depot/modules/fail2ban/default.nix

{
  services.fail2ban = {
    enable = true;
    jails.sshd = ''
      enabled = true
      port = 22
      mode = aggressive
    '';
  };
}