feat(repo): IaaS baseline

config/services/systemd/common/alloy/config.alloy.j2

@@ -207,7 +207,7 @@ loki.process "journal_parser" {
             // Regex to extract the log level from the content.
             expression = "(?i)(?:level[\"\\s:=]+|\\[|\\s|^)(?P<content_level>info|warn|warning|error|debug|fatal|critical|trace)(?:[\"\\]\\s]|$)"
         }
-        
+
         stage.labels {
             values = {
                 "level" = "content_level",
@@ -237,7 +237,7 @@ loki.process "journal_parser" {
 loki.process "suricata_json" {
     forward_to = [loki.write.loki.receiver]
     stage.json {
-        expressions = { 
+        expressions = {
             event_type = "event_type",
             src_ip     = "src_ip",
             severity   = "alert.severity",
@@ -253,7 +253,7 @@ loki.process "suricata_json" {
 loki.process "caddy_json" {
     forward_to = [loki.write.loki.receiver]
     stage.json {
-        expressions = { 
+        expressions = {
             status      = "status",
             method      = "method",
             remote_ip   = "remote_ip",

config/services/systemd/common/crowdsec/acquis.d/suricata.yaml

@@ -2,4 +2,4 @@
 filenames:
   - /var/log/suricata/eve.json
 labels:
-  type: suricata
+  type: suricata-evelogs

config/services/systemd/common/crowdsec/etc/config.yaml.j2

@@ -27,7 +27,7 @@ db_config:
   type: sqlite
   db_path: /var/lib/crowdsec/data/crowdsec.db
   #max_open_conns: 100
-  #user: 
+  #user:
   #password:
   #db_name:
   #host:

config/services/systemd/common/kopia/kopia-backup.service.j2

@@ -20,11 +20,8 @@ ProtectSystem=strict
 ProtectHome=tmpfs
 InaccessiblePaths=/boot /root
 
-{% if node['name'] == 'infra' %}
-BindReadOnlyPaths={{ node['home_path'] }}/containers/postgresql/backups
-{% elif node['name'] == 'app' %}
 BindReadOnlyPaths={{ node['home_path'] }}/data
-{% endif %}
+
 # In root namescope, %u always bring 0
 BindPaths=/etc/kopia
 BindPaths=/etc/secrets/{{ kopia_uid }}
@@ -36,14 +33,8 @@ ExecStartPre=/usr/bin/kopia repository connect server \
     --override-username={{ node['name'] }} \
     --override-hostname={{ node['name'] }}.{{ domain['internal'] }}
 
-{% if node['name'] == 'infra' %}
-ExecStart=/usr/bin/kopia snapshot create \
-    {{ node['home_path'] }}/containers/postgresql/backups
-{% elif node['name'] == 'app' %}
 ExecStart=/usr/bin/kopia snapshot create \
     {{ node['home_path'] }}/data
-{% endif %}
-
 
 [Install]
 WantedBy=multi-user.target

config/services/systemd/common/kopia/kopia.env.j2

@@ -1,4 +1,4 @@
-KOPIA_PASSWORD={{ hostvars['console']['kopia']['user'][node['name']] }}
+KOPIA_PASSWORD={{ hostvars['console']['kopia']['users'][node['name']] }}
 KOPIA_CONFIG_PATH=/etc/kopia/repository.config
 KOPIA_CACHE_DIRECTORY=/var/cache/kopia
 KOPIA_LOG_DIR=/var/cache/kopia/logs