1 files changed, 11 insertions, 3 deletions
diff --git a/modules/vhack/fa/fail2ban/module.nix b/modules/vhack/fa/fail2ban/module.nix
index c619ef9..e1304a7 100644
--- a/modules/vhack/fa/fail2ban/module.nix
+++ b/modules/vhack/fa/fail2ban/module.nix
@@ -13,9 +13,8 @@ in {
     vhack.persist.directories = [
       {
         directory = "/var/lib/fail2ban";
-        # TODO: Fail2ban should probably run under a dedicated `fail2ban` user. <2024-12-25>
-        user = "root";
-        group = "root";
+        user = "fail2ban";
+        group = "fail2ban";
         mode = "0700";
       }
     ];
@@ -54,5 +53,14 @@ in {
         '';
       };
     };
+    users = {
+      groups.fail2ban = {
+        gid = config.vhack.constants.ids.gids.fail2ban;
+      };
+      users.fail2ban = {
+        uid = config.vhack.constants.ids.uids.fail2ban;
+        group = "fail2ban";
+      };
+    };
   };
 }