sorceress
/
nix-infra
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Configure fail2ban

This commit is contained in:
Agatha Lovelace 2023-03-06 20:40:04 +01:00
parent a7a5b5e783
commit f334b2027a
Signed by: sorceress
GPG Key ID: 01D0B3AB10CED4F8
1 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
common/fragments/fail2ban.nix
View File

@ -1,9 +1,28 @@
{ config, pkgs, ... }: {
services.fail2ban = {
enable = true;
maxretry = 5;
maxretry = 10;
ignoreIP = [ "127.0.0.0/8" "10.0.0.0/8" "192.168.0.0/16" "78.94.116.222" ];
bantime-increment.enable = true;
jails = {
nginx-bad-request = ''
enabled = true
action = iptables[type=allports]
'';
grafana = ''
enabled = true
action = iptables[type=allports]
'';
};
};
# Workaround for nginx-bad-request not being included
environment.etc."fail2ban/filter.d/nginx-bad-request.conf".source =
pkgs.fetchurl {
url =
"https://raw.githubusercontent.com/fail2ban/fail2ban/master/config/filter.d/nginx-bad-request.conf";
sha256 = "sha256-fCxNQpN+IAY+2kfeOmunmtipxTjS0gHauTBIKiCtjDY=";
};
}