public
/
nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #120324 from pennae/restart-sshguard 

nixos/sshguard: restart sshguard when services/backend changes
This commit is contained in:
Aaron Andersen 2021-04-23 16:56:30 -04:00 committed by GitHub
parent de2d41e133 265d31bcbd
commit 5f2a8deb17
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 18 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
nixos/modules/services/security/sshguard.nix
View File

@ -5,6 +5,21 @@ with lib;
let let
cfg = config.services.sshguard; cfg = config.services.sshguard;
configFile = let
args = lib.concatStringsSep " " ([
"-afb"
"-p info"
"-o cat"
"-n1"
] ++ (map (name: "-t ${escapeShellArg name}") cfg.services));
backend = if config.networking.nftables.enable
then "sshg-fw-nft-sets"
else "sshg-fw-ipset";
in pkgs.writeText "sshguard.conf" ''
BACKEND="${pkgs.sshguard}/libexec/${backend}"
LOGREADER="LANG=C ${pkgs.systemd}/bin/journalctl ${args}"
'';
in { in {
###### interface ###### interface
@ -85,20 +100,7 @@ in {
config = mkIf cfg.enable { config = mkIf cfg.enable {
environment.etc."sshguard.conf".text = let environment.etc."sshguard.conf".source = configFile;
args = lib.concatStringsSep " " ([
"-afb"
"-p info"
"-o cat"
"-n1"
] ++ (map (name: "-t ${escapeShellArg name}") cfg.services));
backend = if config.networking.nftables.enable
then "sshg-fw-nft-sets"
else "sshg-fw-ipset";
in ''
BACKEND="${pkgs.sshguard}/libexec/${backend}"
LOGREADER="LANG=C ${pkgs.systemd}/bin/journalctl ${args}"
'';
systemd.services.sshguard = { systemd.services.sshguard = {
description = "SSHGuard brute-force attacks protection system"; description = "SSHGuard brute-force attacks protection system";
@ -107,6 +109,8 @@ in {
after = [ "network.target" ]; after = [ "network.target" ];
partOf = optional config.networking.firewall.enable "firewall.service"; partOf = optional config.networking.firewall.enable "firewall.service";
restartTriggers = [ configFile ];
path = with pkgs; if config.networking.nftables.enable path = with pkgs; if config.networking.nftables.enable
then [ nftables iproute2 systemd ] then [ nftables iproute2 systemd ]
else [ iptables ipset iproute2 systemd ]; else [ iptables ipset iproute2 systemd ];