Merge pull request #120324 from pennae/restart-sshguard

nixos/sshguard: restart sshguard when services/backend changes

Changed files
+18 -14
nixos
modules
services
security
+18 -14
nixos/modules/services/security/sshguard.nix
···
let
cfg = config.services.sshguard;
+
configFile = let
+
args = lib.concatStringsSep " " ([
+
"-afb"
+
"-p info"
+
"-o cat"
+
"-n1"
+
] ++ (map (name: "-t ${escapeShellArg name}") cfg.services));
+
backend = if config.networking.nftables.enable
+
then "sshg-fw-nft-sets"
+
else "sshg-fw-ipset";
+
in pkgs.writeText "sshguard.conf" ''
+
BACKEND="${pkgs.sshguard}/libexec/${backend}"
+
LOGREADER="LANG=C ${pkgs.systemd}/bin/journalctl ${args}"
+
'';
+
in {
###### interface
···
config = mkIf cfg.enable {
-
environment.etc."sshguard.conf".text = let
-
args = lib.concatStringsSep " " ([
-
"-afb"
-
"-p info"
-
"-o cat"
-
"-n1"
-
] ++ (map (name: "-t ${escapeShellArg name}") cfg.services));
-
backend = if config.networking.nftables.enable
-
then "sshg-fw-nft-sets"
-
else "sshg-fw-ipset";
-
in ''
-
BACKEND="${pkgs.sshguard}/libexec/${backend}"
-
LOGREADER="LANG=C ${pkgs.systemd}/bin/journalctl ${args}"
-
'';
+
environment.etc."sshguard.conf".source = configFile;
systemd.services.sshguard = {
description = "SSHGuard brute-force attacks protection system";
···
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
partOf = optional config.networking.firewall.enable "firewall.service";
+
+
restartTriggers = [ configFile ];
path = with pkgs; if config.networking.nftables.enable
then [ nftables iproute2 systemd ]