foodogsquared/nixos-config
1
0
Fork 0
mirror of https://github.com/foo-dogsquared/nixos-config.git synced 2025-04-19 06:19:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

hosts/plover: use fail2ban jails settings

Browse Source 
It is nicer compared to the traditional setting with strings.
This commit is contained in:
Gabriel Arazas 2023-07-14 14:41:58 +08:00
parent e43b5a7209
commit 8c08db2eb2
No known key found for this signature in database
GPG Key ID: ADE0C41DAB221FCC
6 changed files with 37 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
hosts/plover/default.nix
View File

@ -67,11 +67,10 @@ in
# We're going to be unforgiving with this one since we only have key # We're going to be unforgiving with this one since we only have key
# authentication and password authentication is disabled anyways. # authentication and password authentication is disabled anyways.
jails.sshd = '' jails.sshd.settings = {
enabled = true enabled = true;
maxretry = 1 maxretry = 1;
port = 22 };
'';
}; };
sops.secrets = lib.getSecrets ./secrets/secrets.yaml { sops.secrets = lib.getSecrets ./secrets/secrets.yaml {

12
hosts/plover/modules/services/bind.nix
View File

@ -284,12 +284,12 @@ in
security.dhparams.params.bind.bits = 4096; security.dhparams.params.bind.bits = 4096;
# Set up a fail2ban which is apparently already available in the package. # Set up a fail2ban which is apparently already available in the package.
services.fail2ban.jails."named-refused" = '' services.fail2ban.jails."named-refused".settings = {
enabled = true enabled = true;
backend = systemd backend = "systemd";
filter = named-refused[journalmatch='_SYSTEMD_UNIT=bind.service'] filter = "named-refused[journalmatch='_SYSTEMD_UNIT=bind.service']";
maxretry = 3 maxretry = 3;
''; };
# Add the following to be backed up. # Add the following to be backed up.
services.borgbackup.jobs.services-backup.paths = [ zonesDir ]; services.borgbackup.jobs.services-backup.paths = [ zonesDir ];

12
hosts/plover/modules/services/gitea.nix
View File

@ -179,12 +179,12 @@ in
# Configuring fail2ban for this service which thankfully has a dedicated page # Configuring fail2ban for this service which thankfully has a dedicated page
# at https://docs.gitea.io/en-us/fail2ban-setup/. # at https://docs.gitea.io/en-us/fail2ban-setup/.
services.fail2ban.jails = { services.fail2ban.jails = {
gitea = '' gitea.settings = {
enabled = true enabled = true;
backend = systemd backend = "systemd";
filter = gitea[journalmatch='_SYSTEMD_UNIT=gitea.service + _COMM=gitea'] filter = "gitea[journalmatch='_SYSTEMD_UNIT=gitea.service + _COMM=gitea']";
maxretry = 8 maxretry = 8;
''; };
}; };
environment.etc = { environment.etc = {

12
hosts/plover/modules/services/keycloak.nix
View File

@ -110,12 +110,12 @@ in
# Configuring fail2ban for this services which is only present as a neat # Configuring fail2ban for this services which is only present as a neat
# little hint from its server administration guide. # little hint from its server administration guide.
services.fail2ban.jails = { services.fail2ban.jails = {
keycloak = '' keycloak.settings = {
enabled = true enabled = true;
backend = systemd backend = "systemd";
filter = keycloak[journalmatch='_SYSTEMD_UNIT=keycloak.service'] filter = "keycloak[journalmatch='_SYSTEMD_UNIT=keycloak.service']";
maxretry = 3 maxretry = 3;
''; };
}; };
environment.etc = { environment.etc = {

6
hosts/plover/modules/services/nginx.nix
View File

@ -36,8 +36,8 @@
# Some fail2ban policies to apply for nginx. # Some fail2ban policies to apply for nginx.
services.fail2ban.jails = { services.fail2ban.jails = {
nginx-http-auth = "enabled = true"; nginx-http-auth.settings = { enabled = true; };
nginx-botsearch = "enabled = true"; nginx-botsearch.settings = { enabled = true; };
nginx-bad-request = "enabled = true"; nginx-bad-request.settings = { enabled = true; };
}; };
} }

24
hosts/plover/modules/services/vaultwarden.nix
View File

@ -159,19 +159,19 @@ in
# Configuring fail2ban for this service which thankfully has a dedicated page # Configuring fail2ban for this service which thankfully has a dedicated page
# at https://github.com/dani-garcia/vaultwarden/wiki/Fail2Ban-Setup. # at https://github.com/dani-garcia/vaultwarden/wiki/Fail2Ban-Setup.
services.fail2ban.jails = { services.fail2ban.jails = {
vaultwarden-user = '' vaultwarden-user.settings = {
enabled = true enabled = true;
backend = systemd backend = "systemd";
filter = vaultwarden-user[journalmatch='_SYSTEMD_UNIT=vaultwarden.service + _COMM=vaultwarden'] filter = "vaultwarden-user[journalmatch='_SYSTEMD_UNIT=vaultwarden.service + _COMM=vaultwarden']";
maxretry = 5 maxretry = 5;
''; };
vaultwarden-admin = '' vaultwarden-admin.settings = {
enabled = true enabled = true;
backend = systemd backend = "systemd";
filter = vaultwarden-admin[journalmatch='_SYSTEMD_UNIT=vaultwarden.service + _COMM=vaultwarden'] filter = "vaultwarden-admin[journalmatch='_SYSTEMD_UNIT=vaultwarden.service + _COMM=vaultwarden']";
maxretry = 3 maxretry = 3;
''; };
}; };
environment.etc = { environment.etc = {