From 0214621a5887ee11aefa78b27ebc98baf79e2bc9 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Tue, 20 Jan 2026 14:39:23 -0500
Subject: [PATCH] fail2ban: implement for bitwarden

---
 services/bitwarden.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/services/bitwarden.nix b/services/bitwarden.nix
index 8028662..85bba39 100644
--- a/services/bitwarden.nix
+++ b/services/bitwarden.nix
@@ -43,4 +43,19 @@
     "Z ${service_configs.vaultwarden.path} 0700 vaultwarden vaultwarden"
     "Z ${config.services.vaultwarden.backupDir} 0700 vaultwarden vaultwarden"
   ];
+
+  # Protect Vaultwarden login from brute force attacks
+  services.fail2ban.jails.vaultwarden = {
+    enabled = true;
+    settings = {
+      backend = "systemd";
+      port = "http,https";
+      # defaults: maxretry=5, findtime=10m, bantime=10m
+    };
+    filter.Definition = {
+      failregex = ''^.*Username or password is incorrect\. Try again\. IP: <HOST>\..*$'';
+      ignoreregex = "";
+      journalmatch = "_SYSTEMD_UNIT=vaultwarden.service";
+    };
+  };
 }