mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-09-17 18:22:54 +02:00
Ruben Hensen
98 lines
3.4 KiB
Nix
98 lines
3.4 KiB
Nix
# CrowdSec Console Integration Module
|
|
# Provides cloud enrollment and community threat intelligence sharing
|
|
{ config, pkgs, lib, ... }:
|
|
|
|
let
|
|
appName = "crowdsec";
|
|
cfg = config.infrastructure.${appName};
|
|
in
|
|
{
|
|
# ==========================================================================
|
|
# Options
|
|
# ==========================================================================
|
|
options.infrastructure.${appName}.console = {
|
|
enrollKeyFile = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.str;
|
|
description = ''
|
|
Path to file containing the CrowdSec Console enrollment key.
|
|
|
|
Enrolling connects your instance to the CrowdSec Console for:
|
|
- Centralized monitoring and management
|
|
- Access to community and commercial blocklists
|
|
- Threat intelligence dashboards
|
|
- Alert visualization and analytics
|
|
|
|
Get your enrollment key from: https://app.crowdsec.net/
|
|
|
|
The enrollment key should be stored securely, for example using
|
|
agenix or sops-nix for secrets management.
|
|
|
|
[NIS2 COMPLIANCE]
|
|
Article 21(2)(g) - Security Monitoring: Provides centralized
|
|
visibility into security events across infrastructure.
|
|
|
|
Article 23 - Reporting: Facilitates incident documentation
|
|
and reporting through centralized logging.
|
|
'';
|
|
default = null;
|
|
example = "/run/secrets/crowdsec-enroll-key";
|
|
};
|
|
|
|
shareDecisions = lib.mkOption {
|
|
type = lib.types.bool;
|
|
description = ''
|
|
Share your detected threats with the CrowdSec community.
|
|
|
|
When enabled, anonymized attack signals are shared to improve
|
|
collective threat intelligence for all CrowdSec users. This is
|
|
a key part of CrowdSec's collaborative security model.
|
|
|
|
Shared data includes:
|
|
- Source IP addresses of attacks
|
|
- Attack type/scenario that triggered
|
|
- Timestamp of the attack
|
|
|
|
Personal data and log contents are NOT shared.
|
|
|
|
[NIS2 COMPLIANCE]
|
|
Article 14 - Information Sharing: Contributes to EU-wide
|
|
cybersecurity by participating in threat intelligence sharing.
|
|
'';
|
|
default = true;
|
|
};
|
|
|
|
name = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.str;
|
|
description = ''
|
|
Custom name for this instance in the CrowdSec Console.
|
|
|
|
If not set, the hostname will be used. Useful for identifying
|
|
machines in multi-server deployments.
|
|
'';
|
|
default = null;
|
|
example = "web-server-01";
|
|
};
|
|
|
|
tags = lib.mkOption {
|
|
type = lib.types.listOf lib.types.str;
|
|
description = ''
|
|
Tags to apply to this instance in the CrowdSec Console.
|
|
|
|
Tags help organize and filter machines in the console dashboard.
|
|
'';
|
|
default = [];
|
|
example = [ "production" "web-tier" "eu-west" ];
|
|
};
|
|
};
|
|
|
|
# ==========================================================================
|
|
# Configuration
|
|
# ==========================================================================
|
|
# Note: The actual console enrollment is handled by the main module
|
|
# since it requires integration with both native and custom implementations.
|
|
# This module only defines the options.
|
|
#
|
|
# For native implementation: settings are passed to services.crowdsec.settings
|
|
# For custom implementation: enrollment is done via cscli in the init script
|
|
}
|