rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

crowdsec: add systemd-journal group so journalctl acquisitions work

Browse source 
DynamicUser can only see its own journald entries by default, so the
sshd + authelia journalctl acquisitions were dying with "insufficient
permissions" and exit status 1 from the spawned journalctl process.
Adding systemd-journal grants the read access journald gates on group
membership, restoring the ssh-bf / authelia-bf detection chain.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
ediblerope 2026-04-25 20:03:10 +01:00
parent c4f0e4920e
commit a0a1d67124
1 changed files with 6 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
services/crowdsec.nix
View file

@ -62,11 +62,13 @@ in
"crowdsecurity/whitelist-good-actors" # don't ban legit crawlers
];
# Allow the agent (DynamicUser) to read nginx logs:
# readOnlyPaths makes the dir visible inside the sandbox; extraGroups
# gets it past Unix perms (access.log is nginx:nginx 640).
# Allow the agent (DynamicUser) to read its acquisition sources:
# - nginx group → /var/log/nginx/access.log (nginx:nginx 640)
# - systemd-journal → journald entries from sshd + authelia
# (without it, journalctl returns "insufficient permissions" and
# the entire ssh-bf / authelia-bf detection chain runs blind)
readOnlyPaths = [ "/var/log/nginx" ];
extraGroups = [ "nginx" ];
extraGroups = [ "nginx" "systemd-journal" ];
settings = {
# config.yaml — main agent + LAPI configuration