From 182012ef4367bede2531e56c2190353ebe539f23 Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Tue, 3 Sep 2019 21:57:25 +0300
Subject: [PATCH] nixos/fail2ban: add options to enable work service with
 iptables-compat

---
 nixos/modules/services/security/fail2ban.nix | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/security/fail2ban.nix b/nixos/modules/services/security/fail2ban.nix
index d933ae02e42..eb4a4f2eb51 100644
--- a/nixos/modules/services/security/fail2ban.nix
+++ b/nixos/modules/services/security/fail2ban.nix
@@ -55,6 +55,13 @@ in
         description = "The fail2ban package to use for running the fail2ban service.";
       };
 
+      packageFirewall = mkOption {
+        default = pkgs.iptables;
+        type = types.package;
+        example = "pkgs.nftables";
+        description = "The firewall package used by fail2ban service.";
+      };
+
       daemonConfig = mkOption {
         default = ''
           [Definition]
@@ -103,7 +110,6 @@ in
 
   };
 
-
   ###### implementation
 
   config = mkIf cfg.enable {
@@ -131,7 +137,7 @@ in
       restartTriggers = [ fail2banConf jailConf pathsConf ];
       reloadIfChanged = true;
 
-      path = [ cfg.package pkgs.iptables pkgs.iproute ];
+      path = [ cfg.package cfg.packageFirewall pkgs.iproute ];
 
       preStart = ''
         mkdir -p /var/lib/fail2ban