diff options
Diffstat (limited to '')
| -rw-r--r-- | modules/vhack/co/constants/module.nix | 2 | ||||
| -rw-r--r-- | modules/vhack/fa/fail2ban/module.nix | 14 |
2 files changed, 13 insertions, 3 deletions
diff --git a/modules/vhack/co/constants/module.nix b/modules/vhack/co/constants/module.nix index 9127488..9de2bce 100644 --- a/modules/vhack/co/constants/module.nix +++ b/modules/vhack/co/constants/module.nix @@ -61,6 +61,7 @@ grafana = 347; node-exporter = 348; smartctl-exporter-access = 349; + fail2ban = 350; # As per the NixOS file, the uids should not be greater or equal to 400; }; @@ -106,6 +107,7 @@ grafana node-exporter smartctl-exporter-access + fail2ban ; # The gid should match the uid. Thus should not be >= 400; diff --git a/modules/vhack/fa/fail2ban/module.nix b/modules/vhack/fa/fail2ban/module.nix index c619ef9..e1304a7 100644 --- a/modules/vhack/fa/fail2ban/module.nix +++ b/modules/vhack/fa/fail2ban/module.nix @@ -13,9 +13,8 @@ in { vhack.persist.directories = [ { directory = "/var/lib/fail2ban"; - # TODO: Fail2ban should probably run under a dedicated `fail2ban` user. <2024-12-25> - user = "root"; - group = "root"; + user = "fail2ban"; + group = "fail2ban"; mode = "0700"; } ]; @@ -54,5 +53,14 @@ in { ''; }; }; + users = { + groups.fail2ban = { + gid = config.vhack.constants.ids.gids.fail2ban; + }; + users.fail2ban = { + uid = config.vhack.constants.ids.uids.fail2ban; + group = "fail2ban"; + }; + }; }; } |