From 24add9ddf2d7613e39f1aee033a982513a4552b8 Mon Sep 17 00:00:00 2001
From: "Simon R. - fantomitechno" <me@fantomitechno.dev>
Date: Tue, 28 Jul 2026 11:45:12 +0200
Subject: [PATCH] =?UTF-8?q?=E2=9C=A8=20fail2ban?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 modules/ssh.nix | 45 +++++++++++++++++++++++++++++++++------------
 1 file changed, 33 insertions(+), 12 deletions(-)

diff --git a/modules/ssh.nix b/modules/ssh.nix
index ec0e006..52e81c6 100644
--- a/modules/ssh.nix
+++ b/modules/ssh.nix
@@ -1,15 +1,36 @@
-{ lib, ... }: {
-  services.openssh = {
-    enable = lib.mkDefault true;
-    openFirewall = true;
-    settings = {
-      PasswordAuthentication = false;
-      KbdInteractiveAuthentication = false;
-      PermitRootLogin = "no";
-      AllowUsers = [ "fantomitechno" ];
-      MaxAuthTries = 3;
-      PerSourcePenalties = "crash:3600s authfail:3600s max:86400s";
+{ lib, pkgs, ... }: {
+  services = {
+    openssh = {
+      enable = lib.mkDefault true;
+      openFirewall = true;
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+        PermitRootLogin = "no";
+        AllowUsers = [ "fantomitechno" ];
+        MaxAuthTries = 3;
+        PerSourcePenalties = "crash:3600s authfail:3600s max:86400s";
+      };
+      ports = [ 22 ];
+    };
+
+    fail2ban = {
+      enable = true;
+      maxretry = 5;
+      ignoreIP = [
+        "172.16.0.0/16"
+      ];
+
+      bantime = "24h"; # Ban IPs for one day on the first ban
+      bantime-increment = {
+        enable = true; # Enable increment of bantime after each violation
+        multipliers = "1 2 4 8 16 32 64";
+        maxtime = "168h"; # Do not ban for more than 1 week
+        overalljails = true; # Calculate the bantime based on all the violations
+      };
+
+      extraPackages = [ pkgs.ipset ];
+      banaction = "iptables-ipset-proto6-allports"; # ban on all port; v4 and v6
     };
-    ports = [ 22 ];
   };
 }
-- 
2.51.2