hosts/mermet/fail2ban.nix

   1 { pkgs, hosts, ... }:
   2 {
   3   services.openssh.settings.LogLevel = "VERBOSE";
   4   /*
   5     systemd.services.nftables.postStart = ''
   6     systemctl reload fail2ban
   7     '';
   8   */
   9   services.fail2ban = {
  10     enable = true;
  11     banaction = "nftables-multiport";
  12     banaction-allports = "nftables-allports";
  13     bantime-increment = {
  14       enable = true;
  15       factor = "1";
  16       formula = "ban.Time * (1 << min(ban.Count, 20)) * banFactor";
  17       maxtime = "1y";
  18       overalljails = false;
  19       rndtime = "";
  20     };
  21     packageFirewall = pkgs.nftables;
  22     ignoreIP = [
  23       hosts.mermet._module.args.ipv4
  24       "losurdo.sourcephile.fr"
  25     ];
  26     jails = {
  27       DEFAULT = ''
  28     '';
  29       sshd = ''
  30         enabled = true
  31         bantime = 5m
  32         findtime = 1d
  33         maxretry = 1
  34         mode = aggressive
  35       '';
  36       postfix = ''
  37         enabled = true
  38         bantime = 5m
  39         findtime = 1d
  40         mode = aggressive
  41       '';
  42     };
  43   };
  44   environment.etc."fail2ban/action.d/nftables-common.local".text = ''
  45     [Init]
  46     blocktype = drop
  47   '';
  48 }