nixos-config/features/network/fail2ban.nix

54 lines
1.6 KiB
Nix
Raw Normal View History

2024-06-15 01:17:53 +02:00
{ config, lib, pkgs, ... }:
with lib;
{
options.features.network.fail2ban.enable = mkOption {
2024-06-15 01:17:53 +02:00
type = lib.types.bool;
default = false;
};
2024-06-15 23:52:21 +02:00
config = mkMerge [
(mkIf config.features.network.fail2ban.enable {
environment.systemPackages = [ pkgs.fail2ban ];
2024-06-15 23:52:21 +02:00
services.fail2ban = {
enable = true;
#package = pkgs.legacy_2311.fail2ban;
2024-06-15 23:52:21 +02:00
jails = { };
};
})
2024-06-15 01:17:53 +02:00
2024-06-15 23:52:21 +02:00
# custom defined jails
# --------------------
# https://github.com/fail2ban/fail2ban/blob/master/config/jail.conf
(mkIf config.features.network.fail2ban.enable {
2024-06-16 00:13:07 +02:00
services.fail2ban.jails.nginx-git-not-found.settings = {
2024-06-15 23:52:21 +02:00
port = "http,https";
logpath = "%(nginx_error_log)s";
};
environment.etc = {
# Defines a filter that detects URL probing by reading the Nginx access log
2024-06-16 00:13:07 +02:00
"fail2ban/filter.d/nginx-git-not-found.local".text = ''
2024-06-15 23:52:21 +02:00
[Definition]
failregex = src_addr="<HOST>".*response_statu="404".*host="git\.ingolf-wagner\.de"
2024-06-16 00:20:45 +02:00
journalmatch = _SYSTEMD_UNIT=nginx.service
2024-06-15 23:52:21 +02:00
'';
2024-06-15 01:17:53 +02:00
};
2024-06-15 23:52:21 +02:00
})
(mkIf config.features.network.fail2ban.enable {
2024-06-16 00:13:07 +02:00
services.fail2ban.jails.nginx-git-bad-request.settings = {
port = "http,https";
logpath = "%(nginx_error_log)s";
};
environment.etc = {
# Defines a filter that detects URL probing by reading the Nginx access log
"fail2ban/filter.d/nginx-git-bad-request.local".text = ''
[Definition]
failregex = src_addr="<HOST>".*response_statu="400".*host="git\.ingolf-wagner\.de"
2024-06-16 00:20:45 +02:00
journalmatch = _SYSTEMD_UNIT=nginx.service
2024-06-16 00:13:07 +02:00
'';
};
})
2024-06-15 23:52:21 +02:00
];
2024-06-15 01:17:53 +02:00
}