Docs: tested single-host install, NPM integration, installer --docker

- README: step-by-step installation of web UI and agent on one host,
  exactly as tested (agent after keygen, all "run" helpers before
  "up -d", http PUBLIC_URL and TRUSTED_PROXY_HOPS=0 without a proxy)
- README: attach to an existing Nginx Proxy Manager in Docker – shared
  network via docker-compose.override.yaml, no published port,
  gw_priority so SSH to the agent keeps the source address of the own
  network (otherwise from= rejects it), TLS settings, test
- install.sh --docker: the new manual jail bans in INPUT and DOCKER-USER
- Running container: helpers via "docker compose exec … python -m webui"
  (run fails with "Address already in use"); troubleshooting entries

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

agent/install.sh

@@ -29,6 +29,7 @@ FROM=""
 AK_FILE=""
 MANUAL_JAIL=manual-block
 BANACTION=""
+DOCKER_CHAIN=0
 PROTECT=""
 INSTALL_JAIL=1
 FORCE_CONFIG=0
@@ -56,6 +57,9 @@ Options:
   --manual-jail NAME           jail for manual bans (default: manual-block)
   --banaction ACTION           banaction for a newly created manual jail
                                (default: the banaction of your jail.local)
+  --docker                     Docker host: the new manual jail bans in INPUT and in
+                               DOCKER-USER, so published container ports (e.g. a
+                               Nginx Proxy Manager) are blocked as well (iptables)
   --protect NETWORKS           additional addresses that must never be banned
                                (comma separated, e.g. your home IP)
   --no-jail                    do not create the manual jail
@@ -81,6 +85,7 @@ while [ $# -gt 0 ]; do
     --authorized-keys-file) need "$@"; AK_FILE="$2"; shift 2 ;;
     --manual-jail)          need "$@"; MANUAL_JAIL="$2"; shift 2 ;;
     --banaction)            need "$@"; BANACTION="$2"; shift 2 ;;
+    --docker)               DOCKER_CHAIN=1; shift ;;
     --protect)              need "$@"; PROTECT="$2"; shift 2 ;;
     --no-jail)              INSTALL_JAIL=0; shift ;;
     --force-config)         FORCE_CONFIG=1; shift ;;
@@ -108,6 +113,8 @@ SSHD=$(command -v sshd || echo /usr/sbin/sshd)
 [ -z "$FROM" ] || [[ "$FROM" =~ ^[0-9A-Fa-f.:/,*?!]+$ ]] || die "invalid --from: $FROM"
 [ -z "$PROTECT" ] || [[ "$PROTECT" =~ ^[0-9A-Fa-f.:/,]+$ ]] || die "invalid --protect: $PROTECT"
 [ -z "$BANACTION" ] || [[ "$BANACTION" != *$'\n'* ]] || die "invalid --banaction"
+[ -z "$BANACTION" ] || [ $DOCKER_CHAIN -eq 0 ] || die "--banaction and --docker cannot be combined"
+[ $DOCKER_CHAIN -eq 0 ] || command -v iptables >/dev/null || die "--docker needs iptables (installed together with Docker)"
 
 if [ -n "$KEY_FILE" ]; then
   [ -r "$KEY_FILE" ] || die "cannot read $KEY_FILE"
@@ -166,6 +173,7 @@ fail2ban-webui agent $AGENT_VERSION  –  fail2ban $F2B_VERSION  –  $(hostname
   key            $KEY_FP
   allowed from   ${FROM:-ANY ADDRESS (consider --from)}
   manual jail    $MANUAL_JAIL $( [ $JAIL_EXISTS -eq 1 ] && echo "(exists, kept)" || { [ $INSTALL_JAIL -eq 1 ] && echo "(will be created)" || echo "(MISSING – bans will fail)"; } )
+  ban chains     $( [ $DOCKER_CHAIN -eq 1 ] && echo "INPUT + DOCKER-USER (--docker)" || echo "from the banaction in jail.local" )
   backups        $BACKUP_DIR
 EOF
 echo
@@ -282,6 +290,11 @@ EOF
     echo "maxretry = 1"
     echo "bantime  = -1"
     [ -z "$BANACTION" ] || echo "banaction = $BANACTION"
+    if [ $DOCKER_CHAIN -eq 1 ]; then
+      # published Docker ports bypass INPUT and pass DOCKER-USER instead
+      echo "action   = iptables-allports[name=$MANUAL_JAIL]"
+      echo "           iptables-allports[name=$MANUAL_JAIL-docker, chain=DOCKER-USER]"
+    fi
   } > "/etc/fail2ban/jail.d/$MANUAL_JAIL.local"
   fail2ban-client reload >/dev/null || die "fail2ban reload failed – check: fail2ban-client -t"
   fail2ban-client status "$MANUAL_JAIL" >/dev/null 2>&1 || die "jail $MANUAL_JAIL did not start – check the fail2ban log"