Add nix-infra-machine

2026-09-18 10:32:55 +02:00 · 2026-03-15 18:31:53 +01:00
parent 28ea6f4a47
commit 1034986fa1
79 changed files with 14465 additions and 0 deletions
@@ -0,0 +1,97 @@
+# CrowdSec Console Integration Module
+# Provides cloud enrollment and community threat intelligence sharing
+{ config, pkgs, lib, ... }:
+
+let
+  appName = "crowdsec";
+  cfg = config.infrastructure.${appName};
+in
+{
+  # ==========================================================================
+  # Options
+  # ==========================================================================
+  options.infrastructure.${appName}.console = {
+    enrollKeyFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      description = ''
+        Path to file containing the CrowdSec Console enrollment key.
+        
+        Enrolling connects your instance to the CrowdSec Console for:
+        - Centralized monitoring and management
+        - Access to community and commercial blocklists
+        - Threat intelligence dashboards
+        - Alert visualization and analytics
+        
+        Get your enrollment key from: https://app.crowdsec.net/
+        
+        The enrollment key should be stored securely, for example using
+        agenix or sops-nix for secrets management.
+        
+        [NIS2 COMPLIANCE]
+        Article 21(2)(g) - Security Monitoring: Provides centralized
+        visibility into security events across infrastructure.
+        
+        Article 23 - Reporting: Facilitates incident documentation
+        and reporting through centralized logging.
+      '';
+      default = null;
+      example = "/run/secrets/crowdsec-enroll-key";
+    };
+
+    shareDecisions = lib.mkOption {
+      type = lib.types.bool;
+      description = ''
+        Share your detected threats with the CrowdSec community.
+        
+        When enabled, anonymized attack signals are shared to improve
+        collective threat intelligence for all CrowdSec users. This is
+        a key part of CrowdSec's collaborative security model.
+        
+        Shared data includes:
+        - Source IP addresses of attacks
+        - Attack type/scenario that triggered
+        - Timestamp of the attack
+        
+        Personal data and log contents are NOT shared.
+        
+        [NIS2 COMPLIANCE]
+        Article 14 - Information Sharing: Contributes to EU-wide
+        cybersecurity by participating in threat intelligence sharing.
+      '';
+      default = true;
+    };
+
+    name = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      description = ''
+        Custom name for this instance in the CrowdSec Console.
+        
+        If not set, the hostname will be used. Useful for identifying
+        machines in multi-server deployments.
+      '';
+      default = null;
+      example = "web-server-01";
+    };
+
+    tags = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = ''
+        Tags to apply to this instance in the CrowdSec Console.
+        
+        Tags help organize and filter machines in the console dashboard.
+      '';
+      default = [];
+      example = [ "production" "web-tier" "eu-west" ];
+    };
+  };
+
+  # ==========================================================================
+  # Configuration
+  # ==========================================================================
+  # Note: The actual console enrollment is handled by the main module
+  # since it requires integration with both native and custom implementations.
+  # This module only defines the options.
+  #
+  # For native implementation: settings are passed to services.crowdsec.settings
+  # For custom implementation: enrollment is done via cscli in the init script
+}