ashie/nixos-vps
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Restrict incoming connections to DE via CrowdSec GeoIP

Browse source
This commit is contained in:
ashisgreat22 2026-03-18 21:53:05 +01:00
parent 8f44273faf
commit c3adfa7e25
1 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
modules/crowdsec.nix
View file

@ -91,6 +91,17 @@ in
# Remediation profiles # Remediation profiles
localConfig.profiles = [ localConfig.profiles = [
{
name = "block_non_de";
filters = [ "Alert.Remediation == true && Alert.GetScope() == 'Ip' && Alert.Enriched.IsoCode != 'DE' && Alert.Enriched.IsoCode != ''" ];
decisions = [
{
type = "ban";
duration = "24h";
}
];
on_success = "break";
}
{ {
name = "default_ip_remediation"; name = "default_ip_remediation";
filters = [ "Alert.Remediation == true && Alert.GetScope() == 'Ip'" ]; filters = [ "Alert.Remediation == true && Alert.GetScope() == 'Ip'" ];
@ -106,6 +117,9 @@ in
# Hub collections for common attack patterns # Hub collections for common attack patterns
hub = { hub = {
parsers = [
"crowdsecurity/geoip-enrich"
];
collections = [ collections = [
"crowdsecurity/linux" "crowdsecurity/linux"
"crowdsecurity/nginx" "crowdsecurity/nginx"