From b180e94a19918dae00612419dc3abc3aac8793db Mon Sep 17 00:00:00 2001
From: Benedikt Peetz <benedikt.peetz@b-peetz.de>
Date: Wed, 28 Oct 2026 17:30:00 +0100
Subject: modules/fail2ban: Use separate user for fail2ban

---
 modules/vhack/fa/fail2ban/module.nix | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

(limited to 'modules/vhack/fa/fail2ban/module.nix')

diff --git a/modules/vhack/fa/fail2ban/module.nix b/modules/vhack/fa/fail2ban/module.nix
index c619ef9..e1304a7 100644
--- a/modules/vhack/fa/fail2ban/module.nix
+++ b/modules/vhack/fa/fail2ban/module.nix
@@ -13,9 +13,8 @@ in {
     vhack.persist.directories = [
       {
         directory = "/var/lib/fail2ban";
-        # TODO: Fail2ban should probably run under a dedicated `fail2ban` user. <2024-12-25>
-        user = "root";
-        group = "root";
+        user = "fail2ban";
+        group = "fail2ban";
         mode = "0700";
       }
     ];
@@ -54,5 +53,14 @@ in {
         '';
       };
     };
+    users = {
+      groups.fail2ban = {
+        gid = config.vhack.constants.ids.gids.fail2ban;
+      };
+      users.fail2ban = {
+        uid = config.vhack.constants.ids.uids.fail2ban;
+        group = "fail2ban";
+      };
+    };
   };
 }
-- 
cgit v1.3.1