From 0242700eea3cdb3abb4b5d5885e4ff614a8806c4 Mon Sep 17 00:00:00 2001 From: Andre Date: Sat, 2 Nov 2024 11:53:13 -0400 Subject: [PATCH] Services: finalize and enable webdav --- hosts/Hevana/default.nix | 2 +- modules/secrets/default.nix | Bin 5006 -> 5040 bytes modules/services/webdav.nix | 27 +++++++++++++++++++++++++++ 3 files changed, 28 insertions(+), 1 deletion(-) diff --git a/hosts/Hevana/default.nix b/hosts/Hevana/default.nix index 81ed8cf..ce0f5f0 100644 --- a/hosts/Hevana/default.nix +++ b/hosts/Hevana/default.nix @@ -236,7 +236,7 @@ in }; }; webdav = { - enable = false; + enable = true; home = "${services-root}/webdav"; url = config.secrets.services.webdav.url; users = config.secrets.services.webdav.users; diff --git a/modules/secrets/default.nix b/modules/secrets/default.nix index 0d47e9a1e34f4bbeb62ffedb3ca5a7b306997384..707a180a110803fd3f51c3e69cdcfbc13ae12806 100644 GIT binary patch literal 5040 zcmV;h6Hn{_M@dveQdv+`0Ae)G|7=-X42Gkuos;V2NS>=}9IKMYlOQu&ay4} zST7N=59Z&i&p3G20teRMQvAg^Ivf-*-Bv+WYN(n?9B!byxMx5M?`l~RI8s`nt{*y0v zO^<;!qunZ>8mB|Ir5HA=a)VBoQ$Dv|xT<3*7>R-2#y2EAAMV#sh3Scm^k8-%GY?bY zAs4Uf4jJ(cFaUKm3kep%7{&kEk3wN*qDiXR%BB`+Md% z9Nc|qx1LO9X8N)K;=x{GRV6LuRQ#+A6+fYbdyxiTdeLAvcpn9>tE|pA_1?bb_i&ac zwi1h3TiIC^a5f7~tKoha?rr1BPHNm6ldt$&Toq$Fscxz(LroByjgLZ_MM)+q55`t} z4gXz?l#fR+eSSf)MaFZtG5cqq$q@cLl@jjR`bW>!N__=BsHrC%Q|OQbOzWm^ zQH{a}Ah3#JCfG`80xkDk8us0NgifVG#QtnAm>Nf>J0HAh^GTPYI?#_ZL;kr!mJCdB zVqJSRw}d>&ykhTeV-t|dWB)370C~t$y@DZdP5ulhZUOQj7^UeGP+9rPBLYrT7=qgq z8((-*)$rJr9nHJCz;vg(gpcD^ZXX!e^3^E5W#5y#t#=~s@{fY4puaSE&(sEO^5yeg$%$zVf9NV19FZV`HRjO{d~^pe6UMo>61sQxr#iK z7k&G9;-8+sudbq3v5&#tq9ShHa*TIpkkK=G%&u|VS?>E9M6~1ga$vO!O|pxk9QNE; zD8va*U(2;)5@vPxeMzDS)OmBZjf8H4p6M>`19rMmKJ?zhRkan(S}=V!b7n~cDW+78 zr4w0 z%%=81HmTeZ7~kq~VMgh^Md-UYuU;=WnQGdfdI^bLE?y~Yu~x-h9$#}r_57hrs4!kd z(Kcc633=I2q;vXUaX29play1qz^@VfOnv8AC(~l9fH{$i{|)q_HcI(4p3|ipbB~Py z7NV28fkWaLwl;e{*}>on?3kUe6bBRRrC+u(2jx|Q1Zy6LlSar zV9X0>0I_aHo?n!3b|MJAG!9->(a#*pxed=;#0gLm+(23f!?dh)!