From b1f3d839adc88b024e3a79d09b54a1939b78edba Mon Sep 17 00:00:00 2001
From: Alejandro Soto <alejandro@34project.org>
Date: Sat, 20 Jul 2024 22:35:52 -0600
Subject: net/fail2ban: initial commit

---
 sys/gitea/default.nix | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

(limited to 'sys/gitea/default.nix')

diff --git a/sys/gitea/default.nix b/sys/gitea/default.nix
index 6096950..69dfbc2 100644
--- a/sys/gitea/default.nix
+++ b/sys/gitea/default.nix
@@ -8,9 +8,26 @@ in
   };
 
   config = mkIf cfg.enable {
-    services.gitea = {
-      enable = true;
-      useWizard = true;
+    environment.etc."fail2ban/filter.d/gitea.local".text = ''
+      [Definition]
+      failregex = .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>
+      ignoreregex =
+    '';
+
+    services = {
+      fail2ban.jails.gitea.settings = {
+        filter = "gitea";
+        logpath = "${config.services.gitea.stateDir}/log/gitea.log";
+        maxretry = "10";
+        findtime = "3600";
+        bantime = "900";
+        action = "iptables-allports";
+      };
+
+      gitea = {
+        enable = true;
+        useWizard = true;
+      };
     };
 
     users = {
-- 
cgit v1.2.3