bleh

common/configuration.nix

@@ -10,7 +10,13 @@
   services.openssh.enable = true;
   services.openssh.settings.PermitRootLogin = lib.mkDefault "no";
 
-  services.fail2ban.enable = true;
+  services.fail2ban = {
+    enable = true;
+    maxretry = 5;
+    ignoreIP = [
+      "neptune.site.deuxfleurs.fr"
+    ];
+  };
 
   # Activate nix flakes.
   nix.settings.experimental-features = [ "nix-command" "flakes" ];

pastila/srv.nix

@@ -1,5 +1,8 @@
 { config, lib, pkgs, ... }:
 
+let
+  up_dir = /srv/up;
+in
 {
   services.nginx.enable = true;
 
@@ -7,25 +10,28 @@
   # in /home. So we need to use a different location.
   users.users."up" = {
     isNormalUser = true;
-    home = /srv/up;
+    home = up_dir;
     group = config.services.nginx.group;
-    createHome = true;
-    homeMode = "750";
+    # Unsure why this is broken, but couldn't make things work without
+    # creating the directory by hand.
+    # createHome = true;
+    # homeMode = "750";
   };
 
   services.nginx.virtualHosts."srv.isomorphis.me" = {
     forceSSL = true;
     enableACME = true;
-    root = config.users.users."up".home;
-    locations."/" = {
-      extraConfig = ''
-        autoindex on;
-      '';
-    };
-    locations."/i/" = {
-      extraConfig = ''
-        autoindex off;
-      '';
+    root = up_dir;
+    locations ={
+      "/" = {
+        extraConfig = "autoindex on;";
+      };
+      "/.ssh" = {
+        return = "403";
+      };
+      "/i/" = {
+        extraConfig = "autoindex off;";
+      };
     };
   };
 }