guixsd-config

commit 5378ca30ed78f9fa65eb56d23fdaa52d9057ef78
parent 42b2f0fd0b68323622578b0929f232d98bb9327c
Author: Vineet Kumar <git@vineetk.net>
Date:   Fri, 23 Jan 2026 18:09:02 -0500

saklas: put ssh inside fail2ban jail

Diffstat:
M
epistemia/systems/saklas.scm
 | 
17
+++++++++++------

1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/epistemia/systems/saklas.scm b/epistemia/systems/saklas.scm
@@ -8,6 +8,7 @@
   #:use-module (gnu services dns)
   #:use-module (gnu services linux)
   #:use-module (gnu services networking)
+  #:use-module (gnu services security)
   #:use-module (gnu services shepherd)
   #:use-module (gnu services ssh)
   #:use-module (gnu services vpn)
@@ -131,12 +132,16 @@
 						  (string-append
 						   "nameserver 127.0.0.1\n"
 						   "search epistemia\n")))))
-		  (service openssh-service-type
-			   (openssh-configuration
-			    (permit-root-login #f)
-			    (authorized-keys
-			     `(("vin" ,(local-file "/data/ssh/id_ed25519.pub"))
-			       ("root" ,(local-file "/data/ssh/id_ed25519.pub"))))
+		  (service (fail2ban-jail-service
+			    openssh-service-type
+			    (fail2ban-jail-configuration
+			     (name "sshd")
+			     (enabled? #t)))
+			    (openssh-configuration
+			     (permit-root-login #f)
+			     (authorized-keys
+			      `(("vin" ,(local-file "/data/ssh/id_ed25519.pub"))
+				("root" ,(local-file "/data/ssh/id_ed25519.pub"))))
 			     (extra-content "\
                                        ListenAddress 127.0.0.1:22
                                        ListenAddress 162.55.242.220:22