Docs: translate README and guides to German
README and all guides under docs/ are now in German, with German anchors for the cross references. Code and configuration blocks are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
schiwagoaandClaude Opus 5.5 committed
1 parent
2e3f79236c
commit
019c74a418
8 files changed
+469
-463
No files matched your search
+57
-54
@@ -1,43 +1,43 @@
|
||||
# Installation – web UI
|
||||
# Installation – Weboberfläche
|
||||
|
||||
This guide sets up the web UI on a Docker host, step by step. The agents on your
|
||||
fail2ban hosts are covered in [agent.md](agent.md); you need both.
|
||||
Diese Anleitung richtet die Weboberfläche Schritt für Schritt auf einem Docker-Host ein.
|
||||
Die Agenten auf den fail2ban-Hosts sind in [agent.md](agent.md) beschrieben; du brauchst beides.
|
||||
|
||||
- Source: <https://git.retronerd.at/schiwagoa/fail2ban-webui>
|
||||
- Quelle: <https://git.retronerd.at/schiwagoa/fail2ban-webui>
|
||||
- Image: `git.retronerd.at/schiwagoa/fail2ban-webui` (`amd64`, `arm64`)
|
||||
- Tags: `1.0.0` (exact), `1` (latest 1.x), `latest`
|
||||
- Tags: `1.0.0` (genau diese Version), `1` (neueste 1.x), `latest`
|
||||
|
||||
## 1. Prerequisites
|
||||
## 1. Voraussetzungen
|
||||
|
||||
- Docker Engine with Compose v2 (`docker compose version`)
|
||||
- Outgoing SSH (TCP 22 or your port) from the Docker host to every fail2ban host
|
||||
- A DNS name and a reverse proxy with TLS for the UI (see [reverse-proxy.md](reverse-proxy.md))
|
||||
- Docker Engine mit Compose v2 (`docker compose version`)
|
||||
- Ausgehendes SSH (TCP 22 oder dein Port) vom Docker-Host zu jedem fail2ban-Host
|
||||
- Ein DNS-Name und ein Reverse Proxy mit TLS für die Oberfläche (siehe [reverse-proxy.md](reverse-proxy.md))
|
||||
|
||||
Check that the subnet used in the example (`172.23.51.0/24`) is free:
|
||||
Prüfen, ob das Subnetz aus dem Beispiel (`172.23.51.0/24`) frei ist:
|
||||
|
||||
```bash
|
||||
docker network inspect $(docker network ls -q) --format '{{.Name}} {{range .IPAM.Config}}{{.Subnet}}{{end}}' | grep 172.23.51 \
|
||||
|| echo "172.23.51.0/24 is free"
|
||||
```
|
||||
|
||||
If it is taken, pick another `/24` and change it in step 3.
|
||||
Ist es belegt, ein anderes `/24` wählen und in Schritt 3 anpassen.
|
||||
|
||||
## 2. Directories
|
||||
## 2. Verzeichnisse
|
||||
|
||||
```bash
|
||||
mkdir -p /opt/fail2ban-webui/config /opt/fail2ban-webui/data
|
||||
cd /opt/fail2ban-webui
|
||||
# the container runs as UID 10050 and needs to write to data/
|
||||
# der Container läuft als UID 10050 und muss in data/ schreiben
|
||||
chown -R 10050:10050 data
|
||||
chmod 700 data
|
||||
```
|
||||
|
||||
| Path | Content |
|
||||
| Pfad | Inhalt |
|
||||
|---|---|
|
||||
| `docker-compose.yaml` | the service |
|
||||
| `.env` | settings and secrets (password hash, OIDC secret) |
|
||||
| `config/hosts.yaml` | the fail2ban hosts (mounted read-only) |
|
||||
| `data/` | SSH key, `known_hosts`, session secret, audit log, GeoIP database |
|
||||
| `docker-compose.yaml` | der Dienst |
|
||||
| `.env` | Einstellungen und Geheimnisse (Passwort-Hash, OIDC-Secret) |
|
||||
| `config/hosts.yaml` | die fail2ban-Hosts (schreibgeschützt eingebunden) |
|
||||
| `data/` | SSH-Schlüssel, `known_hosts`, Sitzungsschlüssel, Protokoll, GeoIP-Datenbank |
|
||||
|
||||
## 3. docker-compose.yaml
|
||||
|
||||
@@ -102,13 +102,13 @@ networks:
|
||||
ip_range: 172.23.51.128/25
|
||||
```
|
||||
|
||||
If the reverse proxy runs on another machine, bind the port to the LAN address instead,
|
||||
e.g. `"192.168.1.10:8080:8080"` – never to `0.0.0.0` without a firewall in front.
