16363dc887
Replaces bare enable flag with a dedicated service module covering: - SSH brute force via journald - Nginx Proxy Manager auth failures via Docker log files - Jellyfin auth failures via journald Includes incremental ban times (up to 1 week) and LAN ignore rules. https://claude.ai/code/session_01PwAXuaoJx7qD5FhVLsn7Sn
34 lines
766 B
Nix
34 lines
766 B
Nix
{ config, pkgs, lib, ... }:
|
|
{
|
|
config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
|
|
# Create symlink from home to storage
|
|
systemd.tmpfiles.rules = [
|
|
"L+ /home/fred/storage - - - - /mnt/storage"
|
|
];
|
|
|
|
# Basic system packages
|
|
environment.systemPackages = with pkgs; [
|
|
mergerfs
|
|
wget
|
|
btop
|
|
util-linux
|
|
javaPackages.compiler.temurin-bin.jre-25
|
|
unzip
|
|
screen
|
|
yt-dlp
|
|
];
|
|
|
|
# Enable Docker
|
|
virtualisation.docker.enable = true;
|
|
|
|
# Basic networking
|
|
networking.useDHCP = lib.mkDefault true;
|
|
|
|
# Open firewall for SSH
|
|
networking.firewall.allowedTCPPorts = [ 22 ];
|
|
services.openssh = {
|
|
enable = true;
|
|
settings.PermitRootLogin = "no";
|
|
};
|
|
};
|
|
}
|