feat: enable fail2ban

Signed-off-by: Lander Van den Bulcke <landervandenbulcke@gmail.com>

hosts/servers/hosting-01.nix

@@ -29,6 +29,18 @@ in
     ];
   };
 
+  services.fail2ban.jails = {
+    # max 6 failures in 600 seconds
+    "nginx-spam" = ''
+      enabled  = true
+      filter   = nginx-bruteforce
+      logpath = /var/log/nginx/access.log
+      backend = auto
+      maxretry = 6
+      findtime = 600
+    '';
+  };
+
   services.nginx = {
     enable = true;
     recommendedGzipSettings = true;