services/router: init

modules/clan/router/crowdsec.nix

@@ -0,0 +1,46 @@
+# CrowdSec security engine + nftables bouncer: parses sshd auth attempts from
+# the journal and bans offending source IPs at the firewall. Log-based (no
+# inline DPI) so it costs the N300 next to nothing.
+{ settings }:
+{ ... }:
+let
+  cfg = settings;
+in
+{
+  services.crowdsec = {
+    enable = true;
+    autoUpdateService = true;
+    hub.collections = [
+      "crowdsecurity/linux"
+      "crowdsecurity/sshd"
+    ];
+    localConfig = {
+      acquisitions = [
+        {
+          source = "journalctl";
+          journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
+          labels.type = "syslog";
+        }
+      ];
+      # Never ban the ZeroTier mesh — it is the only admin path to these
+      # boxes (no public SSH), so a false positive would lock us out.
+      # Parser-stage whitelist: mesh events are dropped before any scenario.
+      parsers.s02Enrich = [
+        {
+          name = "cnx/mesh-whitelist";
+          description = "Whitelist the ZeroTier management mesh";
+          whitelist = {
+            reason = "ZeroTier mesh is the admin path";
+            cidr = [ cfg.mesh.subnet ];
+          };
+        }
+      ];
+    };
+  };
+
+  services.crowdsec-firewall-bouncer = {
+    enable = true;
+    registerBouncer.enable = true;
+    settings.mode = "nftables";
+  };
+}