$Ocb5z}a(dHn;A z2L0Mtlml|0fo8n{e@nbWi)T4T1|)4^VC#QVa@%?wRV|}8+rvVuQq@&qxUiE89^C-u zr`7GBxMch2Fy+4wH?4_Mr$l6gRy>OY(Qs3mqZp`zY+3k4l1H)xJMjNx*7CCnSqg`c z>|nk2lB*f+_BycfYzGlaU#t1j<1ZHEMZKrRS2)smt;aGkfBUVvqZ6DvFNhUg(ogJh zT>}XHWuWA*VDmOK(F`oIf2KdDmI7Vd{G&a6crk*5gDwO56HUn2&JtXm}`hZiOq89CoPb(pXwC z_>yFKk@z@GehipE=MJED*~W9+fDNO(h?hZD9V(RZB!Qj&;qWa}BAR6Fd~5h>zKwbw zeG`b{?$-fpJrS0MYURb+hf!2GojEj5M|B3x+|6!4qH&6?maj6zJW8gp$Cro#4Dv>* zc#41X|3>_%DSm>DLSQ^3ZfIdFKd+TBTT+dW0$spZIWx%AzKCrZue&+`F$_@1U{7xA zw5?^Ugy+*T?*rjPq++MP`9|7XMZ;L;Qc+d6wGxObNc{;0hl^Ph*nfwu(xPIoP1*O2 z1MWS*>J{YFmclmkjvRT2dj&>|2-Ro&C{?gWCP)PTNu7vfY4mxSP|NAytPK~Ryd6Pu zNt;mhKaCT01acC-pJ>>>eGURPyQiQ50ZEx&TVIv%_@r7 z5y_ag+kWNI6fdc(0B}u${fEG}B%*Wt7l@w>%X*L{Iaoqy8~HRgI^R8>A!8OTr`H z9E(JwwG8kYXsX1*ya1jBY~fgeB6y(Sacp!61>^9@9%A)mg9bVr>>f)%n)QE|B8HIJ z4D(AKxM?)Yy%BQJ1SSd5AZQEGIIP|PKJjLjr5(M*7j*oNq&IU+eF9TW}uux!cTYjfX)blSZZRkIiCkYgPUWh%wkdp_U=eSL!+) z(%_s~_^lvE=uK31NYRx_d60DW?Nc zS%4|oPrRD;*mLxX38?~@M3Eq!b@+19wgVvLzL71tRdwrlSSAIQElZy#P(TV<)C@Ne zm;AH_xZ)L4!@DAdZbM}I=`32O#T0O)61V@|N))ktP#9!L80<67qmr*-4>$(>1Dt`~ zX9q%V->Dk28Z1OZ?G|G52$0)>D(jzEllMrSt9<}WR8i`~+=czKIYao}LBiYqo{Qa$ zD1Qcz=Ib+excpkHu#wKasJ+ijCY6hWP$-uQu>1P^=}QB~y4!nWp-Zoh1vXkC6ab7- zN~#&S%sZo0Eebgjt*>&G%G>lj);hHANh8*+4pK*CM>em7<2ehKS#@dowy^bkz(6*a zV!FBv0I!ImTWcQ*gNFZAaW!v;@vB9N{uc2<@vh$cG9Mg5$R61(bx=!V4fAIm%GRQv z&Bzi@vSi`e-{;3hW9~vB-3~$XooEfD--9-ruBj6#->sno4+&EQSr*WVvqkxr?RqIc zxgx{`-{?PMXh0-C+r*B{LU)jbnbZ^tZ2quj(d|@0CZ{3uPuw;o4v1_~L8NIkeNz}Q zddiWXTBDmcdJ%xM4N*^$DSv~#$w90TxE|{9J5P=1Nl%m(Iklf8#{RjwmO~JP11iWw zSId_W(d)72Hzg5Y_H}!*I>bF^JZjWXTEQ#uD*G3cel2l`5`pF32@E70_2<0oo5N}E z!wiZp+ocv6+%@(rB3^~ssrcqCJ9R^h*Bu5`bSM8mm zq@|ft`UT_~qq2}Uu+4MHF`*?{vm*#OWzDhFeWllN*yAKL+yD*VXG_r6*eTg(fkY1_;D6c-V|!%+`c0CjuNYx% zxic~Dyw1V?(M6EOc5(x|CQZq)OM#aPb0bay7(8PMt_Dq28OzD;0Q7F zgAqa=swd#kz+1^IP1hV|_5-EoAu|AJx2`AFfE)ZY9jJh3DBAO_+{O09Q`FJyk^YJi zI}IULY3gfkUw;ZIuuJ(x;P7UHP*<35Ik(c8ewZ(hzJ%t24taCZA!iN_1&DYcuWdX;afTA^MC7 zG@*O`PFu#aR-iVV})Ajd-o1o>+URn}w7zY*s<4Js@Cnc?S z7hFZk&>$=o&eidx9*HVyv1KJhWZ=(3RY${CvaxAQt_~?