# =====================================================================
# fail2ban-webui – settings (copy to .env next to docker-compose.yaml)
# Only the block "Authentication" is required, everything else is optional.
# =====================================================================

# ---------------------------------------------------------------------
# General
# ---------------------------------------------------------------------
# External address of the UI (needed for OIDC; also turns on Secure cookies for https)
PUBLIC_URL=https://fail2ban.example.org
# Language when the user has not chosen one in the dropdown (en, de, …)
DEFAULT_LANG=en
# Number of reverse proxies in front of the container whose X-Forwarded-For/-Proto
# headers are trusted (0 = none). Behind one proxy (NPM, Traefik, Caddy): 1
TRUSTED_PROXY_HOPS=1
# Session lifetime in hours
SESSION_HOURS=12

# ---------------------------------------------------------------------
# Authentication – AUTH_MODE: local | oidc | local,oidc | proxy
# ---------------------------------------------------------------------
AUTH_MODE=local

# local: create the hash with
#   docker compose run --rm -it fail2ban-webui hash-password
# and paste the printed line (keep the single quotes!)
AUTH_USER=admin
AUTH_PASSWORD_HASH='scrypt:...'
# Lock a client IP after this many failed logins for LOGIN_LOCK_MINUTES
LOGIN_MAX_ATTEMPTS=5
LOGIN_LOCK_MINUTES=15

# oidc: e.g. Authentik – Redirect URI in the provider: ${PUBLIC_URL}/auth/callback
#OIDC_ISSUER=https://auth.example.org/application/o/fail2ban-webui/
#OIDC_CLIENT_ID=
#OIDC_CLIENT_SECRET=
#OIDC_SCOPES=openid email profile
#OIDC_USERNAME_CLAIM=preferred_username
#OIDC_GROUPS_CLAIM=groups
# Strongly recommended: only these groups / users may sign in (comma separated)
#OIDC_ALLOWED_GROUPS=fail2ban-admins
#OIDC_ALLOWED_USERS=
#OIDC_BUTTON_LABEL=Authentik

# proxy: the reverse proxy does the login (forward auth, basic auth, IP list).
# Only requests from these addresses are accepted (address of the proxy):
#AUTH_PROXY_ALLOWED_IPS=172.23.51.1/32
# Header with the user name set by the proxy, e.g. X-authentik-username or Remote-User
#AUTH_PROXY_HEADER=
#AUTH_PROXY_LOGOUT_URL=

# ---------------------------------------------------------------------
# Agents (SSH)
# ---------------------------------------------------------------------
# Default SSH user on the hosts (can be overridden per host in hosts.yaml)
SSH_USER=f2bweb
SSH_TIMEOUT=40
# Seconds the ban list is cached
CACHE_SECONDS=15
# Jail used by the agent for manual bans (only shown in the UI)
MANUAL_JAIL=manual-block

# ---------------------------------------------------------------------
# GeoIP (optional) – country/city per IP
# ---------------------------------------------------------------------
# 1 = download the free DB-IP Lite database (CC BY 4.0) monthly into /data/geoip
GEOIP_AUTO_DOWNLOAD=1
# or mount your own .mmdb (DB-IP or MaxMind GeoLite2 City) and point to it:
#GEOIP_DB=/data/geoip/dbip-city-lite.mmdb

# ---------------------------------------------------------------------
# Loki / Grafana (optional) – "History" button and Grafana links
# ---------------------------------------------------------------------
#LOKI_URL=http://loki:3100
#LOKI_SELECTOR={job=~"fail2ban|sshd|nginx"}
#LOKI_DAYS=7
#LOKI_USER=
#LOKI_PASSWORD=
#LOKI_TENANT=
#GRAFANA_URL=https://grafana.example.org
#GRAFANA_DASHBOARD=/d/my-security-dashboard
#GRAFANA_LOKI_UID=loki