From f1b6be6f3ff1311d7041b194ebdd3956a70fb71d Mon Sep 17 00:00:00 2001
From: William <baduhai@proton.me>
Date: Sun, 9 Nov 2025 13:00:17 -0300
Subject: [PATCH] Add fail2ban configuration for SSH and Forgejo on Trantor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Configure fail2ban with progressive ban times (1h base, up to 10000h max)
- Add SSH jail with password authentication disabled
- Add Forgejo jail using systemd journal backend
- Ignore private networks and Tailscale IPs
- Set Forgejo to 10 retries per hour, 15min initial ban

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 hosts/trantor/fail2ban.nix | 43 +++++++++++++++++++++++++
 hosts/trantor/forgejo.nix  | 65 ++++++++++++++++++++++++--------------
 hosts/trantor/openssh.nix  | 23 ++++++++++++++
 3 files changed, 107 insertions(+), 24 deletions(-)
 create mode 100644 hosts/trantor/fail2ban.nix
 create mode 100644 hosts/trantor/openssh.nix

diff --git a/hosts/trantor/fail2ban.nix b/hosts/trantor/fail2ban.nix
new file mode 100644
index 0000000..4ef1bbc
--- /dev/null
+++ b/hosts/trantor/fail2ban.nix
@@ -0,0 +1,43 @@
+{ config, pkgs, ... }:
+
+{
+  services.fail2ban = {
+    enable = true;
+    maxretry = 5;
+    ignoreIP = [
+      "127.0.0.0/8"
+      "::1"
+      "10.0.0.0/8"
+      "172.16.0.0/12"
+      "192.168.0.0/16"
+      "100.64.0.0/10"
+    ];
+
+    bantime = "1h";
+    bantime-increment = {
+      enable = true;
+      multipliers = "1 2 4 8 16 32 64";
+      maxtime = "10000h";
+      overalljails = true;
+    };
+
+    jails.forgejo = {
+      settings = {
+        enabled = true;
+        filter = "forgejo";
+        backend = "systemd";
+        maxretry = 10;
+        findtime = "1h";
+        bantime = "15m";
+      };
+    };
+  };
+
+  # Custom fail2ban filter for Forgejo using systemd journal
+  environment.etc."fail2ban/filter.d/forgejo.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
+    [Definition]
+    journalmatch = _SYSTEMD_UNIT=forgejo.service
+    failregex = Failed authentication attempt for .+ from <HOST>:\d+:
+    ignoreregex =
+  '');
+}
diff --git a/hosts/trantor/forgejo.nix b/hosts/trantor/forgejo.nix
index 9688458..227bcb4 100644
--- a/hosts/trantor/forgejo.nix
+++ b/hosts/trantor/forgejo.nix
@@ -9,33 +9,50 @@ let
   inherit (utils) mkNginxVHosts;
 in
 {
-  services.forgejo = {
-    enable = true;
-    repositoryRoot = "/data/forgejo";
-    settings = {
-      session.COOKIE_SECURE = true;
-      server = {
-        PROTOCOL = "http+unix";
-        DOMAIN = "git.baduhai.dev";
-        ROOT_URL = "https://git.baduhai.dev";
-        OFFLINE_MODE = true; # disable use of CDNs
-        SSH_DOMAIN = "baduhai.dev";
+  services = {
+    forgejo = {
+      enable = true;
+      repositoryRoot = "/data/forgejo";
+      settings = {
+        session.COOKIE_SECURE = true;
+        server = {
+          PROTOCOL = "http+unix";
+          DOMAIN = "git.baduhai.dev";
+          ROOT_URL = "https://git.baduhai.dev";
+          OFFLINE_MODE = true; # disable use of CDNs
+          SSH_DOMAIN = "baduhai.dev";
+        };
+        log.LEVEL = "Warn";
+        mailer.ENABLED = false;
+        actions.ENABLED = false;
+        service.DISABLE_REGISTRATION = true;
+        oauth2_client = {
+          ENABLE_AUTO_REGISTRATION = true;
+          UPDATE_AVATAR = true;
+          ACCOUNT_LINKING = "login";
+          USERNAME = "preferred_username";
+        };
       };
-      log.LEVEL = "Warn";
-      mailer.ENABLED = false;
-      actions.ENABLED = false;
-      service.DISABLE_REGISTRATION = true;
-      oauth2_client = {
-        ENABLE_AUTO_REGISTRATION = true;
-        UPDATE_AVATAR = true;
-        ACCOUNT_LINKING = "login";
-        USERNAME = "preferred_username";
+    };
+    nginx.virtualHosts = mkNginxVHosts {
+      domains."git.baduhai.dev".locations."/".proxyPass =
+        "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}:/";
+    };
+    fail2ban.jails.forgejo = {
+      settings = {
+        enabled = true;
+        filter = "forgejo";
+        logpath = "${config.services.forgejo.stateDir}/log/forgejo.log";
+        maxretry = 10;
+        findtime = "1h";
+        bantime = "15m";
       };
     };
   };
 
-  services.nginx.virtualHosts = mkNginxVHosts {
-    domains."git.baduhai.dev".locations."/".proxyPass =
-      "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}:/";
-  };
+  environment.etc."fail2ban/filter.d/forgejo.conf".text = ''
+    [Definition]
+    failregex = .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>
+    ignoreregex =
+  '';
 }
diff --git a/hosts/trantor/openssh.nix b/hosts/trantor/openssh.nix
new file mode 100644
index 0000000..51d8795
--- /dev/null
+++ b/hosts/trantor/openssh.nix
@@ -0,0 +1,23 @@
+{ ... }:
+
+{
+  services = {
+    openssh = {
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+      };
+    };
+    fail2ban.jails.sshd = {
+      settings = {
+        enabled = true;
+        port = "ssh";
+        filter = "sshd";
+        logpath = "/var/log/auth.log";
+        maxretry = 5;
+        findtime = "10m";
+        bantime = "1h";
+      };
+    };
+  };
+}