Add services/fail2ban module

With bitwarden_rs & gitea filters

modules/services/bitwarden.nix

@@ -10,6 +10,13 @@ in {
 
   config = mkIf cfg.enable {
     services.bitwarden_rs.enable = true;
+
     user.extraGroups = [ "bitwarden_rs" ];
+
+    services.fail2ban.jails.bitwarden_rs = ''
+      enabled = true
+      filter = bitwarden_rs
+      port = 80,443,8002
+    '';
   };
 }

modules/services/fail2ban.nix

@@ -0,0 +1,39 @@
+{ config, options, lib, pkgs, ... }:
+
+with lib;
+with lib.my;
+let cfg = config.modules.services.fail2ban;
+in {
+  options.modules.services.fail2ban = {
+    enable = mkBoolOpt false;
+  };
+
+  config = mkIf cfg.enable {
+    services.fail2ban = {
+      enable = true;
+      ignoreIP = [ "127.0.0.1/16" "192.168.1.0/24" ];
+      jails.DEFAULT = ''
+        blocktype = DROP
+        bantime = 7200
+        findtime = 7200
+      '';
+    };
+
+    # Extra filters
+    environment.etc = {
+      "fail2ban/filter.d/bitwarden_rs.conf".text = ''
+        [INCLUDES]
+        before = common.conf
+
+        [Definition]
+        failregex = ^.*Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$
+        ignoreregex =
+      '';
+      "fail2ban/filter.d/gitea.conf".text = ''
+        [Definition]
+        failregex =  .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>
+        ignoreregex =
+      '';
+    };
+  };
+}

modules/services/gitea.nix

@@ -26,10 +26,19 @@ in {
       # We're assuming SSL-only connectivity
       cookieSecure = true;
       # Only log what's important
-      log.level = "Error";
+      log.level = "Info";
       settings.server.DISABLE_ROUTER_LOG = true;
     };
 
     user.extraGroups = [ "gitea" ];
+
+    services.fail2ban.jails.gitea = ''
+      enabled = true
+      filter = gitea
+      logpath = ${config.services.gitea.log.rootPath}/gitea.log
+      bantime = 1800
+      findtime = 3600
+      banaction = %(banaction_allports)s
+    '';
   };
 }