From 77d26bdb7e558984779e0d1513cf5ecede2257d0 Mon Sep 17 00:00:00 2001
From: baritone <baritone@mail.spoodythe.one>
Date: Tue, 4 Mar 2025 01:03:56 +0100
Subject: [PATCH] stuf + wake on lan

---
 modules/networking.nix |  3 +++
 services/fail2ban.nix  | 44 ++++++++++++++++++++++++++++++++++--------
 2 files changed, 39 insertions(+), 8 deletions(-)

diff --git a/modules/networking.nix b/modules/networking.nix
index 3639f33..e9a131d 100755
--- a/modules/networking.nix
+++ b/modules/networking.nix
@@ -10,6 +10,9 @@
     allowedUDPPorts = [];
   };
 
+  networking.wakeOnLan.enable = true;
+  networking.enp2s0.wakeOnLan.policy = "magic";
+
   networking.interfaces.enp2s0 = {
     ipv4.addresses = [
       {
diff --git a/services/fail2ban.nix b/services/fail2ban.nix
index 7737852..fe6de25 100644
--- a/services/fail2ban.nix
+++ b/services/fail2ban.nix
@@ -1,7 +1,20 @@
-{config, ...}: {
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: {
   services.fail2ban = {
     enable = true;
 
+    bantime = "24h";
+    bantime-increment = {
+      enable = true;
+      formula = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(banFactor)";
+      maxtime = "6969h";
+      overalljails = true;
+    };
+
     jails = {
       dovecot = lib.mkIf config.services.dovecot2.enable {
         settings = {
@@ -13,14 +26,29 @@
       };
 
       jellyfin = lib.mkIf config.services.jellyfin.enable {
-        backend = "auto";
-        enabled = true;
-        port = [80 443];
-        maxretry = 3;
-        bantime = 86400;
-        findtime = 43200;
-        logpath = "/var/lib/jellyfin/log/*.log";
+        settings = {
+          filter = "jellyfin";
+          backend = "auto";
+          enabled = true;
+          port = "8096,8920";
+          maxretry = 3;
+          bantime = 86400;
+          findtime = 43200;
+          logpath = "/var/lib/jellyfin/log/*.log";
+        };
       };
     };
   };
+
+  environment.etc = {
+    "fail2ban/filter.d/jellyfin.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
+      [Definition]
+      failregex = ^.*Authentication request for .* has been denied \(IP: <ADDR>\)\.
+    '');
+    # Defines a filter that detects URL probing by reading the Nginx access log
+    "fail2ban/filter.d/nginx-url-probe.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
+      [Definition]
+      failregex = ^<HOST>.*(GET /(wp-|admin|boaform|phpmyadmin|\.env|\.git)|\.(dll|so|cfm|asp)|(\?|&)(=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000|=PHPE9568F36-D428-11d2-A769-00AA001ACF42|=PHPE9568F35-D428-11d2-A769-00AA001ACF42|=PHPE9568F34-D428-11d2-A769-00AA001ACF42)|\\x[0-9a-zA-Z]{2})
+    '');
+  };
 }