sshguard is now optional

modules/services/default.nix

@@ -16,6 +16,7 @@
     ./nsd-acme
     ./postfix
     ./snmp_exporter
+    ./sshguard
     ./syncthing
     ./zfsunlock
   ];

modules/services/sshguard/default.nix

@@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  myData,
+  ...
+}: {
+  options.mj.services.sshguard = with lib.types; {
+    enable = lib.mkOption {
+      type = bool;
+      default = false;
+    };
+  };
+
+  config = lib.mkIf config.mj.services.sshguard.enable {
+    services.sshguard = {
+      enable = true;
+      blocktime = 900;
+      whitelist =
+        ["192.168.0.0/16" myData.subnets.tailscale.cidr]
+        ++ (lib.catAttrs "publicIP" (lib.attrValues myData.hosts));
+    };
+  };
+}