feat(firewall): Ban AI crawlers

modules/nixos/dgn-firewall/streams.nix

@@ -25,6 +25,43 @@ let
   };
 
   available = {
+    ai-crawlers = {
+      cmd = [
+        "tail"
+        "-n0"
+        "-f"
+        "/var/log/nginx/access.log"
+      ];
+
+      filters.bots = {
+        regex = builtins.map (name: ''^<ip>.*"[^"]*${name}[^"]*"$'') [
+          "AI2Bot"
+          "Amazonbot"
+          "Applebot"
+          "Applebot-Extended"
+          "Bytespider"
+          "CCBot"
+          "ChatGPT-User"
+          "ClaudeBot"
+          "Diffbot"
+          "DuckAssistBot"
+          "FacebookBot"
+          "GPTBot"
+          "Google-Extended"
+          "Kangaroo Bot"
+          "Meta-ExternalAgent"
+          "Meta-ExternalFetcher"
+          "OAI-SearchBot"
+          "PerplexityBot"
+          "Timpibot"
+          "Webzio-Extended"
+          "YouBot"
+          "omgili"
+        ];
+        actions = ban "720h";
+      };
+    };
+
     ssh = {
       cmd = journalctl "sshd";
 
@@ -46,5 +83,8 @@ let
 in
 
 builtins.mapAttrs (_: builtins.foldl' (a: s: a // { ${s} = available.${s}; }) { }) {
-  default = [ "ssh" ];
+  default = [
+    "ai-crawlers"
+    "ssh"
+  ];
 }