rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CrowdSec: stop re-enrolling on every switch

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-10-08 09:30:38 +01:00
parent 98bd60eb64
commit 054bb86471
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
services/crowdsec.nix
View file

@ -82,7 +82,10 @@ in
config.api.server.listen_uri = "127.0.0.1:8081"; # 8080 is qBit config.api.server.listen_uri = "127.0.0.1:8081"; # 8080 is qBit
# CAPI: community blocklist + console (app.crowdsec.net). Setup auto-registers. # CAPI: community blocklist + console (app.crowdsec.net). Setup auto-registers.
config.api.server.online_client.credentials_path = "/var/lib/crowdsec/data/online_api_credentials.yaml"; config.api.server.online_client.credentials_path = "/var/lib/crowdsec/data/online_api_credentials.yaml";
console.enrollKeyFile = "/var/secrets/crowdsec-enroll-key"; # Already enrolled. No console.enrollKeyFile: setup re-ran `cscli
# console enroll` on every switch, and a CAPI outage (401) failed the
# 2026-10-08 nightly deploy and its rollback. Fresh install: run
# `sudo cscli console enroll "$(sudo cat /var/secrets/crowdsec-enroll-key)"` once.
# Drop alerts originating from LAN clients before they're scored. # Drop alerts originating from LAN clients before they're scored.
# Without this, repeated Authelia 401s from inside the house (e.g. # Without this, repeated Authelia 401s from inside the house (e.g.