Add services/fail2ban module
With bitwarden_rs & gitea filters
This commit is contained in:
		
							parent
							
								
									25f0d8044a
								
							
						
					
					
						commit
						177a7eec6f
					
				|  | @ -10,6 +10,13 @@ in { | |||
| 
 | ||||
|   config = mkIf cfg.enable { | ||||
|     services.bitwarden_rs.enable = true; | ||||
| 
 | ||||
|     user.extraGroups = [ "bitwarden_rs" ]; | ||||
| 
 | ||||
|     services.fail2ban.jails.bitwarden_rs = '' | ||||
|       enabled = true | ||||
|       filter = bitwarden_rs | ||||
|       port = 80,443,8002 | ||||
|     ''; | ||||
|   }; | ||||
| } | ||||
|  |  | |||
							
								
								
									
										39
									
								
								modules/services/fail2ban.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										39
									
								
								modules/services/fail2ban.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,39 @@ | |||
| { config, options, lib, pkgs, ... }: | ||||
| 
 | ||||
| with lib; | ||||
| with lib.my; | ||||
| let cfg = config.modules.services.fail2ban; | ||||
| in { | ||||
|   options.modules.services.fail2ban = { | ||||
|     enable = mkBoolOpt false; | ||||
|   }; | ||||
| 
 | ||||
|   config = mkIf cfg.enable { | ||||
|     services.fail2ban = { | ||||
|       enable = true; | ||||
|       ignoreIP = [ "127.0.0.1/16" "192.168.1.0/24" ]; | ||||
|       jails.DEFAULT = '' | ||||
|         blocktype = DROP | ||||
|         bantime = 7200 | ||||
|         findtime = 7200 | ||||
|       ''; | ||||
|     }; | ||||
| 
 | ||||
|     # Extra filters | ||||
|     environment.etc = { | ||||
|       "fail2ban/filter.d/bitwarden_rs.conf".text = '' | ||||
|         [INCLUDES] | ||||
|         before = common.conf | ||||
| 
 | ||||
|         [Definition] | ||||
|         failregex = ^.*Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$ | ||||
|         ignoreregex = | ||||
|       ''; | ||||
|       "fail2ban/filter.d/gitea.conf".text = '' | ||||
|         [Definition] | ||||
|         failregex =  .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST> | ||||
|         ignoreregex = | ||||
|       ''; | ||||
|     }; | ||||
|   }; | ||||
| } | ||||
|  | @ -26,10 +26,19 @@ in { | |||
|       # We're assuming SSL-only connectivity | ||||
|       cookieSecure = true; | ||||
|       # Only log what's important | ||||
|       log.level = "Error"; | ||||
|       log.level = "Info"; | ||||
|       settings.server.DISABLE_ROUTER_LOG = true; | ||||
|     }; | ||||
| 
 | ||||
|     user.extraGroups = [ "gitea" ]; | ||||
| 
 | ||||
|     services.fail2ban.jails.gitea = '' | ||||
|       enabled = true | ||||
|       filter = gitea | ||||
|       logpath = ${config.services.gitea.log.rootPath}/gitea.log | ||||
|       bantime = 1800 | ||||
|       findtime = 3600 | ||||
|       banaction = %(banaction_allports)s | ||||
|     ''; | ||||
|   }; | ||||
| } | ||||
|  |  | |||
		Loading…
	
		Reference in a new issue