Add nix-infra-machine

nix-infra-machine/app_modules/_unstable/crowdsec/integrations/auditd.nix

@@ -0,0 +1,87 @@
+# CrowdSec Auditd Integration Module
+# Provides kernel-level security event monitoring via Linux Audit Framework
+{ config, pkgs, lib, ... }:
+
+let
+  appName = "crowdsec";
+  cfg = config.infrastructure.${appName};
+in
+{
+  # ==========================================================================
+  # Options
+  # ==========================================================================
+  options.infrastructure.${appName}.auditd = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      description = ''
+        Enable auditd integration with CrowdSec.
+        
+        When enabled, configures auditd to send audit events to CrowdSec
+        for analysis. This enables detection of:
+        - Privilege escalation attempts
+        - Unauthorized file access
+        - System call anomalies
+        - User authentication events
+        
+        [NIS2 COMPLIANCE]
+        Article 21(2)(g) - Security Monitoring: Provides kernel-level
+        visibility into security events and potential threats.
+      '';
+      default = false;
+    };
+
+    rules = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = ''
+        Additional auditd rules to configure for CrowdSec monitoring.
+        
+        These rules are added to the system's auditd configuration.
+        
+        Common rules for security monitoring:
+        - File integrity: "-w /etc/passwd -p wa -k identity"
+        - Privilege escalation: "-w /usr/bin/sudo -p x -k privilege"
+        - Network configuration: "-w /etc/hosts -p wa -k network"
+      '';
+      default = [];
+      example = [
+        "-w /etc/passwd -p wa -k identity"
+        "-w /etc/shadow -p wa -k identity"
+        "-w /etc/sudoers -p wa -k privilege"
+      ];
+    };
+
+    nixWrappersWhitelistProcess = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = ''
+        List of process names to whitelist from auditd monitoring.
+        
+        NOTE: This feature is currently disabled due to compatibility issues
+        with the 'comm' field filter in some versions of auditd. The option
+        is preserved for future use when auditd compatibility is resolved.
+        
+        NixOS uses wrapper scripts in /run/wrappers/bin for setuid/setgid
+        programs (like sudo, ping, etc.). These wrappers can generate a lot
+        of noise in auditd logs.
+        
+        [NIS2 COMPLIANCE]
+        Article 21(2)(g) - Security Monitoring: Reduces audit log noise
+        while maintaining security visibility on critical processes.
+      '';
+      default = [];
+      example = [ "sshd" "systemd" "sudo" ];
+    };
+  };
+
+  # ==========================================================================
+  # Configuration
+  # ==========================================================================
+  config = lib.mkIf (cfg.enable && cfg.auditd.enable) {
+    # Enable the Linux Audit daemon
+    security.auditd.enable = true;
+    
+    # Add user-defined audit rules
+    # Note: The nixWrappersWhitelistProcess feature is currently disabled
+    # due to auditd compatibility issues with the 'comm' field filter
+    security.audit.rules = cfg.auditd.rules;
+  };
+}

nix-infra-machine/app_modules/_unstable/crowdsec/integrations/console.nix

@@ -0,0 +1,97 @@
+# CrowdSec Console Integration Module
+# Provides cloud enrollment and community threat intelligence sharing
+{ config, pkgs, lib, ... }:
+
+let
+  appName = "crowdsec";
+  cfg = config.infrastructure.${appName};
+in
+{
+  # ==========================================================================
+  # Options
+  # ==========================================================================
+  options.infrastructure.${appName}.console = {
+    enrollKeyFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      description = ''
+        Path to file containing the CrowdSec Console enrollment key.
+        
+        Enrolling connects your instance to the CrowdSec Console for:
+        - Centralized monitoring and management
+        - Access to community and commercial blocklists
+        - Threat intelligence dashboards
+        - Alert visualization and analytics
+        
+        Get your enrollment key from: https://app.crowdsec.net/
+        
+        The enrollment key should be stored securely, for example using
+        agenix or sops-nix for secrets management.
+        
+        [NIS2 COMPLIANCE]
+        Article 21(2)(g) - Security Monitoring: Provides centralized
+        visibility into security events across infrastructure.
+        
+        Article 23 - Reporting: Facilitates incident documentation
+        and reporting through centralized logging.
+      '';
+      default = null;
+      example = "/run/secrets/crowdsec-enroll-key";
+    };
+
+    shareDecisions = lib.mkOption {
+      type = lib.types.bool;
+      description = ''
+        Share your detected threats with the CrowdSec community.
+        
+        When enabled, anonymized attack signals are shared to improve
+        collective threat intelligence for all CrowdSec users. This is
+        a key part of CrowdSec's collaborative security model.
+        
+        Shared data includes:
+        - Source IP addresses of attacks
+        - Attack type/scenario that triggered
+        - Timestamp of the attack
+        
+        Personal data and log contents are NOT shared.
+        
+        [NIS2 COMPLIANCE]
+        Article 14 - Information Sharing: Contributes to EU-wide
+        cybersecurity by participating in threat intelligence sharing.
+      '';
+      default = true;
+    };
+
+    name = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      description = ''
+        Custom name for this instance in the CrowdSec Console.
+        
+        If not set, the hostname will be used. Useful for identifying
+        machines in multi-server deployments.
+      '';
+      default = null;
+      example = "web-server-01";
+    };
+
+    tags = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = ''
+        Tags to apply to this instance in the CrowdSec Console.
+        
+        Tags help organize and filter machines in the console dashboard.
+      '';
+      default = [];
+      example = [ "production" "web-tier" "eu-west" ];
+    };
+  };
+
+  # ==========================================================================
+  # Configuration
+  # ==========================================================================
+  # Note: The actual console enrollment is handled by the main module
+  # since it requires integration with both native and custom implementations.
+  # This module only defines the options.
+  #
+  # For native implementation: settings are passed to services.crowdsec.settings
+  # For custom implementation: enrollment is done via cscli in the init script
+}