{ lib, config, ... }:
{
  services.fail2ban = {
    enable = false;

    ignoreIP = [
      "10.0.0.0/8"
      "172.16.0.0/12"
      "192.168.0.0/16"
    ];

    jails.sshd.settings = {
      enabled = true;
      filter = "sshd[mode=aggressive]";
      port = lib.strings.concatStringsSep "," (map toString config.services.openssh.ports);
    };
  };
}