23 lines
499 B
Nix
23 lines
499 B
Nix
{ config, ... }:
|
|
{
|
|
services.openssh = {
|
|
enable = true;
|
|
passwordAuthentication = false;
|
|
permitRootLogin = "no";
|
|
};
|
|
networking.firewall.allowedTCPPorts = [ 80 443 22 ]; # ssh and website
|
|
security.sudo.wheelNeedsPassword = false; # needed for deploy-rs
|
|
|
|
security.acme.defaults.email = "anish+acme@lakhwara.com";
|
|
security.acme.acceptTerms = true;
|
|
|
|
services.fail2ban = {
|
|
enable = true;
|
|
maxretry = 5;
|
|
ignoreIP = [
|
|
"127.0.0.0/8"
|
|
"10.0.0.0/8"
|
|
];
|
|
};
|
|
}
|