.sops.yaml

@@ -2,10 +2,11 @@ keys:
   - &users
     - &notoh age1ckvmyqkwk69j64ev3fmckytz6k2dv79z4gn5qf6gxqyevp5yjfesdfkxmn
   - &hosts
+    - &sakura age1vzjyhapn9mqs6x0xwf2xfqaxtlts2dkxt3uudmv7p5868f4jcgrqgqdts
     - &tsuki age19l9yutk47w8hdqyzy8p3ygxv7ql6dk42rswshxe7kj0kd28wxsyqxtscl7
 
 creation_rules:
   - path_regex: secrets/[^/]+\.yaml$
     key_groups:
       - age:
-        - *notoh
+        - *notoh

modules/security.nix

@@ -49,8 +49,6 @@
   };
   services.fail2ban = {
     enable = true;
-    bantime = "1h";
-    maxretry = 1;
     ignoreIP = [
       "192.168.0.0/16"
       "172.16.0.0/12"
@@ -59,6 +57,8 @@
     ];
     extraSettings = {
       findtime = 100000;
+      bantime = 100000;
+      maxretry = 1;
       mode = "aggressive";
     };
   };

secrets/secrets.yaml

@@ -5,9 +5,7 @@ rusty-auth-token: ENC[AES256_GCM,data:FZ1bC6wijkHPII2AlYnDq9P6pFq2qWVo,iv:92ZH8N
 restic-repo-pwd: ENC[AES256_GCM,data:wan4U/w6417NWnbTTe7ID4y6Dv+bs0D3Fvw9ur6gIdU=,iv:4B5ihL5/QiNObqZwLwo4Sd33zx4pqRWszdzdutvK6a0=,tag:KqU5sSpPG8n6qHxxJUpDTg==,type:str]
 woodpecker-server: ENC[AES256_GCM,data:KxAXn4ptTEAxKmQytlBi464NTwwkZA3cJ9oasXrNi/f5s1ZQO2vFbRsrgR7cTF7YsNjSq4HdAM9MFTnDS5FzViWLDEqME+SzGShGf9pKCoMhUpz+UPRD/mmY8XM7IycPFFhe/vC/m1JcrQJjdA0QH8CaelVbDEERPPLTSLA4BzB/MZjy9CsRpJjA+lt+0g==,iv:Tnnc7Ww+HZ6vdztV1DbIERC8T8/td8p0s50oSbbiKj8=,tag:7tNRuIlUouM5sQmVjJnYXQ==,type:str]
 woodpecker-agent-secret: ENC[AES256_GCM,data:Xfz8OEQqcqeb9zi531zhfitbDbfxtVAsf4JFmmqpAL9rMsQwRl8vWVp3m23yEl6F5f67+Bf26GAlPwWT8hVCAA==,iv:fCoBgR1L1niZaa/HCCfJTsrJvOrlGv0Fa7zcTL6s118=,tag:SOE/4MOp6tx+eTr4vrxxGA==,type:str]
-attic-secret: ENC[AES256_GCM,data:RH5ZyG/FqMgWAdNnwMCeP11d/+LxQ//IjIWoGp+Pck2otuUq0TD+IQasonbiz+3tOtyJxmL7Kesov56R8FfKX1yp7OCvyrM+vNH/4lJKjXPtzQCGvmCAlTvWLFmVAu0Vxnfk4yGTnY48GycmlDeSU7ap13IbCqBLpFnyETqV5he7IJlmAS/+uXlo4FVn9T8gP6PRCIEYq7iaf18BV17itzG8XQgSA4nxKvPAqa4i64tmfm0HqZJ3y8XQNq/c32yMBQdrjUuUHklPqAAht0KRqp2UX9dk,iv:kziKIamP6UG0ohht1woqHOf3lIzqt9RC3iGq5N3gwvg=,tag:kFff64ddihlz9ilAB8nrUw==,type:str]
-s3-keyid: ENC[AES256_GCM,data:66gFMHBA1NlZf+YONJkitOrxSOLKXrisEg==,iv:/geb8Z7Uto1Jk8YT7VE/j6Jp18bvucJ4Ocp135sy5Rg=,tag:riHoznD7aErlF4+CuZB2CQ==,type:str]
