From 2da00f3ad5418b1f21542a8935ddcedfd8ffd7e7 Mon Sep 17 00:00:00 2001
From: Henrik Lissner <henrik@lissner.net>
Date: Sat, 30 Jan 2021 05:06:31 -0500
Subject: [PATCH] fail2ban: speed up gitea/bitwarden jails

These services log to syslog, so a log file doesn't exist, meaning
fail2ban must scan the whole journal to seek authentication failure
logs, which is slow! By specifying a journalmatch, it significantly
narrows the scope of their searches.
---
 modules/services/fail2ban.nix | 2 ++
 modules/services/gitea.nix    | 3 +--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/modules/services/fail2ban.nix b/modules/services/fail2ban.nix
index ab7a56d1..038ef2d9 100644
--- a/modules/services/fail2ban.nix
+++ b/modules/services/fail2ban.nix
@@ -35,11 +35,13 @@ in {
         [Definition]
         failregex = ^.*Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$
         ignoreregex =
+        journalmatch = _SYSTEMD_UNIT=bitwarden_rs.service
       '';
       "fail2ban/filter.d/gitea.conf".text = ''
         [Definition]
         failregex =  .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>
         ignoreregex =
+        journalmatch = _SYSTEMD_UNIT=gitea.service
       '';
     };
   };
diff --git a/modules/services/gitea.nix b/modules/services/gitea.nix
index f4aaea0c..c718e462 100644
--- a/modules/services/gitea.nix
+++ b/modules/services/gitea.nix
@@ -26,7 +26,7 @@ in {
 
       # We're assuming SSL-only connectivity
       cookieSecure = true;
-      # Only log what's important
+      # Only log what's important, but Info is necessary for fail2ban to work
       log.level = "Info";
       settings.server.DISABLE_ROUTER_LOG = true;
     };
@@ -34,7 +34,6 @@ in {
     services.fail2ban.jails.gitea = ''
       enabled = true
       filter = gitea
-      logpath = ${config.services.gitea.log.rootPath}/gitea.log
       banaction = %(banaction_allports)s
     '';