diff --git a/hosts/Infini-OPTIPLEX/default.nix b/hosts/Infini-OPTIPLEX/default.nix index 833d3f4..5f7c0a8 100644 --- a/hosts/Infini-OPTIPLEX/default.nix +++ b/hosts/Infini-OPTIPLEX/default.nix @@ -17,51 +17,11 @@ hardware.form.server = true; }; - networking = { - firewall = { - allowedUDPPorts = [ 80 443 ]; - allowedTCPPorts = [ 80 443 ]; - }; - }; - persist = { directories = [ - "/srv" ]; files = [ ]; }; - - services.fail2ban.enable = true; - - environment.etc."fail2ban/filter.d/nginx-url-probe.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter '' - [Definition] - failregex = ^.*(GET /(wp-|admin|boaform|phpmyadmin|\.env|\.git|notifications)|\.(dll|so|cfm|asp)|(\?|&)(=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000|=PHPE9568F36-D428-11d2-A769-00AA001ACF42|=PHPE9568F35-D428-11d2-A769-00AA001ACF42|=PHPE9568F34-D428-11d2-A769-00AA001ACF42)|\\x[0-9a-zA-Z]{2}) - ''); - - services.fail2ban.jails.nginx-url-probe.settings = { - enabled = true; - filter = "nginx-url-probe"; - logpath = "/var/log/nginx/access.log"; - action = "%(action_)s[blocktype=DROP]"; - backend = "auto"; - maxretry = 5; - findtime = 600; - }; - - services.nginx.enable = true; - - security.acme.certs."inx.moe" = { - group = "nginx"; - extraDomainNames = [ "*.inx.moe" ]; - }; - - services.nginx.virtualHosts."*.inx.moe" = { - useACMEHost = "inx.moe"; - addSSL = true; - default = true; - globalRedirect = "inx.moe"; - redirectCode = 302; - }; }