1 files changed, 69 insertions, 0 deletions
diff --git a/os/srv/fail2ban.nix b/os/srv/fail2ban.nix
new file mode 100644
index 0000000..9b51ceb
--- /dev/null
+++ b/os/srv/fail2ban.nix
@@ -0,0 +1,69 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.os.srv.fail2ban;
+in
+{
+  options.os.srv.fail2ban = {
+    enable = lib.mkEnableOption "the NGINX reverse proxy service";
+    nginxJails.enable = lib.mkEnableOption "enables Nginx basic-auth and botsearch jails" // {
+      default = true;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.networking.firewall.enable || config.networking.nftables.enable;
+        message = "Fail2ban requires the NixOS firewall or nftables to be enabled to block IPs.";
+      }
+      {
+        assertion = cfg.nginxJails.enable -> config.os.srv.nginx.enable;
+        message = "Fail2ban Nginx jails require your custom Nginx service to be enabled.";
+      }
+    ];
+
+    services.fail2ban = {
+      enable = true;
+
+      bantime = "24h";
+      # findtime = "10m";
+      maxretry = 5;
+
+      banaction = "nftables-multiport";
+
+      ignoreIP = [ "10.0.0.0/16" ];
+
+      jails = lib.mkMerge [
+        {
+          sshd = {
+            enabled = true;
+            settings = {
+              maxretry = 3;
+            };
+          };
+        }
+
+        (lib.mkIf cfg.nginxJails.enable {
+          nginx-http-auth = {
+            enabled = true;
+            settings = {
+              port = "http,https";
+              filter = "nginx-http-auth";
+              maxretry = 5;
+            };
+          };
+
+          nginx-botsearch = {
+            enabled = true;
+            settings = {
+              port = "http,https";
+              filter = "nginx-botsearch";
+              maxretry = 3;
+            };
+          };
+        })
+      ];
+    };
+  };
+}