From c32a1846e0b232f60d91018570c57096379ee80a Mon Sep 17 00:00:00 2001
From: Henrik Lissner <henrik@lissner.net>
Date: Sun, 31 Jan 2021 18:20:46 -0500
Subject: [PATCH] Tweak fail2ban defaults

---
 modules/services/fail2ban.nix | 22 ++++++++++------------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/modules/services/fail2ban.nix b/modules/services/fail2ban.nix
index 4a036125..3c082e37 100644
--- a/modules/services/fail2ban.nix
+++ b/modules/services/fail2ban.nix
@@ -13,19 +13,17 @@ in {
       enable = true;
       ignoreIP = [ "127.0.0.1/16" "192.168.1.0/24" ];
       banaction-allports = "iptables-allports";
-      jails = {
-        DEFAULT = ''
-          blocktype = DROP
-          bantime = 6h
-          findtime = 15m
-        '';
-        # Harsher defaults for sshd because it's all key based. Auth failures
-        # are less likely to be legit here.
-        sshd = ''
-          bantime = 24h
-          findtime = 1h
-        '';
+      bantime-increment = {
+        enable = true;
+        maxtime = "168h";
+        factor = "4";
       };
+      jails.DEFAULT = ''
+        maxretry = 5
+        blocktype = DROP
+        bantime = 1h
+        findtime = 1h
+      '';
     };
 
     # Extra filters