Now that the fail2ban service has the ".enable" option, I think it's time to add it to the module list, so that we can enable it in configuration.nix like this: services.fail2ban.enable = true;