TheWanderingCrow/CrOS
1
0
Fork 0
mirror of https://github.com/TheWanderingCrow/CrOS.git synced 2026-02-26 06:02:34 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

Matrix, Caddy

Browse source 
* Nginx to caddy (#5)

Convert all nginx instances to caddy instances, setup acme as well

* matrix implemented
This commit is contained in:
Crow 2025-09-11 14:56:05 -04:00 • committed by GitHub
parent 742be942bb
commit e0590ff20b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
25 changed files with 182 additions and 484 deletions
Download patch file Download diff file Expand all files Collapse all files

21
modules/services/fail2ban/default.nix
View file

@ -11,15 +11,6 @@
norestored = true # Needed to avoid receiving a new notification after every restart
actionban = curl -H "Title: <ip> has been banned" -d "<name> jail has banned <ip> from accessing ${config.hostSpec.hostName} after <failures> attempts of attacking the system." https://notify.wanderingcrow.net/Fail2banNotifications
'');
# Defines a filter that detects URL probing by reading the Nginx access log
"fail2ban/filter.d/nginx-ddos-protect.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
[Definition]
failregex = ^<HOST> - - \[.*\] "GET .* HTTP/.*" \d{3} \d+ "-" "ApacheBench/.+"
limiting requests, excess:.* by zone.*client: <HOST>
^.*\[error\]\s+\d+#\d+:\s+\*\d+\s+connect\(\) to unix:.*failed.*while connecting to upstream,\s+client:\s+<HOST>,\s+server:.*
^.*\[error\]\s+\d+#\d+:\s+\*\d+\s+upstream prematurely closed connection while reading response header from upstream,\s+client:\s+<HOST>,.*$
ignoreregex =
'');
};
services.fail2ban = {
enable = true;
@ -29,17 +20,5 @@
ignoreIP = [
inputs.nix-secrets.network.primary.publicIP
];
jails = {
nginx-ddos-protect.settings = {
enabled = true;
filter = "nginx-ddos-protect";
logpath = "/var/log/nginx/*.log";
action = '' %(action_)s[blocktype=DROP]
ntfy'';
backend = "auto"; # Do not forget to specify this if your jail uses a log file
maxretry = 1;
findtime = 3600;
};
};
};
}