net/fail2ban: initial commit

1 files changed, 20 insertions, 3 deletions

diff --git a/sys/gitea/default.nix b/sys/gitea/default.nix
index 6096950..69dfbc2 100644
--- a/sys/gitea/default.nix
+++ b/sys/gitea/default.nix
@@ -8,9 +8,26 @@ in
   };
 
   config = mkIf cfg.enable {
-    services.gitea = {
-      enable = true;
-      useWizard = true;
+    environment.etc."fail2ban/filter.d/gitea.local".text = ''
+      [Definition]
+      failregex = .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>
+      ignoreregex =
+    '';
+
+    services = {
+      fail2ban.jails.gitea.settings = {
+        filter = "gitea";
+        logpath = "${config.services.gitea.stateDir}/log/gitea.log";
+        maxretry = "10";
+        findtime = "3600";
+        bantime = "900";
+        action = "iptables-allports";
+      };
+
+      gitea = {
+        enable = true;
+        useWizard = true;
+      };
     };
 
     users = {