anchor.diff:            ''
               fail2ban-client reload
             '';
  -        
  -        respawn = false;
         };
  -  
  +
  +    # Add some reasonable default jails.  The special "DEFAULT" jail
  +    # sets default values for all other jails.
  +    services.fail2ban.jails.DEFAULT =
  +      ''
  +        ignoreip = 127.0.0.1/8
  +        bantime  = 600
  +        findtime = 600
  +        maxretry = 3
  +        backend  = auto
  +      '';
  +
  +    # Block SSH if there are too many failing connection attempts.
  +    services.fail2ban.jails."ssh-iptables" =
  +      ''
  +        filter   = sshd
  +        action   = iptables[name=SSH, port=ssh, protocol=tcp]
  +        logpath  = /var/log/warn
  +        maxretry = 5
  +      '';
  +    
     };
   
   }
  
positive.code: 
  let
  
    fail2banConf = pkgs.writeText "fail2ban.conf"
      ''
        [Definition]
        loglevel  = 3
        logtarget = SYSLOG
        socket    = /var/run/fail2ban/fail2ban.sock
      '';
  
    jailConf = pkgs.writeText "jail.conf"
      ''
        [DEFAULT]
        bantime  = 120
        findtime = 120
        maxretry = 3
        backend  = auto
      
        [ssh-iptables]
        enabled  = true
        filter   = sshd
        action   = iptables[name=SSH, port=ssh, protocol=tcp]
        logpath  = /var/log/warn
        maxretry = 5
      '';
  
  in
      
  {
  
    ###### interface
  
    options = {
  
    };
  
  
negative.code:         
          preStart =
            ''
              # FIXME: this won't detect changes to
              # /etc/fail2ban/{filter.d,action.d}.
              # ${fail2banConf} ${jailConf}
              mkdir -p /var/run/fail2ban -m 0755
            '';
  