From d380e06cba34c94b6ee4bf348545514003b6ce61 Mon Sep 17 00:00:00 2001
From: Henrik Lissner <henrik@lissner.net>
Date: Sat, 30 Jan 2021 04:41:21 -0500
Subject: [PATCH] Make fail2ban defaults less forgiving

---
 modules/services/fail2ban.nix | 17 ++++++++++++-----
 modules/services/gitea.nix    |  2 --
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/modules/services/fail2ban.nix b/modules/services/fail2ban.nix
index 8259d4ad..ab7a56d1 100644
--- a/modules/services/fail2ban.nix
+++ b/modules/services/fail2ban.nix
@@ -12,11 +12,18 @@ in {
     services.fail2ban = {
       enable = true;
       ignoreIP = [ "127.0.0.1/16" "192.168.1.0/24" ];
-      jails.DEFAULT = ''
-        blocktype = DROP
-        bantime = 7200
-        findtime = 7200
-      '';
+      banaction-allports = "iptables-allports";
+      jails = {
+        DEFAULT = ''
+          blocktype = DROP
+          bantime = 6h
+          findtime = 15m
+        '';
+        sshd = ''
+          bantime = 24h
+          findtime = 1h
+        '';
+      };
     };
 
     # Extra filters
diff --git a/modules/services/gitea.nix b/modules/services/gitea.nix
index 3eaaabd4..f4aaea0c 100644
--- a/modules/services/gitea.nix
+++ b/modules/services/gitea.nix
@@ -35,8 +35,6 @@ in {
       enabled = true
       filter = gitea
       logpath = ${config.services.gitea.log.rootPath}/gitea.log
-      bantime = 1800
-      findtime = 3600
       banaction = %(banaction_allports)s
     '';