In the process of moving to secure systemd services. kdc currently broken.

config/hosts/clunk.nix

@@ -86,6 +86,13 @@ in {
       timing = "weekly";
     };
 
+    auth.kdc = {
+      enable = true;
+      realm = "SELBY.CA";
+      acl-file = "/var/heimdal/access.acl";
+      bind-addresses = [ "10.0.0.1" "127.0.0.1" "::1" ];
+    };
+
     secure-dns-proxy = {
       enable = true;
       listen-port = dns-proxy-port;

config/profiles/common.nix

@@ -38,6 +38,8 @@ in {
       };
     };
 
+    fail2ban.enable = true;
+
     xserver = {
       layout = "us";
       xkbVariant = "dvp";