diff --git a/modules/services/fail2ban.nix b/modules/services/fail2ban.nix index ab7a56d1..038ef2d9 100644 --- a/modules/services/fail2ban.nix +++ b/modules/services/fail2ban.nix @@ -35,11 +35,13 @@ in { [Definition] failregex = ^.*Username or password is incorrect\. Try again\. IP: \. Username:.*$ ignoreregex = + journalmatch = _SYSTEMD_UNIT=bitwarden_rs.service ''; "fail2ban/filter.d/gitea.conf".text = '' [Definition] failregex = .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from ignoreregex = + journalmatch = _SYSTEMD_UNIT=gitea.service ''; }; }; diff --git a/modules/services/gitea.nix b/modules/services/gitea.nix index f4aaea0c..c718e462 100644 --- a/modules/services/gitea.nix +++ b/modules/services/gitea.nix @@ -26,7 +26,7 @@ in { # We're assuming SSL-only connectivity cookieSecure = true; - # Only log what's important + # Only log what's important, but Info is necessary for fail2ban to work log.level = "Info"; settings.server.DISABLE_ROUTER_LOG = true; }; @@ -34,7 +34,6 @@ in { services.fail2ban.jails.gitea = '' enabled = true filter = gitea - logpath = ${config.services.gitea.log.rootPath}/gitea.log banaction = %(banaction_allports)s '';