hosts: start using tailscale + endlessh -> fail2ban

2 files changed, 29 insertions, 14 deletions

diff --git a/modules/nixos/features/tailscale.nix b/modules/nixos/features/tailscale.nix
new file mode 100644
index 0000000..d2c8b20
--- /dev/null
+++ b/modules/nixos/features/tailscale.nix
@@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.getchoo.features.tailscale;
+  inherit (lib) mkDefault mkEnableOption mkIf;
+in {
+  options.getchoo.features.tailscale.enable = mkEnableOption "enable support for tailscale";
+
+  config = mkIf cfg.enable {
+    services = {
+      openssh.openFirewall = false;
+      tailscale.enable = mkDefault true;
+    };
+
+    networking.firewall = {
+      allowedUDPPorts = [config.services.tailscale.port];
+      checkReversePath = "loose";
+      trustedInterfaces = mkDefault ["tailscale0"];
+    };
+  };
+}
diff --git a/modules/nixos/server/default.nix b/modules/nixos/server/default.nix
index 504a333..210484e 100644
--- a/modules/nixos/server/default.nix
+++ b/modules/nixos/server/default.nix
@@ -24,15 +24,6 @@ in {
 
     environment.systemPackages = [pkgs.cachix];
 
-    networking = {
-      firewall = let
-        ports = [80 420];
-      in {
-        allowedUDPPorts = ports;
-        allowedTCPPorts = ports;
-      };
-    };
-
     nix = {
       gc.options = "--delete-older-than 7d --max-freed 50G";
       settings = {
@@ -63,16 +54,17 @@ in {
     };
 
     services = {
-      endlessh = {
-        enable = mkDefault true;
-        port = mkDefault 22;
-        openFirewall = mkDefault true;
+      fail2ban = {
+        enable = true;
+        bantime-increment = {
+          enable = true;
+        };
+        maxretry = 5;
       };
 
       openssh = {
         enable = true;
         passwordAuthentication = mkDefault false;
-        ports = mkDefault [420];
       };
     };
   };