Lithospherical/nix-config
1
0
Fork 0
forked from jan-leila/nix-config
Code Pull requests Activity

fixed permissions on fail2ban database file

Browse source
This commit is contained in:
Leyla Becker 2025-01-25 13:59:22 -06:00
parent 4d0aa119b0
commit b6605dff27
1 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
modules/nixos-modules/server/fail2ban.nix
View file

@ -3,7 +3,8 @@
config, config,
... ...
}: let }: let
dataFile = "/var/lib/fail2ban/fail2ban.sqlite3"; dataFolder = "/var/lib/fail2ban";
dataFile = "fail2ban.sqlite3";
in { in {
options.host.fail2ban = { options.host.fail2ban = {
enable = lib.mkEnableOption "should fail 2 ban be enabled on this server"; enable = lib.mkEnableOption "should fail 2 ban be enabled on this server";
@ -89,7 +90,7 @@ in {
(lib.mkIf config.host.impermanence.enable { (lib.mkIf config.host.impermanence.enable {
assertions = [ assertions = [
{ {
assertion = config.services.fail2ban.daemonSettings.Definition.dbfile == dataFile; assertion = config.services.fail2ban.daemonSettings.Definition.dbfile == "${dataFolder}/${dataFile}";
message = "fail2ban data file does not match persistence"; message = "fail2ban data file does not match persistence";
} }
]; ];
@ -97,8 +98,12 @@ in {
environment.persistence."/persist/system/root" = { environment.persistence."/persist/system/root" = {
enable = true; enable = true;
hideMounts = true; hideMounts = true;
files = [ directories = [
dataFile {
directory = dataFolder;
user = "fail2ban";
group = "fail2ban";
}
]; ];
}; };
}) })