From 25c827b3cc1dc9885f4885b68b9df83c7697b1af Mon Sep 17 00:00:00 2001 From: pennae Date: Sat, 24 Apr 2021 17:42:31 +0200 Subject: [PATCH] nixos/fail2ban: add maxretry option it's not possible to set a different default maxretry value in the DEFAULT jail because the module already does so. expose the maxretry option to the configuration to remedy this. (we can't really remove it entirely because fail2ban defaults to 5) --- nixos/modules/services/security/fail2ban.nix | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/security/fail2ban.nix b/nixos/modules/services/security/fail2ban.nix index b901b19cf31..22abbb518ff 100644 --- a/nixos/modules/services/security/fail2ban.nix +++ b/nixos/modules/services/security/fail2ban.nix @@ -62,6 +62,12 @@ in description = "The firewall package used by fail2ban service."; }; + maxretry = mkOption { + default = 3; + type = types.ints.unsigned; + description = "Number of failures before a host gets banned."; + }; + banaction = mkOption { default = "iptables-multiport"; type = types.str; @@ -291,7 +297,7 @@ in ''} # Miscellaneous options ignoreip = 127.0.0.1/8 ${optionalString config.networking.enableIPv6 "::1"} ${concatStringsSep " " cfg.ignoreIP} - maxretry = 3 + maxretry = ${toString cfg.maxretry} backend = systemd # Actions banaction = ${cfg.banaction}