You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
53 lines
1.3 KiB
Nix
53 lines
1.3 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
inherit (lib) mkIf mkMerge mkThenElse;
|
|
cfg = config.r6d.config-generator;
|
|
computers = config.r6d.computers;
|
|
profiles = config.r6d.profiles;
|
|
|
|
ignoreip = "pedro.dubronetwork.fr cube.dubronetwork.fr voyage.prunetwork.fr xray.prunetwork.fr 192.168.0.0/16 172.16.0.0/16";
|
|
destemail = "admins@dubronetwork.fr";
|
|
in
|
|
|
|
mkIf cfg.fail2ban {
|
|
|
|
# Gestion de fail2ban
|
|
# Services
|
|
services = {
|
|
fail2ban = {
|
|
enable = true;
|
|
jails = {
|
|
DEFAULT = ''
|
|
# "ignoreip" can be an IP address, a CIDR mask or a DNS host
|
|
ignoreip = 127.0.0.1/8 ${ignoreip}
|
|
|
|
# 1 jour
|
|
# bantime = 86400
|
|
# 5 jours
|
|
bantime = 432000
|
|
|
|
maxretry = 3
|
|
|
|
destemail = ${destemail}
|
|
|
|
# https://github.com/Baughn/nixpkgs/blob/master/nixos/modules/services/security/fail2ban.nix
|
|
findtime = 600
|
|
maxretry = 3
|
|
backend = systemd
|
|
enabled = true
|
|
'';
|
|
ssh-route = ''
|
|
filter = sshd
|
|
action = route[blocktype=blackhole]
|
|
maxretry = 3
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
# https://github.com/NixOS/nixpkgs/issues/8437
|
|
services.fail2ban.jails.ssh-iptables = "enabled = true";
|
|
services.fail2ban.jails.mail-whois-lines = "enabled = true";
|
|
}
|