nix/machines
1
0
Fork 0
Code Issues Releases Packages Activity Actions

Adjust some more nginx fail2ban
All checks were successful
/ rust-packages (push) Successful in 37s
Details
/ dev-shell (push) Successful in 30s
Details
/ terraform-providers (push) Successful in 58s
Details
/ check (push) Successful in 1m14s
Details
/ systems (push) Successful in 3m41s
Details

Browse source
This commit is contained in:
Kaare Hoff Skovgaard 2025-07-20 23:35:05 +02:00
parent 61741b5680
commit d5cca90a4d
Signed by: khs
GPG key ID: C7D890804F01E9F0
1 changed files with 6 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nix/modules/nixos/services/nginx/default.nix
View file

@ -137,7 +137,7 @@ in
nginx-botsearch = { nginx-botsearch = {
settings = { settings = {
filter = "nginx-botsearch"; filter = "nginx-botsearch";
action = ''${config.services.fail2ban.banaction}[name=HTTP, port="http,https"]''; port = "http,https";
logpath = "/var/log/nginx/access.log"; logpath = "/var/log/nginx/access.log";
backend = "auto"; backend = "auto";
findtime = 600; findtime = 600;
@ -147,7 +147,7 @@ in
nginx-bad-request = { nginx-bad-request = {
settings = { settings = {
filter = "nginx-bad-request"; filter = "nginx-bad-request";
action = ''${config.services.fail2ban.banaction}[name=HTTP, port="http,https"]''; port = "http,https";
logpath = "/var/log/nginx/access.log"; logpath = "/var/log/nginx/access.log";
backend = "auto"; backend = "auto";
findtime = 600; findtime = 600;
@ -157,9 +157,8 @@ in
nginx-req-limit = { nginx-req-limit = {
settings = { settings = {
filter = "nginx-limit-req"; filter = "nginx-limit-req";
action = ''${config.services.fail2ban.banaction}[name=HTTP, port="http,https"]''; port = "http,https";
logpath = "/var/log/nginx/access.log"; backend = "systemd";
backend = "auto";
findtime = 600; findtime = 600;
maxretry = 3; maxretry = 3;
}; };
@ -192,7 +191,7 @@ in
recommendedZstdSettings = lib.mkDefault true; recommendedZstdSettings = lib.mkDefault true;
recommendedProxySettings = lib.mkDefault true; recommendedProxySettings = lib.mkDefault true;
appendHttpConfig = '' appendHttpConfig = ''
limit_req_zone $binary_remote_addr zone=nobots:10m rate=50r/s; limit_req_zone $binary_remote_addr zone=nobots:10m rate=5r/s;
map $scheme $hsts_header { map $scheme $hsts_header {
https "max-age=63072000; preload"; https "max-age=63072000; preload";
} }
@ -271,7 +270,7 @@ in
else else
''''; '''';
reqLimit = lib.strings.optionalString value.rateLimit.enable '' reqLimit = lib.strings.optionalString value.rateLimit.enable ''
limit_req zone=nobots burst=5 nodelay; limit_req zone=nobots burst=20 nodelay;
''; '';
extraConfig = '' extraConfig = ''
${mtls} ${mtls}