Alan Orth
00558c7dea
Re-work the fail2ban and nftables interaction. Use systemd's PartOf to indicate that fail2ban is part of the nftables service, which tells systemd to propogate stop/start signals to it. Then we tell the firehol update script to restart nftables instead of reload. The different between restart and reload is meaningless for nftables but we want systemd to propagate the stop/start signals to fail2ban.
27 lines
1.1 KiB
Django/Jinja
27 lines
1.1 KiB
Django/Jinja
[Unit]
|
|
# If nftables is stopped or restarted, propagate to fail2ban as well
|
|
PartOf=nftables.service
|
|
|
|
[Service]
|
|
PrivateDevices=yes
|
|
PrivateTmp=yes
|
|
ProtectHome=read-only
|
|
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('18','>=')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11','>=')) %}
|
|
ProtectSystem=strict
|
|
{% else %}
|
|
{# Older systemd versions don't have ProtectSystem=strict #}
|
|
ProtectSystem=full
|
|
{% endif %}
|
|
NoNewPrivileges=yes
|
|
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('18','>=')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11','>=')) %}
|
|
ReadWritePaths=-/var/run/fail2ban
|
|
ReadWritePaths=-/var/lib/fail2ban
|
|
ReadWritePaths=-/var/log/fail2ban.log
|
|
{% else %}
|
|
{# Older systemd versions don't have ReadWritePaths #}
|
|
ReadWriteDirectories=-/var/run/fail2ban
|
|
ReadWriteDirectories=-/var/lib/fail2ban
|
|
ReadWriteDirectories=-/var/log
|
|
{% endif %}
|
|
CapabilityBoundingSet=CAP_AUDIT_READ CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW
|