gortium/infra
1
1
Fork 0
Code Issues 13 Pull Requests 21 Actions Packages Projects 1 Releases Wiki Activity

fix: restructure fail2ban jails per NixOS module - recidive in jails, settings attr, str bantime

Browse Source
This commit is contained in:
Hermes Agent
2026-05-01 03:59:32 +00:00
parent 2477acdfc7
commit 260b2d2756
1 changed files with 30 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
hosts/lazyworkhorse/configuration.nix
View File

@@ -357,47 +357,55 @@
services.fail2ban = {
enable = true;
maxretry = 3;
bantime = 3600;
bantime = "1h";
banaction = "iptables-multiport";
# Ban repeat offenders for 1 week
recidive = {
enabled = true;
filter = "recidive";
logpath = "/var/log/fail2ban.log";
bantime = 604800;
findtime = 86400;
maxretry = 3;
};
jails = {
# SSH brute force protection (uses systemd journal backend)
sshd = {
enabled = true;
filter = "sshd";
port = "2424";
maxretry = 3;
bantime = 3600;
settings = {
port = "2424";
maxretry = 3;
bantime = "1h";
};
};
# Recidive - ban repeat offenders for 1 week
recidive = {
enabled = true;
filter = "recidive";
settings = {
logpath = "/var/log/fail2ban.log";
bantime = "1w";
findtime = "1d";
maxretry = 3;
};
};
# HTTP authentication failures (Traefik)
http-auth = {
enabled = true;
filter = "traefik-auth";
port = "80,443";
logpath = "/var/log/traefik/access.log";
maxretry = 5;
bantime = 3600;
settings = {
port = "80,443";
logpath = "/var/log/traefik/access.log";
maxretry = 5;
bantime = "1h";
};
};
# HTTP scanning/attacks (Traefik)
http-botsearch = {
enabled = true;
filter = "traefik-botsearch";
port = "80,443";
logpath = [ "/var/log/traefik/access.log" ];
maxretry = 2;
bantime = 7200;
settings = {
port = "80,443";
logpath = [ "/var/log/traefik/access.log" ];
maxretry = 2;
bantime = "2h";
};
};
};
};