feat(modules): Deploy fail2ban

modules/dgn-fail2ban/default.nix

@@ -0,0 +1,82 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib)
+    mkDefault mkEnableOption mkIf mkOption
+
+    types;
+
+  cfg = config.dgn-fail2ban;
+
+  settingsFormat = pkgs.formats.keyValue { };
+
+  configFormat = pkgs.formats.ini { };
+
+  jailOptions = {
+    options = {
+      enabled = mkOption {
+        type = types.bool;
+
+        default = true;
+        description = "Wether to enable this jail.";
+      };
+
+      filter = mkOption {
+        type =
+          types.nullOr (types.submodule { freeformType = configFormat.type; });
+
+        description = "Content of the filter used for this jail.";
+      };
+
+      settings = mkOption {
+        type = types.submodule { freeformType = settingsFormat.type; };
+
+        default = { };
+        description = "Additional configuration for the jail.";
+      };
+    };
+  };
+
+in {
+  options.dgn-fail2ban = {
+    enable = mkEnableOption "fail2ban service.";
+
+    jails = mkOption {
+      type = types.attrsOf (types.submodule jailOptions);
+
+      default = { };
+      description = "Set of jails defined for fail2ban.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    dgn-fail2ban.jails =
+      builtins.mapAttrs (_: j: j // { enabled = mkDefault false; })
+      (import ./jails.nix { });
+
+    services.fail2ban = {
+      enable = true;
+
+      inherit (cfg) jails;
+
+      ignoreIP = [
+        "10.0.0.0/8"
+        "129.199.0.0/16"
+        "172.16.0.0/12"
+        "192.168.0.0/16"
+        "100.64.0.0/10"
+        "fd00::/8"
+      ];
+
+      bantime-increment = {
+        enable = true;
+
+        maxtime = "48h";
+        factor = "600";
+      };
+
+      extraPackages = [ pkgs.ipset ];
+      banaction = "iptables-ipset-proto6-allports";
+    };
+  };
+}