From b9b5c1b2e3985d6f75c85afde60354b27d9027b3 Mon Sep 17 00:00:00 2001
From: Leyla Becker <git@jan-leila.com>
Date: Mon, 6 Jan 2025 14:11:29 -0600
Subject: [PATCH] added impermanence to fail2ban

---
 modules/nixos-modules/server/fail2ban.nix | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/modules/nixos-modules/server/fail2ban.nix b/modules/nixos-modules/server/fail2ban.nix
index f68ef9d..e59d8a5 100644
--- a/modules/nixos-modules/server/fail2ban.nix
+++ b/modules/nixos-modules/server/fail2ban.nix
@@ -2,7 +2,9 @@
   lib,
   config,
   ...
-}: {
+}: let
+  dataFile = "/var/lib/fail2ban/fail2ban.sqlite3";
+in {
   options.host.fail2ban = {
     enable = lib.mkEnableOption "should fail 2 ban be enabled on this server";
   };
@@ -85,6 +87,20 @@
       };
     }
     (lib.mkIf config.host.impermanence.enable {
-      })
+      assertions = [
+        {
+          assertion = config.services.fail2ban.daemonSettings.Definition.dbfile == dataFile;
+          message = "fail2ban data file does not match persistence";
+        }
+      ];
+
+      environment.persistence."/persist/system/root" = {
+        enable = true;
+        hideMounts = true;
+        files = [
+          dataFile
+        ];
+      };
+    })
   ]);
 }