From 90d5cb87d75f27ce217b48761e60256943607d13 Mon Sep 17 00:00:00 2001 From: Adam0 Date: Thu, 9 Jul 2026 09:41:56 +0200 Subject: [PATCH] crowsec migration & hyprland termfilechooser rule --- flake.lock | 102 ++++++++++++------------- flake.nix | 4 +- modules/desktop/hyprland/rules.nix | 11 +++ modules/nix/default.nix | 1 + modules/services/security/crowdsec.nix | 96 +++++++++++++++++------ 5 files changed, 138 insertions(+), 76 deletions(-) diff --git a/flake.lock b/flake.lock index b01a5af..5212ec2 100644 --- a/flake.lock +++ b/flake.lock @@ -249,12 +249,12 @@ "nixpkgs": "nixpkgs_3" }, "locked": { - "lastModified": 1781815324, - "narHash": "sha256-5pDiPOe2tLKDOH59TkzP3MNiCCCbGxw3giDyRrSdP4E=", - "rev": "fdef7e382e042b1fe418f65770c3acda5933b155", - "revCount": 422, + "lastModified": 1783537817, + "narHash": "sha256-1Xu/0aFdCij0oyB5/i5flZBfGXOVCYeDvVE2jSv08PM=", + "rev": "7adcb07f6a603447b1d6aa674ce5747a4a91f029", + "revCount": 426, "type": "tarball", - "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.21.2/019edc7b-7758-7223-a52e-d8a340361a73/source.tar.gz" + "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.21.5/019f4326-f1c4-7f13-b58b-98979a78c513/source.tar.gz" }, "original": { "type": "tarball", @@ -264,37 +264,37 @@ "determinate-nixd-aarch64-darwin": { "flake": false, "locked": { - "narHash": "sha256-pQ7YeoB96bBl3iJGRdUWjdOFwahPUMwNN1yl9fwJufY=", + "narHash": "sha256-oz9PLBISeJ+ipMoi4xmcVG41P/Q8IcptQ62xAJ9ZiZg=", "type": "file", - "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.2/macOS" + "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.5/macOS" }, "original": { "type": "file", - "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.2/macOS" + "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.5/macOS" } }, "determinate-nixd-aarch64-linux": { "flake": false, "locked": { - "narHash": "sha256-t6Tc358tx16GFely1je18dmrfB8Wv1FkV6nRnU7ITYY=", + "narHash": "sha256-tvhnv4tS6GIX0DkngUOxWcZ1wW+G7BEOTszojDNDBeY=", "type": "file", - "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.2/aarch64-linux" + "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.5/aarch64-linux" }, "original": { "type": "file", - "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.2/aarch64-linux" + "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.5/aarch64-linux" } }, "determinate-nixd-x86_64-linux": { "flake": false, "locked": { - "narHash": "sha256-M5e/05UlhljIuqS2ZMozD3OJ2MTTYol9SxQwqrzJdkk=", + "narHash": "sha256-brJCRiMDagnf2TLZLAq7UVfKrgow7I/5uNIXfhZsEWA=", "type": "file", - "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.2/x86_64-linux" + "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.5/x86_64-linux" }, "original": { "type": "file", - "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.2/x86_64-linux" + "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.5/x86_64-linux" } }, "discord-userstyle": { @@ -665,11 +665,11 @@ ] }, "locked": { - "lastModified": 1783458499, - "narHash": "sha256-a8whUXG4ThsZNjL92cH4wbl+/dt8CbT/F0zJsfhzFbM=", + "lastModified": 1783550008, + "narHash": "sha256-qbbZUk9IG9dLNwCPwdPBs6I5clxwugRpP+1YU+GPK20=", "owner": "nix-community", "repo": "home-manager", - "rev": "53ebbdc405acc04acd9bb73ccca462b51ddb8c6d", + "rev": "f4d01c1d87c7c2ec909549165d5a8338f1bd3315", "type": "github" }, "original": { @@ -1124,12 +1124,12 @@ "nixpkgs-regression": "nixpkgs-regression" }, "locked": { - "lastModified": 