]> Git — Sourcephile - sourcephile-nix.git/blob - machines/mermet/fail2ban.nix
netns: update
[sourcephile-nix.git] / machines / mermet / fail2ban.nix
1 { pkgs, lib, config, machines, ... }:
2 {
3 services.openssh.logLevel = "VERBOSE";
4 /*
5 systemd.services.nftables.postStart = ''
6 systemctl reload fail2ban
7 '';
8 */
9 services.fail2ban = {
10 enable = true;
11 banaction = "nftables-multiport";
12 banaction-allports = "nftables-allports";
13 bantime-increment = {
14 enable = true;
15 factor = "1";
16 formula = "ban.Time * (1 << min(ban.Count, 20)) * banFactor";
17 maxtime = "1y";
18 multipliers = "";
19 overalljails = false;
20 rndtime = "";
21 };
22 packageFirewall = pkgs.nftables;
23 ignoreIP = [
24 machines.mermet.extraArgs.ipv4
25 "losurdo.sourcephile.fr"
26 "vpn.riseup.net"
27 ];
28 jails = {
29 DEFAULT = ''
30 '';
31 sshd = ''
32 enabled = true
33 bantime = 5m
34 findtime = 1d
35 maxretry = 1
36 mode = aggressive
37 '';
38 postfix = ''
39 enabled = true
40 bantime = 5m
41 findtime = 1d
42 mode = aggressive
43 '';
44 };
45 };
46 environment.etc."fail2ban/action.d/nftables-common.local".text = ''
47 [Init]
48 blocktype = drop
49 '';
50 }