fail2ban: disable tor lists
some people have legimitate interest in accessing our services via tor in case of abuse out of these networks this commit can be reverted
This commit is contained in:
parent
a9d4543da7
commit
85e6ebbc29
|
@ -11,11 +11,6 @@
|
|||
};
|
||||
|
||||
jails = {
|
||||
tor = ''
|
||||
enabled = true
|
||||
bantime = 25h
|
||||
action = nftables-allports
|
||||
'';
|
||||
dovecot = ''
|
||||
enabled = true
|
||||
# aggressive mode to add blocking for aborted connections
|
||||
|
@ -29,30 +24,4 @@
|
|||
'';
|
||||
};
|
||||
};
|
||||
|
||||
environment.etc = {
|
||||
# dummy filter
|
||||
"fail2ban/filter.d/tor.conf".text = ''
|
||||
[Definition]
|
||||
failregex =
|
||||
ignoreregex =
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.services."fail2ban-tor" = {
|
||||
script = ''
|
||||
${lib.getExe pkgs.curl} -fsSL "https://check.torproject.org/torbulkexitlist" | sed '/^#/d' | while read IP; do
|
||||
${config.services.fail2ban.package}/bin/fail2ban-client set "tor" banip "$IP" > /dev/null
|
||||
done
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.timers."fail2ban-tor" = {
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnCalendar = "daily";
|
||||
Persistent = true;
|
||||
Unit = "fail2ban-tor.service";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue