feat(system/core, -||-/services): add security modules - firejail, firewall, fail2ban
This commit is contained in:
parent
cad1551224
commit
b7a5d89ed2
|
@ -1,34 +0,0 @@
|
|||
{ pkgs, ... }:
|
||||
{
|
||||
programs.firejail = {
|
||||
enable = true;
|
||||
wrappedBinaries = {
|
||||
librewolf = {
|
||||
executable = "${pkgs.librewolf}/bin/librewolf";
|
||||
profile = "${pkgs.firejail}/etc/firejail/librewolf.profile";
|
||||
extraArgs = [
|
||||
# Required for U2F USB stick
|
||||
"--ignore=private-dev"
|
||||
# Enforce dark mode
|
||||
"--env=GTK_THEME=Adwaita:dark"
|
||||
# Enable system notifications
|
||||
"--dbus-user.talk=org.freedesktop.Notifications"
|
||||
];
|
||||
};
|
||||
signal-desktop = {
|
||||
# Enable tray icon otherwise Signal window might be hidden
|
||||
executable = "${pkgs.signal-desktop}/bin/signal-desktop --use-tray-icon";
|
||||
profile = "${pkgs.firejail}/etc/firejail/signal-desktop.profile";
|
||||
extraArgs = [
|
||||
# Enforce dark mode
|
||||
"--env=GTK_THEME=Adwaita:dark"
|
||||
#TODO: Enable Wayland mode
|
||||
#"--env=NIXOS_OZONE_WL=1"
|
||||
# Allow tray icon (should be upstreamed into signal-desktop.profile)
|
||||
"--dbus-user.talk=org.kde.StatusNotifierWatcher"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{ configVars, ... }:
|
||||
{
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
|
||||
};
|
||||
}
|
|
@ -1,7 +1,8 @@
|
|||
# http://web.archive.org/web/20240621185719/https://dataswamp.org/~solene/2022-10-02-nixos-fail2ban.html
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
services.fail2ban = {
|
||||
enable = true;
|
||||
enable = false;
|
||||
ignoreIP = [
|
||||
"192.168.1.0/24"
|
||||
];
|
||||
|
@ -10,35 +11,36 @@
|
|||
banaction = "iptables-ipset-proto6-allports";
|
||||
|
||||
|
||||
jails = {
|
||||
|
||||
# max 6 failures in 600 seconds
|
||||
"nginx-spam" = ''
|
||||
enabled = true
|
||||
filter = nginx-bruteforce
|
||||
logpath = /var/log/nginx/access.log
|
||||
backend = auto
|
||||
maxretry = 6
|
||||
findtime = 600
|
||||
'';
|
||||
|
||||
# max 3 failures in 600 seconds
|
||||
"postfix-bruteforce" = ''
|
||||
enabled = true
|
||||
filter = postfix-bruteforce
|
||||
findtime = 600
|
||||
maxretry = 3
|
||||
'';
|
||||
|
||||
# max 10 failures in 600 seconds
|
||||
"molly" = ''
|
||||
enabled = true
|
||||
filter = molly
|
||||
findtime = 600
|
||||
maxretry = 10
|
||||
logpath = /var/log/molly-brown/access.log
|
||||
backend = auto
|
||||
'';
|
||||
jails = {
|
||||
|
||||
# max 6 failures in 600 seconds
|
||||
"nginx-spam" = ''
|
||||
enabled = true
|
||||
filter = nginx-bruteforce
|
||||
logpath = /var/log/nginx/access.log
|
||||
backend = auto
|
||||
maxretry = 6
|
||||
findtime = 600
|
||||
'';
|
||||
|
||||
# max 3 failures in 600 seconds
|
||||
"postfix-bruteforce" = ''
|
||||
enabled = true
|
||||
filter = postfix-bruteforce
|
||||
findtime = 600
|
||||
maxretry = 3
|
||||
'';
|
||||
|
||||
# max 10 failures in 600 seconds
|
||||
"molly" = ''
|
||||
enabled = true
|
||||
filter = molly
|
||||
findtime = 600
|
||||
maxretry = 10
|
||||
logpath = /var/log/molly-brown/access.log
|
||||
backend = auto
|
||||
'';
|
||||
};
|
||||
};
|
||||
environment.etc = {
|
||||
"fail2ban/filter.d/molly.conf".text = ''
|
||||
|
@ -58,7 +60,5 @@
|
|||
'';
|
||||
};
|
||||
|
||||
|
||||
|
||||
|
||||
}
|
||||
|
||||
|
|
|
@ -1,2 +1,34 @@
|
|||
{ pkgs, ... }:
|
||||
{ }
|
||||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
programs.firejail = {
|
||||
enable = true;
|
||||
wrappedBinaries = {
|
||||
librewolf = {
|
||||
executable = "${pkgs.librewolf}/bin/librewolf";
|
||||
profile = "${pkgs.firejail}/etc/firejail/librewolf.profile";
|
||||
extraArgs = [
|
||||
# Required for U2F USB stick
|
||||
"--ignore=private-dev"
|
||||
# Enforce dark mode
|
||||
"--env=GTK_THEME=Adwaita:dark"
|
||||
# Enable system notifications
|
||||
"--dbus-user.talk=org.freedesktop.Notifications"
|
||||
];
|
||||
};
|
||||
signal-desktop = {
|
||||
# Enable tray icon otherwise Signal window might be hidden
|
||||
executable = "${pkgs.signal-desktop}/bin/signal-desktop --use-tray-icon";
|
||||
profile = "${pkgs.firejail}/etc/firejail/signal-desktop.profile";
|
||||
extraArgs = [
|
||||
# Enforce dark mode
|
||||
"--env=GTK_THEME=Adwaita:dark"
|
||||
#TODO: Enable Wayland mode
|
||||
#"--env=NIXOS_OZONE_WL=1"
|
||||
# Allow tray icon (should be upstreamed into signal-desktop.profile)
|
||||
"--dbus-user.talk=org.kde.StatusNotifierWatcher"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue