diff --git a/configurations/nixos/defiant/configuration.nix b/configurations/nixos/defiant/configuration.nix
index 91a8c2c..ae897ce 100644
--- a/configurations/nixos/defiant/configuration.nix
+++ b/configurations/nixos/defiant/configuration.nix
@@ -310,7 +310,7 @@
 
     forgejo = {
       enable = true;
-      domain = "git.jan-leila.com";
+      reverseProxy.domain = "git.jan-leila.com";
     };
 
     searx = {
diff --git a/modules/nixos-modules/server/forgejo/fail2ban.nix b/modules/nixos-modules/server/forgejo/fail2ban.nix
index 213c804..dfe221a 100644
--- a/modules/nixos-modules/server/forgejo/fail2ban.nix
+++ b/modules/nixos-modules/server/forgejo/fail2ban.nix
@@ -4,7 +4,16 @@
   pkgs,
   ...
 }: {
-  config = lib.mkIf (config.services.forgejo.enable && config.services.fail2ban.enable) {
+  options.services.forgejo = {
+    fail2ban = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = config.services.forgejo.enable && config.services.fail2ban.enable;
+      };
+    };
+  };
+
+  config = lib.mkIf config.services.forgejo.fail2ban.enable {
     environment.etc = {
       "fail2ban/filter.d/forgejo.local".text = lib.mkIf config.services.forgejo.enable (
         pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
diff --git a/modules/nixos-modules/server/home-assistant/fail2ban.nix b/modules/nixos-modules/server/home-assistant/fail2ban.nix
index 6ac5900..25194ef 100644
--- a/modules/nixos-modules/server/home-assistant/fail2ban.nix
+++ b/modules/nixos-modules/server/home-assistant/fail2ban.nix
@@ -3,36 +3,46 @@
   pkgs,
   config,
   ...
-}:
-lib.mkIf (config.services.fail2ban.enable && config.services.home-assistant.enable) {
-  environment.etc = {
-    "fail2ban/filter.d/hass.local".text = (
-      pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
-        [INCLUDES]
-        before = common.conf
-
-        [Definition]
-        failregex = ^%(__prefix_line)s.*Login attempt or request with invalid authentication from <HOST>.*$
-
-        ignoreregex =
-
-        [Init]
-        datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S
-      '')
-    );
+}: {
+  options.services.home-assistant = {
+    fail2ban = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = config.services.fail2ban.enable && config.services.home-assistant.enable;
+      };
+    };
   };
 
-  services.fail2ban = {
-    jails = {
-      home-assistant-iptables.settings = {
-        enabled = true;
-        filter = "hass";
-        action = ''iptables-multiport[name=HTTP, port="http,https"]'';
-        logpath = "${config.services.home-assistant.configDir}/*.log";
-        backend = "auto";
-        findtime = 600;
-        bantime = 600;
-        maxretry = 5;
+  config = lib.mkIf config.services.home-assistant.fail2ban.enable {
+    environment.etc = {
+      "fail2ban/filter.d/hass.local".text = (
+        pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
+          [INCLUDES]
+          before = common.conf
+
+          [Definition]
+          failregex = ^%(__prefix_line)s.*Login attempt or request with invalid authentication from <HOST>.*$
+
+          ignoreregex =
+
+          [Init]
+          datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S
+        '')
+      );
+    };
+
+    services.fail2ban = {
+      jails = {
+        home-assistant-iptables.settings = {
+          enabled = true;
+          filter = "hass";
+          action = ''iptables-multiport[name=HTTP, port="http,https"]'';
+          logpath = "${config.services.home-assistant.configDir}/*.log";
+          backend = "auto";
+          findtime = 600;
+          bantime = 600;
+          maxretry = 5;
+        };
       };
     };
   };
diff --git a/modules/nixos-modules/server/immich/fail2ban.nix b/modules/nixos-modules/server/immich/fail2ban.nix
index c9ec87b..21593e7 100644
--- a/modules/nixos-modules/server/immich/fail2ban.nix
+++ b/modules/nixos-modules/server/immich/fail2ban.nix
@@ -4,7 +4,16 @@
   pkgs,
   ...
 }: {
-  config = lib.mkIf (config.services.fail2ban.enable && config.services.immich.enable) {
+  options.services.immich = {
+    fail2ban = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = config.services.fail2ban.enable && config.services.immich.enable;
+      };
+    };
+  };
+
+  config = lib.mkIf config.services.immich.fail2ban.enable {
     environment.etc = {
       "fail2ban/filter.d/immich.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
         [Definition]