feat: enable fail2ban

Signed-off-by: Lander Van den Bulcke <landervandenbulcke@gmail.com>

hosts/servers/mail-01.nix

@@ -12,6 +12,26 @@ in
     }
   ];
 
+  services.fail2ban.jails = {
+    # max 6 failures in 600 seconds
+    "nginx-spam" = ''
+      enabled  = true
+      filter   = nginx-bruteforce
+      logpath = /var/log/nginx/access.log
+      backend = auto
+      maxretry = 6
+      findtime = 600
+    '';
+
+    # max 3 failures in 600 seconds
+    "postfix-bruteforce" = ''
+      enabled = true
+      filter = postfix-bruteforce
+      findtime = 600
+      maxretry = 3
+    '';
+  };
+
   mailserver = {
     enable = true;
     fqdn = "mail.escapeangle.com";