fail2ban: implement for gitea

services/gitea.nix

@@ -58,4 +58,19 @@
   };
 
   services.openssh.settings.AllowUsers = [ config.services.gitea.user ];
+
+  # Protect Gitea login from brute force attacks
+  services.fail2ban.jails.gitea = {
+    enabled = true;
+    settings = {
+      backend = "systemd";
+      port = "http,https";
+      # defaults: maxretry=5, findtime=10m, bantime=10m
+    };
+    filter.Definition = {
+      failregex = ''^.*Failed authentication attempt for .* from <HOST>:.*$'';
+      ignoreregex = "";
+      journalmatch = "_SYSTEMD_UNIT=gitea.service";
+    };
+  };
 }