From d297da3ea7d9087a860ab2ad02f4cefc00c1c36f Mon Sep 17 00:00:00 2001
From: Superredstone <patrickcanal3@gmail.com>
Date: Sat, 11 Jul 2026 10:31:40 +0200
Subject: [PATCH] feat(bomba): add fail2ban

---
 machines/bomba/services/default.nix  |  1 +
 machines/bomba/services/fail2ban.nix | 34 ++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+)
 create mode 100644 machines/bomba/services/fail2ban.nix

diff --git a/machines/bomba/services/default.nix b/machines/bomba/services/default.nix
index 15b954a..041c2fc 100644
--- a/machines/bomba/services/default.nix
+++ b/machines/bomba/services/default.nix
@@ -2,6 +2,7 @@
 {
   imports = [
     ./caddy.nix
+    ./fail2ban.nix
     ./gitea.nix
     ./navidrome.nix
     ./nextcloud.nix
diff --git a/machines/bomba/services/fail2ban.nix b/machines/bomba/services/fail2ban.nix
new file mode 100644
index 0000000..9e41433
--- /dev/null
+++ b/machines/bomba/services/fail2ban.nix
@@ -0,0 +1,34 @@
+{ lib, ... }:
+{
+  services.fail2ban = {
+    enable = true;
+    ignoreIP = [ "192.168.1.0/24" ];
+    bantime = "4h";
+    bantime-increment = {
+      enable = true; 
+      multipliers = "1 2 4 8 16 32 64";
+      overalljails = true;
+    };
+    jails = {
+      caddy-filter.settings = {
+        enabled = true;
+        port = "http,https";
+	action = "iptables-multiport";
+        filter = "caddy-filter";
+        logpath = "/var/log/caddy/*.log";
+        maxretry = 8;
+	backend = "auto";
+      };
+    };
+  };
+
+  environment.etc = {
+    "fail2ban/filter.d/caddy-filter.local".text = lib.mkDefault (
+      lib.mkAfter ''
+        [Definition]
+        failregex = ^\{"level":"info","ts":\d+\.\d+,"logger":"http\.log\.access\.log\d*","msg":"handled request".*"remote_ip":"<HOST>".*"status":4\d{2}.*
+        ignoreregex =
+      ''
+    );
+  };
+}