
|
||||
python3 # required to build sqlite3 bindings
|
||||
node-gyp # required to build sqlite3 bindings
|
||||
makeWrapper
|
||||
] ++ lib.optionals stdenv.hostPlatform.isDarwin [
|
||||
cctools
|
||||
xcbuild
|
||||
];
|
||||
|
||||
buildInputs = [
|
||||
nodejs
|
||||
libkrb5
|
||||
libmongocrypt
|
||||
libpq
|
||||
];
|
||||
|
||||
# Set memory limit for Node.js during build
|
||||
env = {
|
||||
NODE_OPTIONS = "--max-old-space-size=${toString buildMemoryMB}";
|
||||
};
|
||||
|
||||
buildPhase = ''
|
||||
runHook preBuild
|
||||
|
||||
pushd node_modules/sqlite3
|
||||
node-gyp rebuild
|
||||
popd
|
||||
|
||||
# TODO: use deploy after resolved https://github.com/pnpm/pnpm/issues/5315
|
||||
pnpm build --filter=n8n
|
||||
|
||||
runHook postBuild
|
||||
'';
|
||||
|
||||
preInstall = ''
|
||||
echo "Removing non-deterministic and unnecessary files"
|
||||
|
||||
find -type d -name .turbo -exec rm -rf {} +
|
||||
rm node_modules/.modules.yaml
|
||||
rm -f packages/nodes-base/dist/types/nodes.json
|
||||
|
||||
CI=true pnpm --ignore-scripts prune --prod
|
||||
find -type f \( -name "*.ts" -o -name "*.map" \) -exec rm -rf {} +
|
||||
rm -rf node_modules/.pnpm/{typescript*,prettier*}
|
||||
shopt -s globstar
|
||||
# https://github.com/pnpm/pnpm/issues/3645
|
||||
find node_modules packages/**/node_modules -xtype l -delete
|
||||
|
||||
echo "Removed non-deterministic and unnecessary files"
|
||||
'';
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
|
||||
mkdir -p $out/{bin,lib/n8n}
|
||||
mv {packages,node_modules} $out/lib/n8n
|
||||
|
||||
makeWrapper $out/lib/n8n/packages/cli/bin/n8n $out/bin/n8n \
|
||||
--set N8N_RELEASE_TYPE "stable"
|
||||
|
||||
runHook postInstall
|
||||
'';
|
||||
|
||||
# this package has ~80000 files, these take too long and seem to be unnecessary
|
||||
dontStrip = true;
|
||||
dontPatchELF = true;
|
||||
dontRewriteSymlinks = true;
|
||||
|
||||
meta = {
|
||||
description = "Free and source-available fair-code licensed workflow automation tool";
|
||||
longDescription = ''
|
||||
Free and source-available fair-code licensed workflow automation tool.
|
||||
Easily automate tasks across different services.
|
||||
'';
|
||||
homepage = "https://n8n.io";
|
||||
changelog = "https://github.com/n8n-io/n8n/releases/tag/n8n@${finalAttrs.version}";
|
||||
maintainers = with lib.maintainers; [
|
||||
gepbird
|
||||
AdrienLemaire
|
||||
];
|
||||
license = lib.licenses.sustainableUse;
|
||||
mainProgram = "n8n";
|
||||
platforms = lib.platforms.unix;
|
||||
};
|
||||
})
|
||||
Reference in New Issue
Block a user