spoody/server-configuration
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

fail2ban banning works now

Browse source
This commit is contained in:
baritone 2025-03-27 15:07:32 +01:00
parent 80e689dc7b
commit e0a1fceb84
2 changed files with 27 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
services/fail2ban.nix
View file

@ -28,23 +28,44 @@
jellyfin = lib.mkIf config.services.jellyfin.enable { jellyfin = lib.mkIf config.services.jellyfin.enable {
settings = { settings = {
filter = "jellyfin"; filter = "jellyfin";
backend = "auto"; backend = "systemd";
enabled = true; enabled = true;
port = "8096,8920"; port = "80,443";
maxretry = 3; maxretry = 8;
bantime = 86400; bantime = "24h";
findtime = 43200; findtime = "30m";
logpath = "/var/lib/jellyfin/log/*.log"; journalmatch = "_SYSTEMD_UNIT=jellyfin.service";
# logpath = "/var/lib/jellyfin/log/*.log";
};
};
forgejo = lib.mkIf config.services.forgejo.enable {
settings = {
filter = "forgejo";
backend = "systemd";
enabled = true;
port = "80,443";
maxretry = 8;
bantime = "24h";
findtime = "30m";
journalmatch = "_SYSTEMD_UNIT=forgejo.service";
# logpath = "/var/lib/forgejo/log/*.log";
}; };
}; };
}; };
}; };
environment.etc = { environment.etc = {
# Jellyfin
"fail2ban/filter.d/jellyfin.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter '' "fail2ban/filter.d/jellyfin.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
[Definition] [Definition]
failregex = ^.*Authentication request for .* has been denied \(IP: <ADDR>\)\. failregex = ^.*Authentication request for .* has been denied \(IP: <ADDR>\)\.
''); '');
# Forgejo
"fail2ban/filter.d/forgejo.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
[Definition]
failregex = ^.*Failed authentication attempt for .* from <ADDR>.*$
'');
# Defines a filter that detects URL probing by reading the Nginx access log # Defines a filter that detects URL probing by reading the Nginx access log
"fail2ban/filter.d/nginx-url-probe.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter '' "fail2ban/filter.d/nginx-url-probe.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
[Definition] [Definition]

5
services/forgejo.nix
View file

@ -17,11 +17,6 @@ in {
ENABLE_PUSH_CREATE_USER = true; ENABLE_PUSH_CREATE_USER = true;
}; };
log = {
MODE = "file";
LEVEL = "info";
};
server = { server = {
DOMAIN = "git.spoodythe.one"; DOMAIN = "git.spoodythe.one";
HTTP_PORT = port; HTTP_PORT = port;