From f05c2a3644c93b5e73834c4120b4974e9e4b6fda Mon Sep 17 00:00:00 2001
From: Antoine Martin <antoine@alarsyo.net>
Date: Thu, 13 Oct 2022 11:47:24 +0200
Subject: [PATCH] services: photoprism: add fail2ban rules

---
 services/photoprism.nix | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/services/photoprism.nix b/services/photoprism.nix
index e971968..bb2c87a 100644
--- a/services/photoprism.nix
+++ b/services/photoprism.nix
@@ -91,5 +91,23 @@ in {
         "${cfg.home}/storage"
       ];
     };
+
+    services.fail2ban.jails = {
+      photoprism = ''
+        enabled = true
+        filter = vaultwarden
+        port = http,https
+        maxretry = 3
+        logpath = /var/log/nginx/photoprism_access.log
+      '';
+    };
+
+    environment.etc = {
+      "fail2ban/filter.d/photoprism.conf".text = ''
+        [Definition]
+        failregex = ^<HOST> -.*"POST \/api\/v1\/session HTTP[^"]*" 400 .*$
+        ignoreregex =
+      '';
+    };
   };
 }