diff --git a/nixos/common/modules/fail2ban/traefik.nix b/nixos/common/modules/fail2ban/traefik.nix index e90a6f1e..de250f9d 100644 --- a/nixos/common/modules/fail2ban/traefik.nix +++ b/nixos/common/modules/fail2ban/traefik.nix @@ -4,21 +4,11 @@ # https://blog.lrvt.de/configuring-fail2ban-with-traefik/ # https://nixos.wiki/wiki/Fail2ban#Extending_Fail2ban - services.logrotate = { - enable = true; - checkConfig = true; - settings = { - "/var/log/traefik/access.log" = { - frequency = "daily"; - rotate = 30; - }; - }; - }; - services.fail2ban.jails = { traefik-general-forceful-browsing = { settings = { - enabled = true; + # NOTE: This is disabled. + enabled = false; filter = "traefik-general-forceful-browsing"; action = "action-ban-docker-forceful-browsing"; logpath = "/var/log/traefik/access.log"; diff --git a/nixos/common/modules/logrotate/traefik.nix b/nixos/common/modules/logrotate/traefik.nix new file mode 100644 index 00000000..047decff --- /dev/null +++ b/nixos/common/modules/logrotate/traefik.nix @@ -0,0 +1,16 @@ +{ ... }: { + # NOTE: This is dependent on the Traefik access.log being set in traefik.yml + # Curently this is only enabled on the external traefik instance for + # sysctl.io + # TODO: I need to check on if Promtail is ingesting this log. + services.logrotate = { + enable = true; + checkConfig = true; + settings = { + "/var/log/traefik/access.log" = { + frequency = "daily"; + rotate = 30; + }; + }; + }; +} diff --git a/nixos/hosts/nuc-server/default.nix b/nixos/hosts/nuc-server/default.nix index 9b11fce8..bba2c136 100644 --- a/nixos/hosts/nuc-server/default.nix +++ b/nixos/hosts/nuc-server/default.nix @@ -7,12 +7,16 @@ in { imports = [ (modulesPath + "/installer/scan/not-detected.nix") ( import ../../common/services/syncthing/pictures.nix { path = "/Storage/Media/Pictures/RAW"; }) - ../../common/services/tailscale-autoconnect.nix + ../../common/modules/secureboot.nix ../../common/modules/ssh-luks.nix + ../../common/modules/logrotate/traefik.nix + + ../../common/services/tailscale-autoconnect.nix ../../common/services/docker.nix ../../common/services/forgejo-runner.nix ../../common/services/syncthing/default.nix + ./disks.nix ./mounts.nix ./cron.nix diff --git a/nixos/hosts/warsaw-ovh-01/default.nix b/nixos/hosts/warsaw-ovh-01/default.nix index 7d0bc902..59aa5b34 100644 --- a/nixos/hosts/warsaw-ovh-01/default.nix +++ b/nixos/hosts/warsaw-ovh-01/default.nix @@ -3,6 +3,8 @@ (modulesPath + "/installer/scan/not-detected.nix") ../../common/modules/boot.nix ../../common/modules/builder.nix + ../../common/modules/logrotate/traefik.nix + ../../common/services/docker.nix ../../common/services/tailscale-autoconnect.nix ../../common/services/forgejo-runner.nix