From 5e56eaa90e03a8e4b18107996a0e2630c6f8394b Mon Sep 17 00:00:00 2001
From: Infinidoge <infinidoge@inx.moe>
Date: Mon, 15 Apr 2024 02:28:10 -0400
Subject: [PATCH] global/security: add global fail2ban options

---
 modules/global/security.nix | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/modules/global/security.nix b/modules/global/security.nix
index c55226d..77a1beb 100644
--- a/modules/global/security.nix
+++ b/modules/global/security.nix
@@ -68,6 +68,22 @@ with lib;
     recommendedProxySettings = true;
   };
 
+  services.fail2ban = {
+    ignoreIP = [
+      "100.101.102.0/14"
+      "172.16.0.0/12"
+      "192.168.1.0/24"
+      "192.168.137.0/24"
+    ];
+    bantime = "24h";
+    bantime-increment = {
+      enable = true;
+      multipliers = "1 2 4 8 16 32 64";
+      maxtime = "168h"; # Do not ban for more than 1 week
+      overalljails = true; # Calculate the bantime based on all the violations
+    };
+  };
+
   common = {
     nginx = rec {
       ssl-cert = {