44 lines
812 B
Nix
44 lines
812 B
Nix
{ ... }:
|
|
{
|
|
nixpkgs.overlays = [
|
|
(final: prev: {
|
|
fail2ban = prev.fail2ban.overrideAttrs (oldAttrs: {
|
|
patches = oldAttrs.patches or [ ] ++ [ ./remove-umask.patch ];
|
|
});
|
|
})
|
|
];
|
|
|
|
environment = {
|
|
enableAllTerminfo = true;
|
|
persistence."/persist/state"."/var/lib/fail2ban" = { };
|
|
};
|
|
|
|
services = {
|
|
openssh = {
|
|
enable = true;
|
|
settings = {
|
|
PasswordAuthentication = false;
|
|
PrintMotd = false;
|
|
};
|
|
};
|
|
|
|
fail2ban = {
|
|
enable = true;
|
|
bantime = "24h";
|
|
bantime-increment = {
|
|
enable = true;
|
|
maxtime = "720h";
|
|
overalljails = true;
|
|
};
|
|
};
|
|
};
|
|
|
|
systemd.services.fail2ban.serviceConfig = {
|
|
User = "root";
|
|
Group = "fail2ban";
|
|
UMask = "0117";
|
|
};
|
|
|
|
users.groups.fail2ban = { };
|
|
}
|