1780939209, - "narHash": "sha256-/JuW5C6sWuC836Y9b7hga3ZvhRiY4k4Zs73RRg5KVWM=", - "rev": "952beffe9c45ed245d30209d4f17cf1d26654a2a", - "revCount": 26044, + "lastModified": 1783531012, + "narHash": "sha256-oR+h2cF6jderMyM+CMvGu/gbh8s3xceSY+oFqYOcrGg=", + "rev": "1318433ee92773c7c4ab7b3950c8c24d7a8bcc2b", + "revCount": 26214, "type": "tarball", - "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.21.1/019ea860-2acd-7680-ae61-10f9574b2694/source.tar.gz" + "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.21.5/019f42f2-bfcf-72d3-ba62-dd63f71ea07e/source.tar.gz" }, "original": { "type": "tarball", @@ -1260,11 +1260,11 @@ "nixpkgs-nixcord": "nixpkgs-nixcord" }, "locked": { - "lastModified": 1783448630, - "narHash": "sha256-ymGXQlPWLyq4iWiFUgqHB7j8hKv8a2/pm5K6BEsyEt4=", + "lastModified": 1783570676, + "narHash": "sha256-nprEToIeZ3IQ7udagxsQASOlJ/J27TCirC7xBucy71A=", "owner": "kaylorben", "repo": "nixcord", - "rev": "bd25941df7e494f1d31f28b4f6a8182362fec781", + "rev": "ba132526472f74dc0efa75b69e6fc2c03ca0d9d9", "type": "github" }, "original": { @@ -1307,16 +1307,16 @@ }, "nixpkgs-crowdsec": { "locked": { - "lastModified": 1781346399, - "narHash": "sha256-iEQ6kf7Pzxq9jyEgEDP9MB2fayckqJTcNtMDLVpkREg=", + "lastModified": 1782976172, + "narHash": "sha256-+Sk4XRytasMKJj+fICF0ltUIr4HW5Ezq9Pg2bktCWzo=", "owner": "TornaxO7", "repo": "nixpkgs", - "rev": "72de654bfafff415d5d9faabd29276310b70d349", + "rev": "09000fdbccf06b47705e95935b289d3e98680623", "type": "github" }, "original": { "owner": "TornaxO7", - "ref": "crowdsec", + "ref": "saltsprint", "repo": "nixpkgs", "type": "github" } @@ -1386,12 +1386,12 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1773222311, - "narHash": "sha256-BHoB/XpbqoZkVYZCfXJXfkR+GXFqwb/4zbWnOr2cRcU=", - "rev": "0590cd39f728e129122770c029970378a79d076a", - "revCount": 909248, + "lastModified": 1782767157, + "narHash": "sha256-db/8NgfehQlPNt8rMY0J1gvwzTaURU/foM7y/AQimIM=", + "rev": "1d4e0f865d68258aada31e68e6d79c8c463f3b34", + "revCount": 914302, "type": "tarball", - "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2511.909248%2Brev-0590cd39f728e129122770c029970378a79d076a/019ce32b-8ace-7339-b129-cceaa8dd10c6/source.tar.gz" + "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2511.914302%2Brev-1d4e0f865d68258aada31e68e6d79c8c463f3b34/019f1c78-b5ab-7af2-8516-c0d5406b0646/source.tar.gz" }, "original": { "type": "tarball", @@ -1400,12 +1400,12 @@ }, "nixpkgs_3": { "locked": { - "lastModified": 1780930886, - "narHash": "sha256-rppURzHviaQN131F+nLiLdGfcb0uCd9gGP0E5+iw9MI=", - "rev": "8c3cede7ddc26bd659d2d383b5610efbd2c7a16e", - "revCount": 1012902, + "lastModified": 1782723713, + "narHash": "sha256-oPXCU/SSUokcGaJREHibG1CBX3+s/W7orDWQOZDsEeQ=", + "rev": "b5aa0fbd538984f6e3d201be0005b4463d8b09f8", + "revCount": 1024265, "type": "tarball", - "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.1012902%2Brev-8c3cede7ddc26bd659d2d383b5610efbd2c7a16e/019eab22-bd1e-7e40-b919-277db893c789/source.tar.gz" + "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.1024265%2Brev-b5aa0fbd538984f6e3d201be0005b4463d8b09f8/019f3b54-a452-7bf0-9017-aa0cf4ad1907/source.tar.gz" }, "original": { "type": "tarball", @@ -1529,11 +1529,11 @@ ] }, "locked": { - "lastModified": 1783478296, - "narHash": "sha256-Ye66G3O7LCbffDtOsWela85w6m9SyKK/d0eT+EpzoHg=", + "lastModified": 1783581051, + "narHash": "sha256-23ouasHqej9n3qGGqnq682pEBfYcmCGHVPUnm6WDf8U=", "owner": "nix-community", "repo": "NUR", - "rev": "ee50cde4c59d24b446f4af344e4fda4e1ddbd1ab", + "rev": "21d8513f565042678d71826adffd25fa1ac9418b", "type": "github" }, "original": { @@ -1589,15 +1589,15 @@ "locked": { "lastModified": 1783290833, "narHash": "sha256-HuMtTlFHuldcZceIuiZbFvbYjZngjUksmof3G2ZKinc=", - "owner": "adam01110", - "repo": "overzicht", + "ref": "refs/heads/main", "rev": "8bacdfe85abe309f31455377f9e15e7e13b2896a", - "type": "github" + "revCount": 55, + "type": "git", + "url": "https://tangled.org/adam0.dev/overzicht" }, "original": { - "owner": "adam01110", - "repo": "overzicht", - "type": "github" + "type": "git", + "url": "https://tangled.org/adam0.dev/overzicht" } }, "pre-commit": { @@ -2116,11 +2116,11 @@ "rust-overlay": "rust-overlay" }, "locked": { - "lastModified": 1783447831, - "narHash": "sha256-zaEvw2DnGjeKHTPo72GZyX4weaTKVZsNOFn9CKuqEGw=", + "lastModified": 1783493073, + "narHash": "sha256-aZttkaBzM0vjC/WDz5a/uVeq57hGur/CqfBD7P9V1es=", "owner": "notashelf", "repo": "tuigreet", - "rev": "961ff2126d09b97bdbaccb02c610b7656fd4c366", + "rev": "2bf070a0b6bb66e76d2e32500dec851e2254ab2f", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 17d2b33..a8fe3aa 100644 --- a/flake.nix +++ b/flake.nix @@ -64,7 +64,7 @@ inputs.flake-parts.follows = "flake-parts"; }; nixpkgs.url = "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"; - nixpkgs-crowdsec.url = "github:TornaxO7/nixpkgs/crowdsec"; + nixpkgs-crowdsec.url = "github:TornaxO7/nixpkgs/saltsprint"; nixpkgs-crowdsec-blocklist-import.url = "github:gaelj/nixpkgs/init-crowdsec-blocklist-import"; noctalia = { url = "github:noctalia-dev/noctalia?ref=legacy-v4"; @@ -92,7 +92,7 @@ }; }; overzicht = { - url = "github:adam01110/overzicht"; + url = "git+https://tangled.org/adam0.dev/overzicht"; inputs = { flake-parts.follows = "flake-parts"; import-tree.follows = "import-tree"; diff --git a/modules/desktop/hyprland/rules.nix b/modules/desktop/hyprland/rules.nix index 828f515..af686df 100644 --- a/modules/desktop/hyprland/rules.nix +++ b/modules/desktop/hyprland/rules.nix @@ -137,6 +137,17 @@ size = [400 600]; } + { + match = { + # keep-sorted start + class = "com.mitchellh.ghostty"; + title = "Termfilechooser"; + # keep-sorted end + }; + + float = true; + } + { match = { # keep-sorted start diff --git a/modules/nix/default.nix b/modules/nix/default.nix index dc41450..210bc94 100644 --- a/modules/nix/default.nix +++ b/modules/nix/default.nix @@ -10,6 +10,7 @@ in { sops = { secrets."nix_access_tokens/github" = {}; + secrets."nix_access_tokens/ncps" = {}; templates = { access_tokens = { diff --git a/modules/services/security/crowdsec.nix b/modules/services/security/crowdsec.nix index 21a43c9..653b667 100644 --- a/modules/services/security/crowdsec.nix +++ b/modules/services/security/crowdsec.nix @@ -1,7 +1,7 @@ {inputs, ...}: { flake-file = { inputs.nixpkgs-crowdsec = { - url = "github:TornaxO7/nixpkgs/crowdsec"; + url = "github:TornaxO7/nixpkgs/saltsprint"; }; inputs.nixpkgs-crowdsec-blocklist-import = { @@ -49,7 +49,6 @@ services.crowdsec = { enable = true; autoUpdateService = true; - openFirewall = false; hub = { collections = [ @@ -110,6 +109,7 @@ # keep-sorted start getExe mkForce + mkMerge # keep-sorted end ; @@ -122,8 +122,10 @@ proxyPort = "12346"; setupDeps = [ + # keep-sorted start "postgresql.service" "sops-install-secrets.service" + # keep-sorted end ]; setupUnit = { @@ -262,6 +264,7 @@ # keep-sorted start "crowdsec-blocklist-gotify-proxy.service" "crowdsec-firewall-bouncer-register.service" + "gotify-server.service" "sops-install-secrets.service" # keep-sorted end ]; @@ -269,11 +272,22 @@ # keep-sorted start "crowdsec-blocklist-gotify-proxy.service" "crowdsec-firewall-bouncer-register.service" + "gotify-server.service" "sops-install-secrets.service" # keep-sorted end ]; - serviceConfig.EnvironmentFile = templates."crowdsec-blocklist-import-env".path; + serviceConfig = { + EnvironmentFile = templates."crowdsec-blocklist-import-env".path; + StateDirectory = mkForce []; + + ReadWritePaths = [ + # keep-sorted start + "/var/lib/crowdsec" + "/var/lib/crowdsec-firewall-bouncer-register" + # keep-sorted end + ]; + }; }; crowdsec-blocklist-import-limited = { @@ -281,6 +295,7 @@ # keep-sorted start "crowdsec-blocklist-gotify-proxy.service" "crowdsec-firewall-bouncer-register.service" + "gotify-server.service" "sops-install-secrets.service" # keep-sorted end ]; @@ -288,21 +303,47 @@ # keep-sorted start "crowdsec-blocklist-gotify-proxy.service" "crowdsec-firewall-bouncer-register.service" + "gotify-server.service" "sops-install-secrets.service" # keep-sorted end ]; - serviceConfig.EnvironmentFile = templates."crowdsec-blocklist-import-env".path; + serviceConfig = { + EnvironmentFile = templates."crowdsec-blocklist-import-env".path; + StateDirectory = mkForce []; + + ReadWritePaths = [ + # keep-sorted start + "/var/lib/crowdsec" + "/var/lib/crowdsec-firewall-bouncer-register" + # keep-sorted end + ]; + }; }; crowdsec-blocklist-gotify-proxy = { description = "Transform blocklist-import webhook payload for Gotify"; - after = ["sops-install-secrets.service"]; + after = [ + # keep-sorted start + "gotify-server.service" + "sops-install-secrets.service" + # keep-sorted end + ]; stopIfChanged = false; - wants = ["sops-install-secrets.service"]; + wants = [ + # keep-sorted start + "gotify-server.service" + "sops-install-secrets.service" + # keep-sorted end + ]; - wantedBy = ["crowdsec-blocklist-import-frequent.service" "crowdsec-blocklist-import-limited.service"]; + wantedBy = [ + # keep-sorted start + "crowdsec-blocklist-import-frequent.service" + "crowdsec-blocklist-import-limited.service" + # keep-sorted end + ]; serviceConfig = { # keep-sorted start @@ -310,8 +351,6 @@ ExecStart = "${getExe pkgs.socat} TCP-LISTEN:${proxyPort},bind=127.0.0.1,fork,reuseaddr SYSTEM:${getExe pkgs.crowdsec-blocklist-gotify-proxy}"; LoadCredential = ["gotify_api_key:${secrets."crowdsec/gotify_api_key".path}"]; Restart = "on-failure"; - StateDirectory = "crowdsec"; - StateDirectoryMode = "0750"; SuccessExitStatus = [143]; Type = "simple"; # keep-sorted end @@ -365,21 +404,32 @@ exit 1 ''; - serviceConfig = { - # keep-sorted start - DynamicUser = true; - Group = config.services.crowdsec.group; - StateDirectory = "crowdsec"; - StateDirectoryMode = "0750"; - User = config.services.crowdsec.user; - # keep-sorted end + serviceConfig = mkMerge [ + { + StateDirectory = mkForce []; - # keep-sorted start - LoadCredential = ["traefik_bouncer_key:${secrets."traefik/crowdsec_bouncer_key".path}"]; - RemainAfterExit = true; - Type = "oneshot"; - # keep-sorted end - }; + ReadWritePaths = [ + # keep-sorted start + "/var/lib/crowdsec" + "/var/lib/crowdsec/data" + # keep-sorted end + ]; + } + + { + # keep-sorted start + DynamicUser = true; + Group = config.services.crowdsec.group; + User = config.services.crowdsec.user; + # keep-sorted end + + # keep-sorted start + LoadCredential = ["traefik_bouncer_key:${secrets."traefik/crowdsec_bouncer_key".path}"]; + RemainAfterExit = true; + Type = "oneshot"; + # keep-sorted end + } + ]; }; }; }; -- 2.51.2