From fe558dead04b04e4c93ba73b56ce2021159e3d85 Mon Sep 17 00:00:00 2001
From: LorenzProbst <mail@lo-probst.de>
Date: Wed, 17 Jun 2026 14:04:04 +0200
Subject: [PATCH] add simple fail2ban, remove passwordauth for ssh

---
 configuration.nix | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index b915e9f..a8269e8 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -110,7 +110,15 @@
 
   programs = {
     mosh.enable = true;
-    ssh.startAgent = true;
+    ssh = {
+      startAgent = true;
+      extraConfig = "
+        Host git.lo-probst.de
+          Hostname git.lo-probst.de
+          Port 23
+          User forgejo
+      ";
+    };
   };
   # Some programs need SUID wrappers, can be configured further or are
   # started in user sessions.
@@ -128,11 +136,15 @@
       enable = true;
       ports = [ 22 ];
       settings = {
-        PasswordAuthentication = true;
+        PasswordAuthentication = false;
         KbdInteractiveAuthentication = false;
         PermitRootLogin = "yes";
       };
     };
+    fail2ban = {
+      enable = true;
+      bantime = "12h";
+    };
   };
 
 #  services.nginx = {