From 05c4d0f86a469651e5cc8fe21e594ff23338a815 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20M=C3=A9meint?= Date: Sun, 8 Feb 2026 09:08:29 +0100 Subject: [PATCH 1/2] nixos/crowdsec-firewall-bouncer: Add tornax as maintainer --- .../modules/services/security/crowdsec-firewall-bouncer.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/security/crowdsec-firewall-bouncer.nix b/nixos/modules/services/security/crowdsec-firewall-bouncer.nix index 856efd81b483..94a9fcd664ca 100644 --- a/nixos/modules/services/security/crowdsec-firewall-bouncer.nix +++ b/nixos/modules/services/security/crowdsec-firewall-bouncer.nix @@ -386,6 +386,9 @@ in }; meta = { - maintainers = with lib.maintainers; [ nicomem ]; + maintainers = with lib.maintainers; [ + nicomem + tornax + ]; }; } From e931ac1f0a9c4b1c35102de534eb231d264509f5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20M=C3=A9meint?= Date: Sun, 8 Feb 2026 09:08:46 +0100 Subject: [PATCH 2/2] nixos/crowdsec-firewall-bouncer: Fix missing systemd dependencies to firewall services --- .../services/security/crowdsec-firewall-bouncer.nix | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/security/crowdsec-firewall-bouncer.nix b/nixos/modules/services/security/crowdsec-firewall-bouncer.nix index 94a9fcd664ca..dcc61fc42817 100644 --- a/nixos/modules/services/security/crowdsec-firewall-bouncer.nix +++ b/nixos/modules/services/security/crowdsec-firewall-bouncer.nix @@ -306,17 +306,24 @@ in # Replace the api_key placeholder with the secret ${lib.getExe pkgs.replace-secret} '@API_KEY_FILE@' "$CREDENTIALS_DIRECTORY/API_KEY_FILE" ${final-config-file} ''; + + isIptables = (cfg.settings.mode == "iptables") || (cfg.settings.mode == "ipset"); + isNftables = cfg.settings.mode == "nftables"; in rec { description = "CrowdSec Firewall Bouncer"; wantedBy = [ "multi-user.target" ]; - after = [ "network.target" ] ++ (lib.optional config.services.crowdsec.enable "crowdsec.service"); + partOf = lib.optional isNftables "nftables.service" ++ lib.optional isIptables "firewall.service"; + after = + lib.optional isNftables "nftables.service" + ++ lib.optional isIptables "firewall.service" + ++ lib.optional config.services.crowdsec.enable "crowdsec.service"; wants = after; requires = lib.optional cfg.registerBouncer.enable "crowdsec-firewall-bouncer-register.service"; # When using iptables/ipset modes, the bouncer calls external binaries so they must be added to the path. # For nftables mode, it does not depend on external binaries. - path = lib.optionals ((cfg.settings.mode == "iptables") || (cfg.settings.mode == "ipset")) [ + path = lib.optionals isIptables [ pkgs.iptables pkgs.ipset ];