fail2ban: Update to 0.8.10

Also fix random start failures due to a race between the fail2ban
server and the postStart script.

1 files changed, 27 insertions, 29 deletions

diff --git a/nixos/modules/services/security/fail2ban.nix b/nixos/modules/services/security/fail2ban.nix
index 2b2a54ef4097..395a5df8af07 100644
--- a/nixos/modules/services/security/fail2ban.nix
+++ b/nixos/modules/services/security/fail2ban.nix
@@ -10,7 +10,7 @@ let
 
   jailConf = pkgs.writeText "jail.conf"
     (concatStringsSep "\n" (attrValues (flip mapAttrs cfg.jails (name: def:
-      optionalString (def != "") 
+      optionalString (def != "")
         ''
           [${name}]
           ${def}
@@ -32,7 +32,8 @@ in
             [Definition]
             loglevel  = 3
             logtarget = SYSLOG
-            socket    = /var/run/fail2ban/fail2ban.sock
+            socket    = /run/fail2ban/fail2ban.sock
+            pidfile   = /run/fail2ban/fail2ban.pid
           '';
         type = types.string;
         description =
@@ -71,56 +72,53 @@ in
             <filename>/etc/fail2ban/filter.d</filename>.
           '';
       };
-      
+
     };
 
   };
 
-  
+
   ###### implementation
 
   config = {
 
     environment.systemPackages = [ pkgs.fail2ban ];
 
-    environment.etc =
-      [ { source = fail2banConf;
-          target = "fail2ban/fail2ban.conf";
-        }
-        { source = jailConf;
-          target = "fail2ban/jail.conf";
-        }
-        { source = "${pkgs.fail2ban}/etc/fail2ban/action.d/*.conf";
-          target = "fail2ban/action.d";
-        }
-        { source = "${pkgs.fail2ban}/etc/fail2ban/filter.d/*.conf";
-          target = "fail2ban/filter.d";
-        }
-      ];
-
-    system.activationScripts.fail2ban =
-      ''
-        mkdir -p /var/run/fail2ban -m 0755
-      '';
+    environment.etc."fail2ban/fail2ban.conf".source = fail2banConf;
+    environment.etc."fail2ban/jail.conf".source = jailConf;
+    environment.etc."fail2ban/action.d".source = "${pkgs.fail2ban}/etc/fail2ban/action.d/*.conf";
+    environment.etc."fail2ban/filter.d".source = "${pkgs.fail2ban}/etc/fail2ban/filter.d/*.conf";
 
     systemd.services.fail2ban =
       { description = "Fail2ban intrusion prevention system";
 
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
-      
+
         restartTriggers = [ fail2banConf jailConf ];
         path = [ pkgs.fail2ban pkgs.iptables ];
-        
+
+        preStart =
+          ''
+            mkdir -p /run/fail2ban -m 0755
+          '';
+
         serviceConfig =
           { ExecStart = "${pkgs.fail2ban}/bin/fail2ban-server -f";
             ReadOnlyDirectories = "/";
-            ReadWriteDirectories = "/var/run/fail2ban /var/tmp";
-            CapabilityBoundingSet="CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW";
+            ReadWriteDirectories = "/run/fail2ban /var/tmp";
+            CapabilityBoundingSet = "CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW";
           };
 
         postStart =
           ''
+            # Wait for the server to start listening.
+            for ((n = 0; n < 20; n++)); do
+              if fail2ban-client ping; then break; fi
+              sleep 0.5
+            done
+
+            # Reload its configuration.
             fail2ban-client reload
           '';
       };
@@ -137,14 +135,14 @@ in
       '';
 
     # Block SSH if there are too many failing connection attempts.
-    services.fail2ban.jails."ssh-iptables" =
+    services.fail2ban.jails.ssh-iptables =
       ''
         filter   = sshd
         action   = iptables[name=SSH, port=ssh, protocol=tcp]
         logpath  = /var/log/warn
         maxretry = 5
       '';
-    
+
   };
 
 }