nixos: create 'modules/nixos' folder

Let's consolidate all modules under one path, so that NixOS,
home-manager, and nix-darwin (if I ever end up using it down the line)
would go under the same folder.

modules/nixos/services/fail2ban/default.nix

@@ -0,0 +1,37 @@
+# Filter and ban unauthorized access
+{ config, lib, ... }:
+let
+  cfg = config.my.services.fail2ban;
+  wgNetCfg = config.my.services.wireguard.net;
+in
+{
+  options.my.services.fail2ban = with lib; {
+    enable = mkEnableOption "fail2ban daemon";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.fail2ban = {
+      enable = true;
+
+      ignoreIP = [
+        # Wireguard IPs
+        "${wgNetCfg.v4.subnet}.0/${toString wgNetCfg.v4.mask}"
+        "${wgNetCfg.v6.subnet}::/${toString wgNetCfg.v6.mask}"
+        # Loopback addresses
+        "127.0.0.0/8"
+      ];
+
+      maxretry = 5;
+
+      bantime-increment = {
+        enable = true;
+        rndtime = "5m"; # Use 5 minute jitter to avoid unban evasion
+      };
+
+      jails.DEFAULT.settings = {
+        findtime = "4h";
+        bantime = "10m";
+      };
+    };
+  };
+}