Compare commits

..

2 Commits

Author SHA1 Message Date
d34dee84bd move modules to seperate folder 2023-12-29 11:51:41 +00:00
477bf5bf90 add fail2ban, so far only banning ssh connections 2023-12-29 11:47:44 +00:00
8 changed files with 27 additions and 7 deletions

View File

@ -25,11 +25,12 @@
inherit system;
modules = [
./configuration.nix
./matrix.nix
./puffer.nix
./gitea.nix
./letsencrypt.nix
./email.nix
./modules/matrix.nix
./modules/puffer.nix
./modules/gitea.nix
./modules/letsencrypt.nix
./modules/fail2ban.nix
./modules/email.nix
agenix.nixosModules.default
nixos-mailserver.nixosModules.default
nixos-matrix-modules.nixosModules.default

19
modules/fail2ban.nix Normal file
View File

@ -0,0 +1,19 @@
{ ... }: {
services.fail2ban = {
enable = true;
maxretry = 5;
ignoreIP = [
# Whitelist some subnets
"10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16"
"matrix.org"
"app.element.io" # don't ratelimit matrix users
];
bantime = "1h"; # Ban IPs for 1h at first.
bantime-increment = {
enable = true; # Enable increment of bantime after each violation
multipliers = "1 2 4 8 16 32 64 128 256";
maxtime = "168h"; # Do not ban for more than 1 week
overalljails = true; # Calculate the bantime based on all the violations
};
};
}

View File

@ -86,12 +86,12 @@ host replication all ::1/128 md5
services.redis.servers."".enable = true;
age.secrets.synapse_db_pass = {
file = ./secrets/synapse_db_pass.age;
file = ../secrets/synapse_db_pass.age;
owner = "postgres";
group = "postgres";
};
age.secrets.synapse_db_pass_prepared = {
file = ./secrets/synapse_db_pass_prepared.age;
file = ../secrets/synapse_db_pass_prepared.age;
owner = "matrix-synapse";
group = "matrix-synapse";
mode = "0600";