security (mcentire): Prevent ssh root and password login

services/crowdsec.nix

@@ -44,6 +44,8 @@
     };
   };
 
+  users.users."${config.services.crowdsec.user}".extraGroups = [ "adm" ];
+
   systemd.tmpfiles.rules = let cfg = config.services.crowdsec;
   in [ "d /var/lib/crowdsec 0755 ${cfg.user} ${cfg.group}" ];
 }

services/fireflyiii.nix

@@ -155,8 +155,8 @@ in {
             networks = [ networks."${user}".ref ];
             publishPorts = [ "127.0.0.1:${port}:${containerPort}" ];
           };
-          unitConfig.Requires = [ secrets.ref containers."${user}".ref ];
+          unitConfig.Requires = [ secrets.ref containers."${user}-db".ref ];
-          unitConfig.After = [ secrets.ref containers."${user}".ref ];
+          unitConfig.After = [ secrets.ref containers."${user}-db".ref ];
         };
       };
     };

services/openssh.nix

@@ -0,0 +1,9 @@
+{ ... }: {
+  services.openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = "no";
+      PasswordAuthentication = false;
+    };
+  };
+}

services/vaultwarden.nix

@@ -60,6 +60,15 @@ in {
     }
   '';
 
+  services.crowdsec = {
+    localConfig.acquisitions = [{
+      source = "journalctl";
+      journalctl_filter = [ "_SYSTEMD_USER_UNIT=${user}.service" ];
+      labels.type = "bitwarden";
+    }];
+    hub.collections = [ "MariuszKociubinski/bitwarden" ];
+  };
+
   users.users."${user}" = {
     group = user;
     isNormalUser = true;
@@ -146,8 +155,8 @@ in {
             networks = [ networks."${user}".ref ];
             publishPorts = [ "127.0.0.1:${port}:${containerPort}" ];
           };
-          unitConfig.Requires = [ secrets.ref containers."${user}".ref ];
+          unitConfig.Requires = [ secrets.ref containers."${user}-db".ref ];
-          unitConfig.After = [ secrets.ref containers."${user}".ref ];
+          unitConfig.After = [ secrets.ref containers."${user}-db".ref ];
         };
       };
     };

systems/linux/mcentire.nix

@@ -12,6 +12,7 @@
     ./../../services/fireflyiii.nix
     ./../../services/freshrss.nix
     ./../../services/navidrome.nix
+    ./../../services/openssh.nix
     ./../../services/vaultwarden.nix
   ];