2da00f3ad5
These services log to syslog, so a log file doesn't exist, meaning fail2ban must scan the whole journal to seek authentication failure logs, which is slow! By specifying a journalmatch, it significantly narrows the scope of their searches.
48 lines
1.1 KiB
Nix
48 lines
1.1 KiB
Nix
{ options, config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
with lib.my;
|
|
let cfg = config.modules.services.gitea;
|
|
in {
|
|
options.modules.services.gitea = {
|
|
enable = mkBoolOpt false;
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
# Allows git@... clone addresses rather than gitea@...
|
|
users.users.git = {
|
|
useDefaultShell = true;
|
|
home = "/var/lib/gitea";
|
|
group = "gitea";
|
|
};
|
|
|
|
user.extraGroups = [ "gitea" ];
|
|
|
|
services.gitea = {
|
|
enable = true;
|
|
|
|
user = "git";
|
|
database.user = "git";
|
|
|
|
# We're assuming SSL-only connectivity
|
|
cookieSecure = true;
|
|
# Only log what's important, but Info is necessary for fail2ban to work
|
|
log.level = "Info";
|
|
settings.server.DISABLE_ROUTER_LOG = true;
|
|
};
|
|
|
|
services.fail2ban.jails.gitea = ''
|
|
enabled = true
|
|
filter = gitea
|
|
banaction = %(banaction_allports)s
|
|
'';
|
|
|
|
modules.backup.targets.gitea = {
|
|
baseDir = config.users.users.git.home;
|
|
owner = "git";
|
|
targets = [ "repositories" "data" ];
|
|
suspendServices = [ "gitea" ];
|
|
};
|
|
};
|
|
}
|