add fail2ban

modules/boot.nix

@@ -1,12 +1,12 @@
 { config, lib, libS, ... }:
 
 let
-  cfg = config.boot;
+cfg = config.boot;
 in
 {
-  options = {
-    boot = {
-      default = libS.mkOpinionatedOption "enable the boot builder";
+options = {
+  boot = {
+    default = libS.mkOpinionatedOption "enable the boot builder";
       cpuType = lib.mkOption {
         type = lib.types.str;
         example = "amd";

modules/fail2ban.nix

@@ -0,0 +1,45 @@
+{ config, lib, libS, ... }:
+
+let
+  cfg = config.services.fail2ban;
+in
+{
+  options = {
+    services.fail2ban = {
+      recommendedDefaults = libS.mkOpinionatedOption "use fail2ban with recommended defaults";
+    };
+  };
+
+  config.services.fail2ban = lib.mkIf cfg.recommendedDefaults {
+    maxretry = 5;
+    bantime = "24h";
+    bantime-increment = {
+      enable = true;
+      formula = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";
+      multipliers = "1 2 4 8 16 32 64";
+      maxtime = "168h";
+      overalljails = true;
+    };
+
+    jails = {
+      apache-nohome-iptables.settings = {
+        # Block an IP address if it accesses a non-existent
+        # home directory more than 5 times in 10 minutes,
+        # since that indicates that it's scanning.
+        filter = "apache-nohome";
+        action = ''iptables-multiport[name=HTTP, port="http,https"]'';
+        logpath = "/var/log/httpd/error_log*";
+        backend = "auto";
+        findtime = 600;
+        bantime  = 600;
+        maxretry = 5;
+      };
+      dovecot = {
+        settings = {
+          filter = "dovecot[mode=aggressive]";
+          maxretry = 3;
+        };
+      };
+    };
+  };
+}

modules/security.nix

@@ -1,7 +1,13 @@
+# BIASED
 { config, lib, ... }:
 {
   config = {
     services = lib.mkIf config.services.gitea.enable {
+      fail2ban = {
+        enable = true;
+        
+      };
+
       openssh = {
         extraConfig = ''
           Match User gitea