Initial version of fail2ban-webui

Web interface to view, ban and unban fail2ban IPs on several hosts via
SSH, generalised from the private f2b-web tool.

- Web UI (Flask/Waitress): hosts.yaml, local/OIDC/proxy authentication,
  English/German UI, origin map, optional Loki/Grafana/GeoIP, CLI helpers
- Agent f2b-webctl with install.sh/uninstall.sh (dedicated user + sudo,
  from= restriction, protected networks, manual jail)
- Hardened Docker image, examples, documentation, smoke test, testbed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

SECURITY.md

@@ -0,0 +1,30 @@
+# Security
+
+## Reporting a vulnerability
+
+Please do **not** open a public issue. Send a description and, if possible, steps to
+reproduce to the maintainer via a private message on
+[git.retronerd.at](https://git.retronerd.at/schiwagoa). You will get an answer within a
+few days; fixes are released as soon as possible and mentioned in the changelog.
+
+## Security model
+
+| Part | Trust | Protection |
+|---|---|---|
+| Browser → web UI | untrusted | login (local / OIDC / proxy), CSRF token on every change, Origin check, strict CSP, no caching |
+| Web UI container | holds the SSH key for all agents | non-root (UID 10050), read-only root FS, no capabilities, `no-new-privileges`, bound to 127.0.0.1 by default |
+| Web UI → agent | SSH with a single ed25519 key | host keys pinned (`StrictHostKeyChecking=yes`), key restricted with `restrict`, `from=` and a forced command |
+| Agent (`f2b-webctl`) | runs as root via one sudo rule | fixed command whitelist, strict IP/jail validation, never bans private, own or protected addresses, syslog of every action |
+
+What the web UI **cannot** do on a host: open a shell, forward ports, run other commands,
+change fail2ban configuration, or ban protected addresses.
+
+What an attacker **with access to the web UI** can do: ban and unban public IPs on the
+configured hosts. Protect the UI accordingly (strong password or SSO, reverse proxy with
+TLS, ideally an IP allow list).
+
+Recommendations:
+
+- Always install the agent with `--from <address of the web UI>`.
+- Keep the `data/` directory (SSH key, session secret) readable for UID 10050 only.
+- Rebuild or pull the image regularly – the base image receives Debian security updates.