Start adding fail2ban to server config

home/desktop/waybar.nix

@@ -4,10 +4,12 @@
     (nerdfonts.override { fonts = [ "FiraCode" ]; })
     bluez
   ];
-  # xdg.configFile."waybar/common.json".source = ./config/waybar/common.json;
   xdg.configFile."waybar" = {
     source = ./config/waybar;
     recursive = true;
   };
-  programs.waybar.enable = true;
+  programs.waybar = {
+    enable = true;
+    systemd.enable = true;
+  };
 }

home/ssh/common.nix

@@ -7,6 +7,9 @@
     serverAliveCountMax = 3;
     controlMaster = "auto";
     controlPersist = "1s";
-    matchBlocks."git.*".user = "git";
+    matchBlocks = {
+      "git.*".user = "git";
+      "xenia.me.uk" = { user = "git"; port = 2222; };
+    };
   };
 }

home/ssh/personal.nix

@@ -4,7 +4,7 @@
   programs.ssh.matchBlocks = {
     "legion" = { port = 30; };
     "vanguard" = { hostname = "192.168.1.166"; port = 22; };
-    "legion vanguard xenia.me.uk" = lib.hm.dag.entryAfter [ "legion" "vanguard" ] {
+    "legion vanguard" = lib.hm.dag.entryAfter [ "legion" "vanguard" ] {
       user = "root";
       forwardAgent = true;
     };

server/fail2ban.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  services.fail2ban = {
+    enable = true;
+    ignoreIP = [ "127.0.0.1/8" "::1" "192.168.1.0/16" ];
+    bantime-increment = { enable = true; };
+  };
+}

server/gitea.nix

@@ -1,10 +1,20 @@
 { ... }:
 {
-  imports = [ ./traefik.nix ];
-  services.gitea.enable = true;
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  imports = [ ./traefik.nix ./fail2ban.nix ];
+  services.gitea = {
+    enable = true;
+    settings = {
+      server = { DOMAIN = "git.xenia.me.uk"; SSH_PORT = 2222; };
+      log.MODE = "file";
+    };
+    appName = "Gitea";
+  };
+  networking.firewall.allowedTCPPorts = [ 80 443 2222 ];
   services.traefik.dynamicConfigOptions.http = {
     routers.gitea = { rule = "Host(`git.xenia.me.uk`)"; service = "gitea-websecure"; tls = { certResolver = "default"; }; };
     services.gitea-websecure.loadBalancer.servers = [{ url = "http://localhost:3000"; }];
   };
+  # services.fail2ban.jails.gitea = ''
+  #
+  # '';
 }