nixos/fail2ban: use systemd socket activation

This includes some cleanup to remove redundant entries in `serviceConfig`.

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -258,6 +258,8 @@
 
 - `services.gitlab.registry` now uses PostgreSQL as database storage for new installations and supports old installations that use the filesystem as metadata storage. It creates the required PostgreSQL database and user. Users can manually migrate their filesystem based metadata storage. See [GitLab Container Registry Migration to database metadata store](#module-services-gitlab-registry-database-migration).
 
+- `services.fail2ban` now supports systemd socket activation via `fail2ban.socket`
+
 - Enabling [`services.userborn`](#opt-services.userborn.enable) on a system that was previously managed by the default `update-users-groups.pl` script now imports the legacy state from `/var/lib/nixos/` on the first switch. Locked stub entries are added to `/etc/passwd` and `/etc/group` for every name recorded in `uid-map`/`gid-map` that no longer has a live entry, so a previously-used UID/GID cannot be reassigned to a different user. Subordinate id ranges recorded in `auto-subuid-map` are seeded into the subid files as well. If the import fails, userborn does not start and the user database is left untouched. Inspect `journalctl -u userborn-import-legacy.service`, fix or remove the legacy state, and switch again. The import can be skipped entirely with [`services.userborn.importLegacyState`](#opt-services.userborn.importLegacyState)` = false`.
 
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.

nixos/modules/services/security/fail2ban.nix

@@ -400,12 +400,8 @@ in
         # Security
         NoNewPrivileges = true;
         # Directory
-        RuntimeDirectory = "fail2ban";
         RuntimeDirectoryMode = "0750";
-        StateDirectory = "fail2ban";
         StateDirectoryMode = "0750";
-        LogsDirectory = "fail2ban";
-        LogsDirectoryMode = "0750";
         # Sandboxing
         ProtectSystem = "strict";
         ProtectHome = true;
@@ -417,6 +413,10 @@ in
         ProtectControlGroups = true;
       };
     };
+    systemd.sockets.fail2ban.wantedBy = [
+      "sockets.target"
+      "fail2ban.service"
+    ];
 
     # Defaults for the daemon settings
     services.fail2ban.daemonSettings.Definition = {