|
||||
Läuft der Reverse Proxy auf einer anderen Maschine, den Port stattdessen an die LAN-Adresse
|
||||
binden, z. B. `"192.168.1.10:8080:8080"` – niemals ohne Firewall davor an `0.0.0.0`.
|
||||
|
||||
## 4. .env
|
||||
|
||||
Start with this minimal file; every option is described in
|
||||
[configuration.md](configuration.md) and in [`examples/.env.example`](../examples/.env.example).
|
||||
Mit dieser minimalen Datei beginnen; alle Optionen stehen in
|
||||
[configuration.md](configuration.md) und in [`examples/.env.example`](../examples/.env.example).
|
||||
|
||||
```bash
|
||||
nano .env
|
||||
@@ -129,35 +129,38 @@ MANUAL_JAIL=manual-block
|
||||
GEOIP_AUTO_DOWNLOAD=1
|
||||
```
|
||||
|
||||
### Password hash
|
||||
`DEFAULT_LANG=de` stellt die Oberfläche standardmäßig auf Deutsch; jeder Benutzer kann die
|
||||
Sprache zusätzlich im Dropdown wählen.
|
||||
|
||||
### Passwort-Hash
|
||||
|
||||
```bash
|
||||
docker compose run --rm -it fail2ban-webui hash-password
|
||||
```
|
||||
|
||||
Copy the printed line (`AUTH_PASSWORD_HASH='scrypt:…'`) into `.env` and replace the
|
||||
placeholder. **Keep the single quotes** – the hash contains `$` signs that Docker Compose
|
||||
would otherwise try to expand. For single sign-on instead see
|
||||
[authentication.md](authentication.md).
|
||||
Die ausgegebene Zeile (`AUTH_PASSWORD_HASH='scrypt:…'`) in die `.env` kopieren und den
|
||||
Platzhalter ersetzen. **Die einfachen Anführungszeichen beibehalten** – der Hash enthält
|
||||
`$`-Zeichen, die Docker Compose sonst als Variablen auswerten würde. Für Single Sign-on
|
||||
stattdessen siehe [authentication.md](authentication.md).
|
||||
|
||||
## 5. SSH key
|
||||
## 5. SSH-Schlüssel
|
||||
|
||||
```bash
|
||||
docker compose run --rm fail2ban-webui keygen
|
||||
```
|
||||
|
||||
The command creates `data/ssh/id_ed25519` and prints the public key
|
||||
(`ssh-ed25519 AAAA… fail2ban-webui`). Copy it – you need it for the agent installer.
|
||||
Der Befehl erzeugt `data/ssh/id_ed25519` und gibt den öffentlichen Schlüssel aus
|
||||
(`ssh-ed25519 AAAA… fail2ban-webui`). Kopieren – er wird für den Agent-Installer gebraucht.
|
||||
|
||||
## 6. Agents
|
||||
## 6. Agenten
|
||||
|
||||
Install the agent on every fail2ban host as described in [agent.md](agent.md). In short:
|
||||
Den Agenten auf jedem fail2ban-Host installieren, wie in [agent.md](agent.md) beschrieben. Kurzfassung:
|
||||
|
||||
```bash
|
||||
# on each fail2ban host, as root
|
||||
# auf jedem fail2ban-Host, als root
|
||||
git clone https://git.retronerd.at/schiwagoa/fail2ban-webui.git /tmp/fail2ban-webui
|
||||
echo 'ssh-ed25519 AAAA… fail2ban-webui' > /tmp/webui.pub
|
||||
bash /tmp/fail2ban-webui/agent/install.sh --key-file /tmp/webui.pub --from <public IP of the web UI host>
|
||||
bash /tmp/fail2ban-webui/agent/install.sh --key-file /tmp/webui.pub --from <öffentliche IP des Webui-Hosts>
|
||||
```
|
||||
|
||||
## 7. config/hosts.yaml
|
||||
@@ -180,24 +183,24 @@ hosts:
|
||||
address: host.docker.internal
|
||||
```
|
||||
|
||||
`user` defaults to `SSH_USER` (`f2bweb`). Set `user: root` for hosts where the agent was
|
||||
installed with `--user root`.
