server: nextcloud: enable fail2ban

hosts/configuration_server.nix

@@ -80,6 +80,10 @@
         source = ../modules/services/server/fail2ban/filter/gitea.conf;
         mode = "0444";
       };
+      "fail2ban/filter.d/nextcloud.conf" = {
+        source = ../modules/services/server/fail2ban/filter/nextcloud.conf;
+        mode = "0444";
+      };
     };
     systemPackages = with pkgs; [           # Default packages install system-wide
       vim
@@ -116,16 +120,23 @@
     fail2ban = {
         enable = true;
         maxretry = 5;
+        extraSettings = {
+           findtime = "15m";
+           bantime = "1h";
+        };
         jails = {
             gitea = ''
               enabled = true
               filter = gitea
               backend = systemd
-              maxretry = 10
-              findtime = 3600
-              bantime = 900
               action = iptables-allports
             '';
+            nextcloud = ''
+              backend = auto
+              enabled = true
+              filter = nextcloud
+              logpath = /var/lib/nextcloud/data/nextcloud.log
+              action = iptables-allports
           };
     };
 

modules/services/server/fail2ban/filter/gitea.conf

@@ -1,3 +1,5 @@
 [Definition]
 failregex =  .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>
 ignoreregex =
+#journalmatch = _SYSTEMD_UNIT=gitea.servie
+journalmatch = 

modules/services/server/fail2ban/filter/nextcloud.conf

@@ -0,0 +1,6 @@
+[Definition]
+_groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)
+failregex = ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
+            ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
+datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"
+journalmatch = 

modules/services/server/nextcloud.nix

@@ -8,11 +8,13 @@
         package = pkgs.nextcloud26;
         enableBrokenCiphersForSSE = false;
         database.createLocally = false;
+        logType = "file";
         caching = {
             redis = true;
             apcu = false;
         };
         extraOptions = {
+            logfile = "nextcloud.log";
             redis = {
                 host = "/run/redis-nextcloud/redis.sock";
                 port = 0;