{-fl(vd1e zxE6zl>Y}}*IZ?M%F2lC5VEl2@)gshGBWS?IoGb1$`*8hn7>70#Wtdl zYjusIs^FQx=Wp{dysG*(1G*a>d{nI}VJ&M512w9}99t$?f`{s9Xf+gX^PE~d07>My zq8_@2cPZm<2y&#?)ecjPw4*@g4ek|2Yj0Jy)WbE+-3ppNePnt4G7b=g3h&%UH<{!m zf^NXR(JeF7^v1m6eA5uPknjhBAYwrPcSe)OJ(i z$F{A=ky#q0vE=$mSlQM~YZ3$)VvvtK7L@;S z7%KgkZCqvXa(R24=w@R*$FUex3RaedJ@(8gy+iJ)yc37$?osock~e%+cedrvNdXMV zhH_sQnthC~h-O!OS@&c{sx>IpTTOy3U%v*tdK?Q?+T|z^|Co}d*S-M&(f@Xjc2f7~ zQRHkm-{U%{v$bJfNK3yGW|Zo&g(KL81=*eHfJKLW%+&*$Go^;qH!4wHbrP=@-0H1= z70eIiI8%K1DQgg}z6|(4bQlwcfGgbgpAVAxKS+QsREy5GIJta(`jBwf|E1-Cw0NV^ zT0ypXcy_}dL?42~O!YwB)rQ1+mlVMx7kb7v7yX~0!*Lt%j557SWC%go8>CA^$Q3`h zBUV2C0b)hz`FNl7tbXXP)LM1f76tS!UzGS;cqhMk4YrdCFB?g`j#bAG9#%z z3Oj}4ep)bsQ5IXt&n%*vTR=U;PKF_*#t+=e?m(Azpo>iO!5x*52hK6iUx7--?%cuh z0dqXmjU-v#i;M6pkruHqC*4m-Jc6De2i$U`RQtseMwT6lE%%^Esx_FtqLGB1S^<2K z!`o~>-%LM2#9Xq>2k!J*$c9bhm~!DZQ*_Cag1|0=mQgfrdnh%TF! z%K|HY^i};jM=}A3HG!d)Q>~axExfLE5_~ns)J8nwM(_T5j@PQqAiO^NamHLRG)+b^ zbRuaDu?{Yn)5F`em(!Kk)n(kl?2)#9=HW9)Q|$_#D5Xd9-f6+>x$K~?RGm$oh@>D>bEO)2 zi(A+;b41`wi0Wn(uS>N_ygX6P4FrB}C^+~0x;sdWKdj?vG!PCy(oEokLYk?Y?h(xc zBU)J1T-3f73uGkUD$9foIBZfv@?A%*K)*e*1Zy}lMe%>i*2q2}&NSw+#ccL)U4eBP zmLFvQ-2qaR1y)VJ(|2vlSuPjxUh5 zR&mG~l%`*+?6xR4ewJ0Q2S#(-e7wh~rD9VsaViw`tIe~HCQoJ#0_XVL6on}P>=0_4@l;FZN?cRnAwrKcG6HIMNQ>-{^XH*=N=BQQMD;n z@cHPDBr&7=9*f$Tq7pIHe6*F_8;?CECWOdUvq5jT$%WSEXHhoYDx9e=CO|5MqD?~an>P^~o@_Ad#bYd>ccrTOK3gg= z-)8K>;4(V7Hm5Q6N&|N`Jb25+Pf#9y-36ngv4X2oQ8k~|qn=x@DVu6}`Qba}{xyB@ z`kaV5H#N9zWTib5!Iwl7O3kYa6TqXs`8-A67CIW#Nl8>D(d)rZo79CKTsTETl~+<& zWQW`}M5-3uD&U_MmmkW!0k0u-J0>|?fGagYxu&3 z;6YTNwkI_MC<>;Y#^qmx8Z9Z{lX+WsG@KAR5%6CFEqj9j`4qdMjR+IWxkJ z0B-OXWk2+(=Bn(d9jkhlGOF;yG8xPdo7Mk&jxW+D0%V7s#KBiscbn%#&I%4?7C3he zIi{ujBb&Q@wcrsJ)2Q7oW#K7oFLtbtDPT?SFC3?_;%LVw$={?c5Y)D+owMMr>jIY) zhQ0`9#hB)B#{p9!049lbo)1RxEgZHL?inDVnYQ;Y*E*_xg6bUc5;;-80!L^fWk>0< z%N#ZXh`sZvnzYQZ-Jbn&dq*0IKib*rSh7IFFtwOo)yZe}cU?;%sBoymrk@*0kH3!p6?Hy- z)C#?