setup fail2ban #74

Merged
fugidev merged 1 commit from fail2ban into main 2023-10-04 19:03:50 +02:00
2 changed files with 41 additions and 0 deletions

View file

@ -56,6 +56,7 @@
./modules/course-management.nix
./modules/courses-phil.nix
./modules/gitea.nix
./modules/fail2ban.nix
{
sops.defaultSopsFile = ./secrets/quitte.yaml;
}

40
modules/fail2ban.nix Normal file
View file

@ -0,0 +1,40 @@
{ config, lib, pkgs, ... }:
{
services.fail2ban = {
enable = true;
jails = {
tor = ''
enabled = true
bantime = 25h
action = iptables-allports[name=fail2banTOR, protocol=all]
'';
};
};
environment.etc = {
# dummy filter
"fail2ban/filter.d/tor.conf".text = ''
[Definition]
failregex =
ignoreregex =
'';
};
systemd.services."fail2ban-tor" = {
script = ''
${lib.getExe pkgs.curl} -fsSL "https://check.torproject.org/torbulkexitlist" | sed '/^#/d' | while read IP; do
${config.services.fail2ban.package}/bin/fail2ban-client set "tor" banip "$IP" > /dev/null
done
'';
};
systemd.timers."fail2ban-tor" = {
wantedBy = [ "timers.target" ];
timerConfig = {
OnCalendar = "daily";
Persistent = true;
Unit = "fail2ban-tor.service";
};
};
}