diff options
| author | Benedikt Peetz <benedikt.peetz@b-peetz.de> | 2026-10-28 17:30:00 +0100 |
|---|---|---|
| committer | Benedikt Peetz <benedikt.peetz@b-peetz.de> | 2026-10-28 17:30:00 +0100 |
| commit | b180e94a19918dae00612419dc3abc3aac8793db (patch) | |
| tree | ccfd1e3f13f53ea54a08de067699f7189b5bd99a /modules/vhack/fa/fail2ban/module.nix | |
| parent | flake: Switch inputs over to unflake (diff) | |
| download | nixos-server-b180e94a19918dae00612419dc3abc3aac8793db.zip | |
modules/fail2ban: Use separate user for fail2ban
Diffstat (limited to '')
| -rw-r--r-- | modules/vhack/fa/fail2ban/module.nix | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/modules/vhack/fa/fail2ban/module.nix b/modules/vhack/fa/fail2ban/module.nix index c619ef9..e1304a7 100644 --- a/modules/vhack/fa/fail2ban/module.nix +++ b/modules/vhack/fa/fail2ban/module.nix @@ -13,9 +13,8 @@ in { vhack.persist.directories = [ { directory = "/var/lib/fail2ban"; - # TODO: Fail2ban should probably run under a dedicated `fail2ban` user. <2024-12-25> - user = "root"; - group = "root"; + user = "fail2ban"; + group = "fail2ban"; mode = "0700"; } ]; @@ -54,5 +53,14 @@ in { ''; }; }; + users = { + groups.fail2ban = { + gid = config.vhack.constants.ids.gids.fail2ban; + }; + users.fail2ban = { + uid = config.vhack.constants.ids.uids.fail2ban; + group = "fail2ban"; + }; + }; }; } |