{YT>#R15;_HOeeT;;vZOHa!r~rUm5{?V9O+JFubJ(r1cXt!LQw9?nO3%W$}*7 zjy)IXfHFaKOrY4|krLOJ13(Zicco-ZOGqOTw!(ym7@D9P;d%CiSm$U`_+!_KA=@F` z$*%e8EaJ2L`i?Pw8emB(k6}M)5e;%eFyU75b& znN}TCsUIoZi8UK-{dG&UBD{j<>qdr@909%Jse?4{0u^rU$XBY&Q+y|^_3 zryOuy?7pov|LE2rhViE0rpn^%ejc4R%}#J!(OhW+bGhs9T477vpH@KjS<4XO zKR}IU>{#Oe|+fMkw@VWb&@EcKUdkjX;53%sS zI!SC3Jkqob8&K7QHlba+dy`Ac6RZ8jNJ6h{tVY$Rz3*WNR=RKjhjNeDbA0AisvPenlRd+T|4%6B( z2~F?G?Z+cUApvLjb>qFuW}rfS^;3=%CHM*gb`&PMrOwz~n9WX|QxXolrrRRBpFUfZEXms0*ncus>-|L~ZUQ<4s)$P2%wCZ)ealijf`*F1UTr?8oRw&TK7H zQ3afBnkV(OGB3tU|FsIQ{N@#{r;~vm;YfD!MZ4;sPk#$xV(a;A9=WEjgm#y>5_$C- zE|eR~bg&5?N~#x}mR^69EFI>Pt=DKh3y*I%p7XcccJO2QpRlfjw{{5Y93L~@+b@AP zs(IT6x=0JQD(^z{fJPF2yddg>(T8V!?dVgWU`nFi8&y+U+KU}24KqVxB8O@8N7A0i z0~%I?WKTLHMC5|0{ax2!5~;(TbeM$CiKsz%`iJM+fzL?bgS$XOc@$cqB)ZMU9edo< zfg|%=a!AS|ajITny6J?NT7HkeEOy0cHjwal(=#b#+i&RZ*S}(}Y=I`^7=8+WBQb1@ zUhA#@ei|VE3`Hq8L{qvtBd%uF-(Bf2SIXS$hens@((tccSrkG4?d!83?(oivr)Xh{ zVt`xrM6>GK!x}IkXt06Gbsln{=SLH2tu;?U?#S-uE16&fkh3h~p{8}8SnQJRB>_Rl>jzV9}f)PGn;!sZ}yOM(vnPEt}sy6CeVCVeV&2YhIC zk&0=I$nDj%X{T!TV2QxF#WaD9`VULkHZnQP6$iHGxNJov3yHC^3!>O$;b+enXCAC4L+vJ|=TPDP5C{^B^Ih^`JB~1vg{o zns8vcSI$%9_70yzjWp*Vll2)e6)arUS&6>63mQhf?F(AU1iV=BtyxakQV(h#b~{k~ z?NjG(0<0WQo#z2n?y9mG$;yKUVUxc(e*z)P0&=gU{-pAvV#oGJHJs>_k(q|TbW*Sa z6V~=qQS`C2<)*yuqlv!zG>(AtpNThn3v9YEDfHxo*3^=PS71xv!6zp&7L`sKs({zZ z1!-$BsE)$VmhAq!iCEPUaijZDr z1b$9=&=|aoR`-bq<94xr%u$boA)k!v>oO7Pl=C|w{#S8M6I(Ot8{WJw=J9NAQve3=$wQ?uW^&}I(~=i6laK7F&a0_t&@qp z4mEthrRB`(H{~GE5bB1D5amJwI$VJ($=sQRuJigLT`2Nmrkj_PNLp7{$OCM-Itk6? z6$A7m4yjSexsi6@ueE2BVn}8Z5`Hh=`D$WX=&#aO^((=10k;buFkOg{7hwg6I%oL(T&fc9ylKQFf{?+GIeQM+mCm50%g~V~wdLw|}c&CDNS_ zqiUHiCz-yf{Y(v)Bp9k9jg;Xgm!<_o|lq1-e#TEz2x(2rNNz^Pz>YK;0 zH@dO}hA9zP7x-qA1xcRRk#@(yI<`UcuS;S9`P7!>{msTV2kZ#Vt*HJr3AJ3=y@Cfo z$aFtZ^cLPKzw&u1yih|komHSc0{Xf0tstB}DCl4T4EEjows7AkCH}~8ujTja#QrOB z|0GHmW4#(&gDQ$R?Y&Bm1y)7F8PrBUP7Gq%jQhiYv&xPw)nG1 zBxC!*4>PHbN_U5b%dph3aY|?h3sAN;``Z(1abBc;X9&t^Wy7-iPLsg8?qXz*{Tv60 zGrX~s!