]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/fail2ban.nix
nix: update input julm-nix
[sourcephile-nix.git] / hosts / losurdo / fail2ban.nix
1 { pkgs, hosts, ... }:
2 {
3 services.openssh.settings.LogLevel = "VERBOSE";
4 services.postgresql.logLinePrefix = "%h ";
5 /*
6 systemd.services.nftables.postStart = '' systemctl reload fail2ban '';
7 */
8 services.fail2ban = {
9 enable = true;
10 banaction = "nftables-multiport";
11 banaction-allports = "nftables-allports";
12 bantime-increment = {
13 enable = true;
14 factor = "1";
15 formula = "ban.Time * (1 << min(ban.Count, 20)) * banFactor";
16 maxtime = "1y";
17 overalljails = false;
18 rndtime = "";
19 };
20 packageFirewall = pkgs.nftables;
21 ignoreIP = [
22 #"0.0.0.0/8"
23 #"10.0.0.0/8"
24 "127.0.0.0/8"
25 #"169.254.0.0/16"
26 #"172.16.0.0/12"
27 #"192.0.2.0/24"
28 "192.168.0.0/16"
29 #"224.0.0.0/3"
30 #"240.0.0.0/5"
31 hosts.mermet._module.args.ipv4
32 "losurdo.sourcephile.fr"
33 ];
34 jails = {
35 DEFAULT = ''
36 '';
37 sshd = ''
38 enabled = true
39 bantime = 5m
40 findtime = 1d
41 maxretry = 1
42 mode = aggressive
43 '';
44 postgresql = ''
45 enabled = true
46 bantime = 1m
47 filter = postgresql
48 findtime = 1d
49 port = 5432
50 '';
51 };
52 };
53 environment.etc."fail2ban/action.d/nftables-common.local".text = ''
54 [Init]
55 blocktype = drop
56 '';
57 environment.etc."fail2ban/filter.d/postgresql.local".text = ''
58 [INCLUDES]
59 before = common.conf
60 [DEFAULT]
61 _daemon = postgresql-start
62 [Definition]
63 journalmatch = _SYSTEMD_UNIT=postgresql.service + _COMM=postgres
64 prefregex = ^<F-MLFID>%(__prefix_line)s</F-MLFID><F-CONTENT>.+</F-CONTENT>$
65 failregex = ^<HOST>\s+FATAL:\s*no pg_hba.conf entry for host.+$
66 ^<HOST>\s+FATAL:\s*no PostgreSQL user name specified in startup packet.+$
67 ^<HOST>\s+FATAL:\s*password authentication failed for user.+$
68 ^<HOST>\s+FATAL:\s*unsupported frontend protocol.+$
69 maxlines = 1
70 #ignoreregex = duration:
71 '';
72 }