wireguard and fail2ban

hosts/falkenstein-1/default.nix

@@ -5,7 +5,8 @@
     [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ./modules/backup
+      # ./modules/backup
+      ./modules/fail2ban
       ./modules/mail
       ./modules/networks
       ./modules/nginx

hosts/falkenstein-1/modules/backup/default.nix

@@ -5,8 +5,6 @@
   services.borgmatic = {
     enable = true;
     settings = {
-      # fix failing check
-      location = null;
       source_directories = [
         "/var/lib"
         "/var/log"

hosts/falkenstein-1/modules/fail2ban/default.nix

@@ -0,0 +1,25 @@
+{ ... }:
+{
+  services.fail2ban = {
+    enable = true;
+    bantime = "10m";
+    bantime-increment = {
+      enable = true;
+    };
+    jails = {
+      dovecot = ''
+        enabled = true
+        # aggressive mode add blocking for aborted connections
+        filter = dovecot[mode=aggressive]
+        bantime = 10m
+        maxretry = 3
+      '';
+      postfix = ''
+        enabled = true
+        filter = postfix[mode=aggressive]
+        maxretry = 3
+      '';
+    };
+  };
+}
+

hosts/falkenstein-1/modules/networks/default.nix

@@ -42,8 +42,7 @@
     netdevs."30-dorm" = {
       netdevConfig = {
         Kind = "wireguard";
-        Name = "dorm";
-        Description = "WireGuard to my Dorm Infra";
+        Name = "wg0";
       };
       wireguardConfig = {
         PrivateKeyFile = config.sops.secrets."wireguard/dorm/private".path;
@@ -52,29 +51,29 @@
       wireguardPeers = [
         {
           wireguardPeerConfig = {
-            PublicKey = "vUmworuJFHjB4KUdkucQ+nzqO2ysARLomq4UuK1n430=";
+            PublicKey = "Z5lwwHTCDr6OF4lfaCdSHNveunOn4RzuOQeyB+El9mQ=";
             PresharedKeyFile = config.sops.secrets."wireguard/dorm/preshared".path;
             Endpoint = "dorm.vpn.rfive.de:51820";
-            AllowedIPs = "10.10.10.0/24, 192.168.10.0/24";
+            AllowedIPs = "192.168.42.0/24, 192.168.43.0/24";
           };
         }
       ];
     };
     networks."30-dorm" = {
-      matchConfig.Name = "dorm";
+      matchConfig.Name = "wg0";
       networkConfig = {
-        DNS = "192.168.10.1";
+        DNS = "192.168.42.1";
       };
       addresses = [
         {
           addressConfig = {
-            Address = "10.10.10.4/24";
+            Address = "192.168.43.4/24";
             RouteMetric = 30;
           };
         }
       ];
       routes = [
-        { routeConfig = { Gateway = "0.0.0.0"; Destination = "192.168.10.0/24"; Metric = 30; }; }
+        { routeConfig = { Gateway = "0.0.0.0"; Destination = "192.168.42.0/24"; Metric = 30; }; }
       ];
     };
   };

hosts/falkenstein-1/modules/purge/default.nix

@@ -3,7 +3,7 @@ let
   domain = "purge.${config.networking.domain}";
 in
 {
-  sops.secrets."purge/token".owner = "purge";
+  sops.secrets."purge/token" = { };
   services.purge = {
     enable = true;
     discord = {