Initial version of fail2ban-webui

Web interface to view, ban and unban fail2ban IPs on several hosts via
SSH, generalised from the private f2b-web tool.

- Web UI (Flask/Waitress): hosts.yaml, local/OIDC/proxy authentication,
  English/German UI, origin map, optional Loki/Grafana/GeoIP, CLI helpers
- Agent f2b-webctl with install.sh/uninstall.sh (dedicated user + sudo,
  from= restriction, protected networks, manual jail)
- Hardened Docker image, examples, documentation, smoke test, testbed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

examples/.env.example

@@ -0,0 +1,82 @@
+# =====================================================================
+# fail2ban-webui – settings (copy to .env next to docker-compose.yaml)
+# Only the block "Authentication" is required, everything else is optional.
+# =====================================================================
+
+# ---------------------------------------------------------------------
+# General
+# ---------------------------------------------------------------------
+# External address of the UI (needed for OIDC; also turns on Secure cookies for https)
+PUBLIC_URL=https://fail2ban.example.org
+# Language when the user has not chosen one in the dropdown (en, de, …)
+DEFAULT_LANG=en
+# Number of reverse proxies in front of the container whose X-Forwarded-For/-Proto
+# headers are trusted (0 = none). Behind one proxy (NPM, Traefik, Caddy): 1
+TRUSTED_PROXY_HOPS=1
+# Session lifetime in hours
+SESSION_HOURS=12
+
+# ---------------------------------------------------------------------
+# Authentication – AUTH_MODE: local | oidc | local,oidc | proxy
+# ---------------------------------------------------------------------
+AUTH_MODE=local
+
+# local: create the hash with
+#   docker compose run --rm -it fail2ban-webui hash-password
+# and paste the printed line (keep the single quotes!)
+AUTH_USER=admin
+AUTH_PASSWORD_HASH='scrypt:...'
+# Lock a client IP after this many failed logins for LOGIN_LOCK_MINUTES
+LOGIN_MAX_ATTEMPTS=5
+LOGIN_LOCK_MINUTES=15
+
+# oidc: e.g. Authentik – Redirect URI in the provider: ${PUBLIC_URL}/auth/callback
+#OIDC_ISSUER=https://auth.example.org/application/o/fail2ban-webui/
+#OIDC_CLIENT_ID=
+#OIDC_CLIENT_SECRET=
+#OIDC_SCOPES=openid email profile
+#OIDC_USERNAME_CLAIM=preferred_username
+#OIDC_GROUPS_CLAIM=groups
+# Strongly recommended: only these groups / users may sign in (comma separated)
+#OIDC_ALLOWED_GROUPS=fail2ban-admins
+#OIDC_ALLOWED_USERS=
+#OIDC_BUTTON_LABEL=Authentik
+
+# proxy: the reverse proxy does the login (forward auth, basic auth, IP list).
+# Only requests from these addresses are accepted (address of the proxy):
+#AUTH_PROXY_ALLOWED_IPS=172.23.51.1/32
+# Header with the user name set by the proxy, e.g. X-authentik-username or Remote-User
+#AUTH_PROXY_HEADER=
+#AUTH_PROXY_LOGOUT_URL=
+
+# ---------------------------------------------------------------------
+# Agents (SSH)
+# ---------------------------------------------------------------------
+# Default SSH user on the hosts (can be overridden per host in hosts.yaml)
+SSH_USER=f2bweb
+SSH_TIMEOUT=40
+# Seconds the ban list is cached
+CACHE_SECONDS=15
+# Jail used by the agent for manual bans (only shown in the UI)
+MANUAL_JAIL=manual-block
+
+# ---------------------------------------------------------------------
+# GeoIP (optional) – country/city per IP
+# ---------------------------------------------------------------------
+# 1 = download the free DB-IP Lite database (CC BY 4.0) monthly into /data/geoip
+GEOIP_AUTO_DOWNLOAD=1
+# or mount your own .mmdb (DB-IP or MaxMind GeoLite2 City) and point to it:
+#GEOIP_DB=/data/geoip/dbip-city-lite.mmdb
+
+# ---------------------------------------------------------------------
+# Loki / Grafana (optional) – "History" button and Grafana links
+# ---------------------------------------------------------------------
+#LOKI_URL=http://loki:3100
+#LOKI_SELECTOR={job=~"fail2ban|sshd|nginx"}
+#LOKI_DAYS=7
+#LOKI_USER=
+#LOKI_PASSWORD=
+#LOKI_TENANT=
+#GRAFANA_URL=https://grafana.example.org
+#GRAFANA_DASHBOARD=/d/my-security-dashboard
+#GRAFANA_LOKI_UID=loki