foodogsquared/nixos-config
1
0
Fork 0
mirror of https://github.com/foo-dogsquared/nixos-config.git synced 2025-04-18 06:19:11 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

hosts/plover: use fail2ban jails settings

Browse Source 
It is nicer compared to the traditional setting with strings.
This commit is contained in:
Gabriel Arazas 2023-07-14 14:41:58 +08:00
parent e43b5a7209
commit 8c08db2eb2
No known key found for this signature in database
GPG Key ID: ADE0C41DAB221FCC
6 changed files with 37 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
hosts/plover/default.nix
View File

@ -67,11 +67,10 @@ in
# We're going to be unforgiving with this one since we only have key
# authentication and password authentication is disabled anyways.
jails.sshd = ''
enabled = true
maxretry = 1
port = 22
'';
jails.sshd.settings = {
enabled = true;
maxretry = 1;
};
};
sops.secrets = lib.getSecrets ./secrets/secrets.yaml {

12
hosts/plover/modules/services/bind.nix
View File

@ -284,12 +284,12 @@ in
security.dhparams.params.bind.bits = 4096;
# Set up a fail2ban which is apparently already available in the package.
services.fail2ban.jails."named-refused" = ''
enabled = true
backend = systemd
filter = named-refused[journalmatch='_SYSTEMD_UNIT=bind.service']
maxretry = 3
'';
services.fail2ban.jails."named-refused".settings = {
enabled = true;
backend = "systemd";
filter = "named-refused[journalmatch='_SYSTEMD_UNIT=bind.service']";
maxretry = 3;
};
# Add the following to be backed up.
services.borgbackup.jobs.services-backup.paths = [ zonesDir ];

12
hosts/plover/modules/services/gitea.nix
View File

@ -179,12 +179,12 @@ in
# Configuring fail2ban for this service which thankfully has a dedicated page
# at https://docs.gitea.io/en-us/fail2ban-setup/.
services.fail2ban.jails = {
gitea = ''
enabled = true
backend = systemd
filter = gitea[journalmatch='_SYSTEMD_UNIT=gitea.service + _COMM=gitea']
maxretry = 8
'';
gitea.settings = {
enabled = true;
backend = "systemd";
filter = "gitea[journalmatch='_SYSTEMD_UNIT=gitea.service + _COMM=gitea']";
maxretry = 8;
};
};
environment.etc = {

12
hosts/plover/modules/services/keycloak.nix
View File

@ -110,12 +110,12 @@ in
# Configuring fail2ban for this services which is only present as a neat
# little hint from its server administration guide.
services.fail2ban.jails = {
keycloak = ''
enabled = true
backend = systemd
filter = keycloak[journalmatch='_SYSTEMD_UNIT=keycloak.service']
maxretry = 3
'';
keycloak.settings = {
enabled = true;
backend = "systemd";
filter = "keycloak[journalmatch='_SYSTEMD_UNIT=keycloak.service']";
maxretry = 3;
};
};
environment.etc = {

6
hosts/plover/modules/services/nginx.nix
View File

@ -36,8 +36,8 @@
# Some fail2ban policies to apply for nginx.
services.fail2ban.jails = {
nginx-http-auth = "enabled = true";
nginx-botsearch = "enabled = true";
nginx-bad-request = "enabled = true";
nginx-http-auth.settings = { enabled = true; };
nginx-botsearch.settings = { enabled = true; };
nginx-bad-request.settings = { enabled = true; };
};
}

24
hosts/plover/modules/services/vaultwarden.nix
View File

@ -159,19 +159,19 @@ in
# Configuring fail2ban for this service which thankfully has a dedicated page
# at https://github.com/dani-garcia/vaultwarden/wiki/Fail2Ban-Setup.
services.fail2ban.jails = {
vaultwarden-user = ''
enabled = true
backend = systemd
filter = vaultwarden-user[journalmatch='_SYSTEMD_UNIT=vaultwarden.service + _COMM=vaultwarden']
maxretry = 5
'';
vaultwarden-user.settings = {
enabled = true;
backend = "systemd";
filter = "vaultwarden-user[journalmatch='_SYSTEMD_UNIT=vaultwarden.service + _COMM=vaultwarden']";
maxretry = 5;
};
vaultwarden-admin = ''
enabled = true
backend = systemd
filter = vaultwarden-admin[journalmatch='_SYSTEMD_UNIT=vaultwarden.service + _COMM=vaultwarden']
maxretry = 3
'';
vaultwarden-admin.settings = {
enabled = true;
backend = "systemd";
filter = "vaultwarden-admin[journalmatch='_SYSTEMD_UNIT=vaultwarden.service + _COMM=vaultwarden']";
maxretry = 3;
};
};
environment.etc = {