From 64530944b826db682de4a2b1cc09e4dc8f3d3145 Mon Sep 17 00:00:00 2001
From: Adam0 <alumail@protonmail.com>
Date: Sat, 06 Jun 2026 16:49:33 +0000
Subject: [PATCH] experimental

---
 modules/services/crowdsec.nix | 82 +++++++++++++++++++++++++++++++++++++++++++++++++++-------------------------------
 modules/services/traefik.nix | 4 ++--
 modules/desktop/noctalia/wallpaper.nix | 10 +---------
 modules/hosts/euclid/default.nix | 2 +-
 modules/profiles/stylix/base.nix | 6 +++++-
 5 file(s) changed, 60 insertion(s)(+), 44 deletion(s)(-)

diff --git a/modules/services/crowdsec.nix b/modules/services/crowdsec.nix
--- a/modules/services/crowdsec.nix
+++ b/modules/services/crowdsec.nix
@@ -18,16 +18,7 @@
       ;
   };
 
-  flake.modules.nixos.crowdsec = {
-    # keep-sorted start
-    config,
-    pkgs,
-    self,
-    # keep-sorted end
-    ...
-  }: let
-    dataDir = "/var/lib/crowdsec/data";
-  in {
+  flake.modules.nixos.crowdsec-base = {self, ...}: {
     nixpkgs.overlays = [self.overlays.crowdsec];
 
     disabledModules = [
@@ -43,13 +34,6 @@
       "${inputs.nixpkgs-crowdsec}/nixos/modules/services/security/crowdsec.nix"
       # keep-sorted end
     ];
-
-    sops.secrets = {
-      # keep-sorted start
-      "crowdsec/console_enroll_key" = {};
-      "traefik/crowdsec_bouncer_key" = {};
-      # keep-sorted end
-    };
 
     services.crowdsec = {
       enable = true;
@@ -71,35 +55,69 @@
 
       settings = {
         acquisitions = [
-          {
-            journalctl_filter = ["_SYSTEMD_UNIT=sshd.service"];
-            labels.type = "syslog";
-            source = "journalctl";
-          }
-          {
-            filenames = ["/var/log/traefik/*.log"];
-            labels.type = "traefik";
-            source = "file";
-          }
+          # keep-sorted start block=yes newline_separated=yes
           {
             appsec_configs = ["crowdsecurity/appsec-default"];
             labels.type = "appsec";
             listen_addr = "127.0.0.1:7424";
             source = "appsec";
           }
+
+          {
+            filenames = ["/var/log/traefik/*.log"];
+            labels.type = "traefik";
+            source = "file";
+          }
+
+          {
+            journalctl_filter = ["_SYSTEMD_UNIT=sshd.service"];
+            labels.type = "syslog";
+            source = "journalctl";
+          }
+          # keep-sorted end
         ];
+      };
+    };
+  };
 
-        config.api.server.online_client.credentials_path = "${dataDir}/online_api_credentials.yaml";
+  flake.modules.nixos.crowdsec-agent = {self, ...}: {
+    imports = [self.modules.nixos.crowdsec-base];
 
-        config.db_config = {
+    services.crowdsec.settings.config.api.server.enable = false;
+  };
+
+  flake.modules.nixos.crowdsec-server = {
+    # keep-sorted start
+    config,
+    pkgs,
+    self,
+    # keep-sorted end
+    ...
+  }: let
+    dataDir = "/var/lib/crowdsec/data";
+  in {
+    imports = [self.modules.nixos.crowdsec-base];
+
+    sops.secrets = {
+      # keep-sorted start
+      "crowdsec/console_enroll_key" = {};
+      "traefik/crowdsec_bouncer_key" = {};
+      # keep-sorted end
+    };
+
+    services.crowdsec.settings = {
+      config = {
+        api.server.online_client.credentials_path = "${dataDir}/online_api_credentials.yaml";
+
+        db_config = {
           db_name = "crowdsec";
           db_path = "/run/postgresql";
           type = "pgx";
           user = "crowdsec";
         };
-
-        console.enrollKeyFile = config.sops.secrets."crowdsec/console_enroll_key".path;
       };
+
+      console.enrollKeyFile = config.sops.secrets."crowdsec/console_enroll_key".path;
     };
 
     services.postgresql = {
@@ -119,6 +137,7 @@
     };
 
     systemd.services = {
+      # keep-sorted start block=yes newline_separated=yes
       crowdsec = {
         after = ["postgresql.service"];
         requires = ["postgresql.service"];
@@ -170,6 +189,7 @@
           User = config.services.crowdsec.user;
         };
       };
+      # keep-sorted end
     };
   };
 }
diff --git a/modules/services/traefik.nix b/modules/services/traefik.nix
--- a/modules/services/traefik.nix
+++ b/modules/services/traefik.nix
@@ -11,12 +11,12 @@
           mode = "0400";
         };
 
+        "traefik/mail" = {};
+
         "traefik/redis_crowdsec_password" = {
           owner = "traefik";
           mode = "0400";
         };
-
-        "traefik/mail" = {};
         # keep-sorted end
       };
 
diff --git a/modules/desktop/noctalia/wallpaper.nix b/modules/desktop/noctalia/wallpaper.nix
--- a/modules/desktop/noctalia/wallpaper.nix
+++ b/modules/desktop/noctalia/wallpaper.nix
@@ -14,15 +14,7 @@
       setWallpaperOnAllMonitors = true;
       showHiddenFiles = true;
       skipStartupTransition = true;
-      transitionType = [
-        # keep-sorted start
-        "disc"
-        "fade"
-        "honeycomb"
-        "stripes"
-        "wipe"
-        # keep-sorted end
-      ];
+      transitionType = ["honeycomb"];
       # keep-sorted end
     };
   };
diff --git a/modules/hosts/euclid/default.nix b/modules/hosts/euclid/default.nix
--- a/modules/hosts/euclid/default.nix
+++ b/modules/hosts/euclid/default.nix
@@ -6,7 +6,7 @@
 
       # Services
       # keep-sorted start
-      crowdsec
+      crowdsec-server
       godns
       mysql
       postgres
diff --git a/modules/profiles/stylix/base.nix b/modules/profiles/stylix/base.nix
--- a/modules/profiles/stylix/base.nix
+++ b/modules/profiles/stylix/base.nix
@@ -64,6 +64,10 @@
   }: {
     imports = lib.optional (osConfig == null) inputs.stylix.homeModules.stylix;
 
-    stylix = stylixConfig;
+    stylix =
+      stylixConfig
+      // {
+        targets.btop.opacity.override.terminal = 0.0;
+      };
   };
 }

--
tangled.sh