-s3-secret-key: ENC[AES256_GCM,data:VzFl4foy42gCeY+yLgXSBy0Dj1geOWzI3WrxCfvsnQ==,iv:Hgc7fpI3gBnQEq5wmGb+xlZU4B5KemMlkD02ZTU7HaI=,tag:OGjfv+HxmWGm/j9qRxY+wQ==,type:str]
+attic-secret: ENC[AES256_GCM,data:dHKfY7zNz5cH2pOiK6evuZv/WMt+VHhzeOB2E3kgcEvB7uCTcC1xRtyyCpCpsBZiTJg6RRHKPf0RO8pF3NIrKlTMQZvnzlTOW7baNlOXDPGrgTfH78/a3o+laVUeBozTIvvi8fkztJjUq3VcSPRkkdzo6OCwft70R3dbYmqPQ3vd,iv:MrJ55LJMBlGik0LW1Co99pHiK4JysoBJtJvW6Rgx4Bs=,tag:eW2kdbTJ7LQy8QlRr5NkTg==,type:str]
 gluetun: ENC[AES256_GCM,data:yL+LOPpwU+CAtbjc7YWbNUOTpDhq4mH3aJOl3hPYxgbFUba6NVJQ73mFt7BF+PXeqA/ilbZJW3GbCfAoXWLDP3qzFYqs9XeEV/FhHznkVHB88xdr+Fbv7cuCEa7PnnYbSiwr/R68EZLsGSr+u99+uu1TH6ABXG9nJna0bkwkTfx6ui/Yc2GndWS+Ew==,iv:rYdMasJS1LqMGvMYFyAdEkoTLtOHrZHGcfBOvbn63bg=,tag:YNcP/pvgKHPYNhAwVGdFHw==,type:str]
 miniflux: ENC[AES256_GCM,data:C4kurW7+C62ewPUalvJWnxV/fipCEwFFvkAst13aRAwi0v+R8g9skvW9F9PkSrvkyjAOFaCFKA==,iv:xEG3s9WCpjWFbBqR8dHBlrsf/ItvcdhlP+b9qOo5Wx8=,tag:XmswbqaAJaYElSYwW+V/kw==,type:str]
 authelia-jwt: ENC[AES256_GCM,data:cAn2uZeSGjG2FqTFgZkupcSutCZLvZXCNBsxuUQvGX4=,iv:1OTDQzQwaPTmnTEB4TfnxU6l8CdBAlHfqFThE8QZa6A=,tag:KJ6aYDczHFajhLJHemfIQw==,type:str]
@@ -27,8 +25,8 @@ sops:
             YWNQcURKMSs2U0pOa3E0cTdCZ3RnalkKGayA7DBUQS+kn+6OYVBc6oTunF0qeZdt
             5b9DLHgh0HRWFm09XGSOog8K315d93Wzblw1My1/dXeEQX/ryinqUQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-06-25T23:47:38Z"
-    mac: ENC[AES256_GCM,data:a6Vyt6GRqbymTNJo06qyRfowz612oFf5TDf3gX8Q+E30gt2G6y4ETnilCL6G5dYXqyaYobaJpKFwbQDJ/T3CdbbcCp9pKC0tBhzHYXRl+ONA159NX58dy4G+u4GFcOGldJTcrFZQeYKOFfaTKp7l53ZNJBfZLgejP13+Tuby+tc=,iv:DGOunXWScU4LOVChnKsPe5KdQEf8spAXu1OLUW/SoNw=,tag:T5Yb038MFV5+F36BamP8WQ==,type:str]
+    lastmodified: "2023-06-24T01:38:36Z"
+    mac: ENC[AES256_GCM,data:7DsI6KJ1Xmftj1JxTexaxjkOOEeIMVZgOl8hr/Zios1jyGLYSfzZ6umGV5fddJd1nc7xI1moXQR3E+tKUzcDhvV7CYbMS6TGvU3ice8gpwQjRFNmmqCdOb2pydWxkZH8uhrSSY6uxqnu0sIsLsS+PM1pHOyFo93/P2BHUWI/8Fs=,iv:h61eEAxnj/tR/ebZQI7bVHsBcoJJQ/yomgIeoFNk5FA=,tag:ZWdMIkVXkloZtnKErIKnGQ==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.7.3