{fhphrYdfvcyAm)Ii8qZ$Z4!SHtyUY+__VkQ(L;J`>*5U#qEftB17HdJFjm z?!-R_1EF-(_1R~5;TVkm2~IDLQxY8+si7eW;@JNNm;RSw_DjFWG;Wi$i#y(SGDfh-_@!Ix*hw7+38f0f|Mm95$`K6shTTL?OBy<+$>P=D z0;Q@s)V-h#!K2t2q-$A)VS0|~Sr|Vd+fT$MKjp7yq9%nDr`>M#KI0^vm^0KR53Hie zPXJ8oQHr~79=$?Xvt!rzMe%MD0N?|wl5(&u0(}tixEg_JQAL6w#HQ|GXHZ$gLb)wc zwju=G!d)&a2kaiZ5$jqsEPcr<%BC>V!=%~(MQN;XF0cymcX97@pC|UWlaVX?*xpLe zv#1Z{4nlns$}RKU#@gRpL&0Wu?1YryF^>ZnJQvm~Ra2YRY4J3Gd~1;&iX}0;(a4Bo z*{v&pL4QKmX6kWJisgk3#!fya0c|H^xBu5Z9?Ivrv5uT?F=5-<4fjq&3*3WGuJ~~_ z(__6tL7AdI*g}zJr?V3YGPD^|jpFM0xpIHxI@2RmOyrLe=g0pl(-^qw_<%NP`=r@T+)a810hc?ST4*N|FOLx5)9CW#>RTmE%H_E(JFWifR_htN>HC1kdFIR zh>~~Aytyw~6(G0zHCzG2(&XFGLRo(>nGFUG-pmthje@y;!NS9y36VJdbk>6=L)RFM z9sX4nObTQ>zoz#&Jh&m^^1|iBkIaDl2hq!2pWHuC45_snqUXO4mza=(MAqv`Jx9H% Yp1+C;YBzYQZIuQM!5)R21Ggk$o-P@vYXATM diff --git a/modules/services/webdav.nix b/modules/services/webdav.nix index 2e6dde1..3b7d102 100644 --- a/modules/services/webdav.nix +++ b/modules/services/webdav.nix @@ -43,6 +43,7 @@ in port = port; scope = cfg.home; users = cfg.users; + behindProxy = true; }; }; @@ -60,6 +61,32 @@ in }; }; + environment.etc = lib.mkIf config.services.fail2ban.enable { + "fail2ban/filter.d/webdav.conf".text = '' + [INCLUDES] + before = common.conf + + [Definition] + # Failregex to match "invalid password" and extract remote_address only + failregex = ^.*invalid password\s*\{.*"remote_address":\s*""\s*\} + + # Failregex to match "invalid username" and extract remote_address only (if applicable) + failregex += ^.*invalid username\s*\{.*"remote_address":\s*""\s*\} + + ignoreregex = + ''; + + "fail2ban/jail.d/webdav.conf".text = '' + [webdav] + enabled = true + port = ${builtins.toString port} + filter = webdav + logpath = /var/log/webdav/fail2ban.log + banaction = iptables-allports + ignoreself = false + ''; + }; + systemd.services = { webdav.unitConfig.RequiresMountsFor = cfg.home; nginx.wants = [ config.systemd.services.webdav.name ];