From 177a7eec6f716e450b623a6d1f0e655b12ecb88c Mon Sep 17 00:00:00 2001
From: Henrik Lissner <henrik@lissner.net>
Date: Fri, 1 Jan 2021 21:19:06 -0500
Subject: [PATCH] Add services/fail2ban module

With bitwarden_rs & gitea filters
---
 modules/services/bitwarden.nix |  7 ++++++
 modules/services/fail2ban.nix  | 39 ++++++++++++++++++++++++++++++++++
 modules/services/gitea.nix     | 11 +++++++++-
 3 files changed, 56 insertions(+), 1 deletion(-)
 create mode 100644 modules/services/fail2ban.nix

diff --git a/modules/services/bitwarden.nix b/modules/services/bitwarden.nix
index 2666144f..09027592 100644
--- a/modules/services/bitwarden.nix
+++ b/modules/services/bitwarden.nix
@@ -10,6 +10,13 @@ in {
 
   config = mkIf cfg.enable {
     services.bitwarden_rs.enable = true;
+
     user.extraGroups = [ "bitwarden_rs" ];
+
+    services.fail2ban.jails.bitwarden_rs = ''
+      enabled = true
+      filter = bitwarden_rs
+      port = 80,443,8002
+    '';
   };
 }
diff --git a/modules/services/fail2ban.nix b/modules/services/fail2ban.nix
new file mode 100644
index 00000000..8259d4ad
--- /dev/null
+++ b/modules/services/fail2ban.nix
@@ -0,0 +1,39 @@
+{ config, options, lib, pkgs, ... }:
+
+with lib;
+with lib.my;
+let cfg = config.modules.services.fail2ban;
+in {
+  options.modules.services.fail2ban = {
+    enable = mkBoolOpt false;
+  };
+
+  config = mkIf cfg.enable {
+    services.fail2ban = {
+      enable = true;
+      ignoreIP = [ "127.0.0.1/16" "192.168.1.0/24" ];
+      jails.DEFAULT = ''
+        blocktype = DROP
+        bantime = 7200
+        findtime = 7200
+      '';
+    };
+
+    # Extra filters
+    environment.etc = {
+      "fail2ban/filter.d/bitwarden_rs.conf".text = ''
+        [INCLUDES]
+        before = common.conf
+
+        [Definition]
+        failregex = ^.*Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$
+        ignoreregex =
+      '';
+      "fail2ban/filter.d/gitea.conf".text = ''
+        [Definition]
+        failregex =  .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>
+        ignoreregex =
+      '';
+    };
+  };
+}
diff --git a/modules/services/gitea.nix b/modules/services/gitea.nix
index 9a4a6118..dd5e6de3 100644
--- a/modules/services/gitea.nix
+++ b/modules/services/gitea.nix
@@ -26,10 +26,19 @@ in {
       # We're assuming SSL-only connectivity
       cookieSecure = true;
       # Only log what's important
-      log.level = "Error";
+      log.level = "Info";
       settings.server.DISABLE_ROUTER_LOG = true;
     };
 
     user.extraGroups = [ "gitea" ];
+
+    services.fail2ban.jails.gitea = ''
+      enabled = true
+      filter = gitea
+      logpath = ${config.services.gitea.log.rootPath}/gitea.log
+      bantime = 1800
+      findtime = 3600
+      banaction = %(banaction_allports)s
+    '';
   };
 }