Initial version of fail2ban-webui

Web interface to view, ban and unban fail2ban IPs on several hosts via
SSH, generalised from the private f2b-web tool.

- Web UI (Flask/Waitress): hosts.yaml, local/OIDC/proxy authentication,
  English/German UI, origin map, optional Loki/Grafana/GeoIP, CLI helpers
- Agent f2b-webctl with install.sh/uninstall.sh (dedicated user + sudo,
  from= restriction, protected networks, manual jail)
- Hardened Docker image, examples, documentation, smoke test, testbed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dev/testbed/agent/Dockerfile

@@ -0,0 +1,36 @@
+# syntax=docker/dockerfile:1
+# Test host: sshd + fail2ban (dummy actions, no firewall changes).
+# The agent is installed at start with agent/install.sh – exactly like on a real host.
+# Build context: repository root (see ../docker-compose.yaml)
+FROM debian:trixie-slim
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends openssh-server openssh-client fail2ban python3 sudo iproute2 \
+ && rm -rf /var/lib/apt/lists/* /etc/fail2ban/jail.d/* /etc/ssh/ssh_host_* \
+ && mkdir -p /run/sshd && touch /var/log/empty.log
+
+COPY <<'JAIL' /etc/fail2ban/jail.local
+[DEFAULT]
+banaction = dummy
+banaction_allports = dummy
+backend = polling
+
+[sshd]
+enabled = true
+logpath = /var/log/empty.log
+JAIL
+
+COPY agent/ /opt/fail2ban-webui-agent/
+
+COPY <<'ENTRY' /entrypoint.sh
+#!/bin/sh
+set -e
+ssh-keygen -A >/dev/null
+until [ -s /keys/ssh/id_ed25519.pub ]; do echo "waiting for /keys/ssh/id_ed25519.pub"; sleep 2; done
+fail2ban-client -x start >/dev/null
+# INSTALL_ARGS: options for install.sh, set per agent in docker-compose.yaml
+bash /opt/fail2ban-webui-agent/install.sh --yes --key-file /keys/ssh/id_ed25519.pub $INSTALL_ARGS
+for ip in $SAMPLE_BANS; do fail2ban-client set sshd banip "$ip" >/dev/null; done
+exec /usr/sbin/sshd -D -e
+ENTRY
+RUN chmod 0755 /entrypoint.sh
+ENTRYPOINT ["/entrypoint.sh"]

dev/testbed/docker-compose.yaml

@@ -0,0 +1,64 @@
+# Local testbed: web UI + two fail2ban hosts (dummy actions, nothing is really blocked).
+# The agents are set up with agent/install.sh at start:
+#   agent1  user f2bweb + sudo, key only accepted from the testbed network
+#   agent2  user root, key in authorized_keys2 (like hosts managed by Keywarden)
+#
+#   docker compose build
+#   docker compose run --rm -it webui hash-password >> .env   (test password of your choice)
+#   docker compose run --rm webui keygen
+#   docker compose run --rm -T --entrypoint sh webui -c 'cat > /data/hosts.yaml' < hosts.yaml
+#   docker compose up -d agent1 agent2
+#   docker compose run --rm webui keyscan --yes
+#   docker compose up -d webui        -> http://127.0.0.1:18080 (login: see .env)
+#   docker compose down -v            -> remove everything
+#
+# hosts.yaml lives in the data volume: Docker Desktop cannot bind-mount network drives.
+name: f2bwebui-testbed
+
+services:
+  webui:
+    build: { context: ../.., dockerfile: docker/Dockerfile, args: { VERSION: testbed } }
+    image: fail2ban-webui:testbed
+    env_file: .env
+    environment:
+      CONFIG_FILE: /data/hosts.yaml
+    read_only: true
+    tmpfs: [/tmp]
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
+    volumes:
+      - webui-data:/data
+    ports:
+      - "127.0.0.1:18080:8080"
+    networks: [testbed]
+
+  agent1:
+    build: { context: ../.., dockerfile: dev/testbed/agent/Dockerfile }
+    image: f2bwebui-testbed-agent
+    hostname: agent1
+    environment:
+      INSTALL_ARGS: "--from 172.31.231.0/24 --protect 203.0.113.250"
+      SAMPLE_BANS: "203.0.113.7 198.51.100.23 2001:db8::42"
+    volumes:
+      - webui-data:/keys:ro
+    networks: [testbed]
+
+  agent2:
+    image: f2bwebui-testbed-agent
+    hostname: agent2
+    environment:
+      INSTALL_ARGS: "--user root --authorized-keys-file /root/.ssh/authorized_keys2 --manual-jail blocklist"
+      SAMPLE_BANS: "8.8.4.4 1.1.1.1"
+    volumes:
+      - webui-data:/keys:ro
+    networks: [testbed]
+
+volumes:
+  webui-data:
+
+networks:
+  testbed:
+    name: f2bwebui-testbed.dockernetwork.local
+    ipam:
+      config:
+        - subnet: 172.31.231.0/24

dev/testbed/hosts.yaml

@@ -0,0 +1,6 @@
+hosts:
+  - name: agent1
+    address: agent1
+  - name: agent2
+    address: agent2
+    user: root