anchor.diff:          
           preStart =
             ''
  +            # FIXME: this won't detect changes to
  +            # /etc/fail2ban/{filter.d,action.d}.
               # ${fail2banConf} ${jailConf}
               mkdir -p /var/run/fail2ban -m 0755
             '';
  
positive.code: 
  let
  
    fail2banConf = pkgs.writeText "fail2ban.conf"
      ''
        [Definition]
        loglevel  = 3
        logtarget = SYSLOG
        socket    = /var/run/fail2ban/fail2ban.sock
      '';
  
    jailConf = pkgs.writeText "jail.conf"
      ''
        [DEFAULT]
        bantime  = 120
        findtime = 120
        maxretry = 3
        backend  = auto
      
        [ssh-iptables]
        enabled  = true
        filter   = sshd
        action   = iptables[name=SSH, port=ssh, protocol=tcp]
        logpath  = /var/log/warn
        maxretry = 5
      '';
  
  in
      
  {
  
    ###### interface
  
    options = {
  
    };
  
  
negative.code:           ''
              fail2ban-client reload
            '';
        };
  
      # Add some reasonable default jails.  The special "DEFAULT" jail
      # sets default values for all other jails.
      services.fail2ban.jails.DEFAULT =
        ''
          ignoreip = 127.0.0.1/8
          bantime  = 600
          findtime = 600
          maxretry = 3
          backend  = auto
        '';
  
      # Block SSH if there are too many failing connection attempts.
      services.fail2ban.jails."ssh-iptables" =
        ''
          filter   = sshd
          action   = iptables[name=SSH, port=ssh, protocol=tcp]
          logpath  = /var/log/warn
          maxretry = 5
        '';
      
    };
  
  }
  