palo/nixos-config
palo/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fiddeling around with fail2ban and unlock via ssh

Browse source
This commit is contained in:
Ingolf Wagner 2024-08-02 23:40:57 +02:00
parent cff3407b46
commit 46a2b0cfa1
No known key found for this signature in database
GPG key ID: 76BF5F1928B9618B
5 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
components/network/fail2ban.nix
View file

@ -11,6 +11,7 @@ with lib;
environment.systemPackages = [ pkgs.fail2ban pkgs.ipset ]; environment.systemPackages = [ pkgs.fail2ban pkgs.ipset ];
services.fail2ban = { services.fail2ban = {
enable = true; enable = true;
#package = pkgs.legacy_2311.fail2ban;
jails = { }; jails = { };
}; };
}) })

1
components/network/sshd/default.nix
View file

@ -74,6 +74,7 @@ in
(mkIf cfg.sshguard.enable { (mkIf cfg.sshguard.enable {
environment.systemPackages = [ pkgs.ipset ]; environment.systemPackages = [ pkgs.ipset ];
services.sshguard.enable = lib.mkDefault true; services.sshguard.enable = lib.mkDefault true;
#boot.kernelModules = ["xt_set"];
}) })
(mkIf (cfg.onlyTincAccess && cfg.enable) { (mkIf (cfg.onlyTincAccess && cfg.enable) {

2
components/nixos/tor-ssh.nix
View file

@ -64,7 +64,7 @@ with types;
#}; #};
# tor setup # tor setup
clan.core.facts.services.initrd_tor = factsGenerator.tor { name = "initrd"; }; clan.core.facts.services.initrd_tor = factsGenerator.tor { name = ""; };
boot.initrd.secrets = { boot.initrd.secrets = {
"/etc/tor/onion/bootup/tor.priv" = config.clan.core.facts.services.initrd_tor.secret."tor.initrd.priv".path; "/etc/tor/onion/bootup/tor.priv" = config.clan.core.facts.services.initrd_tor.secret."tor.initrd.priv".path;

4
flake.nix
View file

@ -462,8 +462,8 @@
homeManagerModules homeManagerModules
stylixModules stylixModules
srvos.nixosModules.hardware-hetzner-online-intel srvos.nixosModules.hardware-hetzner-online-intel
srvos.nixosModules.server #srvos.nixosModules.server
srvos.nixosModules.mixins-terminfo #srvos.nixosModules.mixins-terminfo
{ {
# not needed for servers in general # not needed for servers in general
boot.initrd.systemd.emergencyAccess = false; boot.initrd.systemd.emergencyAccess = false;

3
machines/orbi/configuration.nix
View file

@ -53,6 +53,9 @@
components.network.fail2ban.enable = true; components.network.fail2ban.enable = true;
components.network.sshd.sshguard.enable = false; components.network.sshd.sshguard.enable = false;
components.nixos.boot.enable = true;
components.nixos.boot.tor.enable = false;
components.monitor.enable = true; components.monitor.enable = true;
networking.firewall.interfaces.wg0.allowedTCPPorts = [ 4317 ]; networking.firewall.interfaces.wg0.allowedTCPPorts = [ 4317 ];
networking.firewall.interfaces.wg0.allowedUDPPorts = [ 4317 ]; networking.firewall.interfaces.wg0.allowedUDPPorts = [ 4317 ];