summaryrefslogtreecommitdiff
path: root/os/srv/fail2ban.nix
diff options
context:
space:
mode:
authoradikro <adikro@disroot.org>2026-06-17 00:28:00 +0200
committeradikro <adikro@disroot.org>2026-06-17 00:28:00 +0200
commit630da5d0639cada53e26a03f579df0a7bac3b17a (patch)
tree73edd6ea30331d807413d548f9559d89acc38a82 /os/srv/fail2ban.nix
parentce7fb7ddd3267291a8d692cc6381dad606288aa5 (diff)
librewolf manual compilation issue
Diffstat (limited to 'os/srv/fail2ban.nix')
-rw-r--r--os/srv/fail2ban.nix69
1 files changed, 0 insertions, 69 deletions
diff --git a/os/srv/fail2ban.nix b/os/srv/fail2ban.nix
deleted file mode 100644
index 9b51ceb..0000000
--- a/os/srv/fail2ban.nix
+++ /dev/null
@@ -1,69 +0,0 @@
-{ config, lib, ... }:
-
-let
- cfg = config.os.srv.fail2ban;
-in
-{
- options.os.srv.fail2ban = {
- enable = lib.mkEnableOption "the NGINX reverse proxy service";
- nginxJails.enable = lib.mkEnableOption "enables Nginx basic-auth and botsearch jails" // {
- default = true;
- };
- };
-
- config = lib.mkIf cfg.enable {
- assertions = [
- {
- assertion = config.networking.firewall.enable || config.networking.nftables.enable;
- message = "Fail2ban requires the NixOS firewall or nftables to be enabled to block IPs.";
- }
- {
- assertion = cfg.nginxJails.enable -> config.os.srv.nginx.enable;
- message = "Fail2ban Nginx jails require your custom Nginx service to be enabled.";
- }
- ];
-
- services.fail2ban = {
- enable = true;
-
- bantime = "24h";
- # findtime = "10m";
- maxretry = 5;
-
- banaction = "nftables-multiport";
-
- ignoreIP = [ "10.0.0.0/16" ];
-
- jails = lib.mkMerge [
- {
- sshd = {
- enabled = true;
- settings = {
- maxretry = 3;
- };
- };
- }
-
- (lib.mkIf cfg.nginxJails.enable {
- nginx-http-auth = {
- enabled = true;
- settings = {
- port = "http,https";
- filter = "nginx-http-auth";
- maxretry = 5;
- };
- };
-
- nginx-botsearch = {
- enabled = true;
- settings = {
- port = "http,https";
- filter = "nginx-botsearch";
- maxretry = 3;
- };
- };
- })
- ];
- };
- };
-}