crowdsec: use sshd.service unit for journalctl ssh acquisition on NixOS

README.md

@@ -20,8 +20,6 @@
         - 9009-9013/tcp (relay)
     - **SFTPGo**
         - 2022/tcp (SFTP)
-    - **Gitea**
-        - 2222/tcp (SSH)
     - **WireGuard Easy**
         - 51820/udp (WireGuard)
 

crowdsec/acquis.d/sshd.yaml

@@ -1,5 +1,6 @@
 source: journalctl
 journalctl_filter:
-  - "_SYSTEMD_UNIT=ssh.service"
+  # NixOS names the OpenSSH unit "sshd.service"; Debian/Ubuntu use "ssh.service".
+  - "_SYSTEMD_UNIT=sshd.service"
 labels:
   type: syslog

gitea/.env.example

@@ -1,7 +1,5 @@
 # URL of the Gitea instance
 GITEA_INSTANCE_URL=http://gitea:3000
-# Domain advertised in SSH clone URLs (e.g. gitea.aykhans.me)
-GITEA_SSH_DOMAIN=
 # How to get the token: https://docs.gitea.com/usage/actions/act-runner#obtain-a-registration-token
 GITEA_RUNNER_REGISTRATION_TOKEN=
 # UID and GID of the user that should run the runner (e.g. USER_UID=1000, USER_GID=1000)

gitea/docker-compose.yaml

@@ -15,14 +15,10 @@ services:
     environment:
       - USER_UID=${USER_UID}
       - USER_GID=${USER_GID}
-      - GITEA__server__SSH_DOMAIN=${GITEA_SSH_DOMAIN}
-      - GITEA__server__SSH_PORT=2222
     restart: unless-stopped
     networks:
       - gitea
       - caddy
-    ports:
-      - "2222:22"
     volumes:
       - ./data:/data
       - /etc/timezone:/etc/timezone:ro