helm/profiles/server/default.nix
2022-10-03 23:59:21 +10:00

23 lines
499 B
Nix

{ config, ... }:
{
services.openssh = {
enable = true;
passwordAuthentication = false;
permitRootLogin = "no";
};
networking.firewall.allowedTCPPorts = [ 80 443 22 ]; # ssh and website
security.sudo.wheelNeedsPassword = false; # needed for deploy-rs
security.acme.defaults.email = "anish+acme@lakhwara.com";
security.acme.acceptTerms = true;
services.fail2ban = {
enable = true;
maxretry = 5;
ignoreIP = [
"127.0.0.0/8"
"10.0.0.0/8"
];
};
}