|
||||
`user` ist standardmäßig `SSH_USER` (`f2bweb`). Für Hosts, auf denen der Agent mit
|
||||
`--user root` installiert wurde, `user: root` setzen.
|
||||
|
||||
## 8. Host keys and connection test
|
||||
## 8. Host-Schlüssel und Verbindungstest
|
||||
|
||||
```bash
|
||||
docker compose run --rm -it fail2ban-webui keyscan
|
||||
```
|
||||
|
||||
`keyscan` shows the fingerprint of every host and asks before writing
|
||||
`data/ssh/known_hosts`. Compare the fingerprints with the hosts:
|
||||
`keyscan` zeigt den Fingerprint jedes Hosts und fragt vor dem Schreiben von
|
||||
`data/ssh/known_hosts` nach. Die Fingerprints mit den Hosts vergleichen:
|
||||
|
||||
```bash
|
||||
# on the fail2ban host
|
||||
# auf dem fail2ban-Host
|
||||
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
|
||||
```
|
||||
|
||||
Then test every agent:
|
||||
Danach jeden Agenten testen:
|
||||
|
||||
```bash
|
||||
docker compose run --rm fail2ban-webui check
|
||||
@@ -209,33 +212,33 @@ OK lxc-proxy agent 1.0.0, 2 jails, 0 bans
|
||||
OK dockerhost agent 1.0.0, 4 jails, 7 bans
|
||||
```
|
||||
|
||||
Every host must show `OK` – see [operations.md](operations.md#troubleshooting) otherwise.
|
||||
Jeder Host muss `OK` melden – sonst siehe [operations.md](operations.md#fehlersuche).
|
||||
|
||||
## 9. Start
|
||||
## 9. Starten
|
||||
|
||||
```bash
|
||||
docker compose up -d
|
||||
docker compose ps # STATUS: Up … (healthy)
|
||||
docker compose logs -f fail2ban-webui # Ctrl+C to leave
|
||||
docker compose logs -f fail2ban-webui # mit Strg+C verlassen
|
||||
```
|
||||
|
||||
The log shows a summary like
|
||||
Das Log zeigt eine Zusammenfassung wie
|
||||
`fail2ban-webui 1.0.0 – hosts: web01, lxc-proxy, dockerhost – auth: local – loki: off – geoip: on`.
|
||||
|
||||
Local test without the proxy:
|
||||
Lokaler Test ohne Proxy:
|
||||
|
||||
```bash
|
||||
curl -s http://127.0.0.1:8080/healthz # ok
|
||||
```
|
||||
|
||||
## 10. Reverse proxy
|
||||
## 10. Reverse Proxy
|
||||
|
||||
Publish `http://127.0.0.1:8080` (or the LAN address from step 3) under your DNS name with
|
||||
TLS – examples for Nginx Proxy Manager, Caddy, Traefik and nginx are in
|
||||
[reverse-proxy.md](reverse-proxy.md). Then open `PUBLIC_URL` and sign in.
|
||||
`http://127.0.0.1:8080` (oder die LAN-Adresse aus Schritt 3) unter deinem DNS-Namen mit
|
||||
TLS veröffentlichen – Beispiele für Nginx Proxy Manager, Caddy, Traefik und nginx stehen in
|
||||
[reverse-proxy.md](reverse-proxy.md). Dann `PUBLIC_URL` öffnen und anmelden.
|
||||
|
||||
## Next steps
|
||||
## Nächste Schritte
|
||||
|
||||
- [Protect the login with fail2ban](operations.md#protecting-the-login-with-fail2ban)
|
||||
- [Updates and backups](operations.md)
|
||||
- Optional: [Loki history and Grafana links](configuration.md#loki-and-grafana)
|
||||
- [Login mit fail2ban absichern](operations.md#login-mit-fail2ban-absichern)
|
||||
- [Updates und Backups](operations.md)
|
||||
- Optional: [Loki-Verlauf und Grafana-Links](configuration.md#loki-und-grafana)
|
||||
Reference in new issue
Block a user