nix: update switch from julm-nix

[sourcephile-nix.git] / hosts / mermet / fail2ban.nix

diff --git a/hosts/mermet/fail2ban.nix b/hosts/mermet/fail2ban.nix
index 75ec45f6310e682e964b160bc032a5a967382052..01e83189c3fceeab593faa20a85ad40c9b9ee16d 100644 (file)
--- a/hosts/mermet/fail2ban.nix
+++ b/hosts/mermet/fail2ban.nix
@@ -1,51 +1,49 @@
-{ pkgs, lib, config, hosts, ... }:
+{ pkgs, hosts, ... }:
 {
-services.openssh.logLevel = "VERBOSE";
-/*
-systemd.services.nftables.postStart = ''
-  systemctl reload fail2ban
-'';
-*/
-services.fail2ban = {
-  enable = true;
-  banaction = "nftables-multiport";
-  banaction-allports = "nftables-allports";
-  bantime-increment = {
-    enable = true;
-    factor = "1";
-    formula = "ban.Time * (1 << min(ban.Count, 20)) * banFactor";
-    maxtime = "1y";
-    multipliers = "";
-    overalljails = false;
-    rndtime = "";
-  };
-  packageFirewall = pkgs.nftables;
-  ignoreIP = [
-    hosts.mermet.extraArgs.ipv4
-    hosts.losurdo.extraArgs.wireguard.wg-intra.ipv4
-    "losurdo.sourcephile.fr"
-    "vpn.riseup.net"
-  ];
-  jails = {
-    DEFAULT = ''
+  services.openssh.logLevel = "VERBOSE";
+  /*
+    systemd.services.nftables.postStart = ''
+    systemctl reload fail2ban
     '';
-    sshd = ''
-      enabled = true
-      bantime = 5m
-      findtime = 1d
-      maxretry = 1
-      mode = aggressive
-    '';
-    postfix = ''
-      enabled = true
-      bantime = 5m
-      findtime = 1d
-      mode = aggressive
+  */
+  services.fail2ban = {
+    enable = true;
+    banaction = "nftables-multiport";
+    banaction-allports = "nftables-allports";
+    bantime-increment = {
+      enable = true;
+      factor = "1";
+      formula = "ban.Time * (1 << min(ban.Count, 20)) * banFactor";
+      maxtime = "1y";
+      multipliers = "";
+      overalljails = false;
+      rndtime = "";
+    };
+    packageFirewall = pkgs.nftables;
+    ignoreIP = [
+      hosts.mermet._module.args.ipv4
+      "losurdo.sourcephile.fr"
+    ];
+    jails = {
+      DEFAULT = ''
     '';
+      sshd = ''
+        enabled = true
+        bantime = 5m
+        findtime = 1d
+        maxretry = 1
+        mode = aggressive
+      '';
+      postfix = ''
+        enabled = true
+        bantime = 5m
+        findtime = 1d
+        mode = aggressive
+      '';
+    };
   };
-};
-environment.etc."fail2ban/action.d/nftables-common.local".text = ''
-  [Init]
-  blocktype = drop
-'';
+  environment.etc."fail2ban/action.d/nftables-common.local".text = ''
+    [Init]
+    blocktype = drop
+  '';
 }