modules: services: add fail2ban

This commit is contained in:
Bruno BELANYI 2023-02-19 18:36:01 +01:00
parent 4e59c0d551
commit 13aa8abfaf
2 changed files with 38 additions and 0 deletions

View file

@ -7,6 +7,7 @@
./blog
./calibre-web
./drone
./fail2ban
./flood
./gitea
./grocy

View file

@ -0,0 +1,37 @@
# A minimalist, opinionated feed reader
{ config, lib, ... }:
let
cfg = config.my.services.fail2ban;
wgNetCfg = config.my.services.wireguard.net;
in
{
options.my.services.fail2ban = with lib; {
enable = mkEnableOption "fail2ban daemon";
};
config = lib.mkIf cfg.enable {
services.fail2ban = {
enable = true;
ignoreIP = [
# Wireguard IPs
"${wgNetCfg.v4.subnet}.0/${toString wgNetCfg.v4.mask}"
"${wgNetCfg.v6.subnet}::/${toString wgNetCfg.v6.mask}"
# Loopback addresses
"127.0.0.0/8"
];
maxretry = 5;
bantime-increment = {
enable = true;
rndtime = "5m"; # Use 5 minute jitter to avoid unban evasion
};
jails.DEFAULT = '';
findtime = 4h
bantime = 10m
'';
};
};
}