# Local testbed: web UI + two fail2ban hosts (dummy actions, nothing is really blocked).
# The agents are set up with agent/install.sh at start:
#   agent1  user f2bweb + sudo, key only accepted from the testbed network
#   agent2  user root, key in authorized_keys2 (like hosts managed by Keywarden)
#
#   docker compose build
#   docker compose run --rm -it webui hash-password >> .env   (test password of your choice)
#   docker compose run --rm webui keygen
#   docker compose run --rm -T --entrypoint sh webui -c 'cat > /data/hosts.yaml' < hosts.yaml
#   docker compose up -d agent1 agent2
#   docker compose run --rm webui keyscan --yes
#   docker compose up -d webui        -> http://127.0.0.1:18080 (login: see .env)
#   docker compose down -v            -> remove everything
#
# hosts.yaml lives in the data volume: Docker Desktop cannot bind-mount network drives.
name: f2bwebui-testbed

services:
  webui:
    build: { context: ../.., dockerfile: docker/Dockerfile, args: { VERSION: testbed } }
    image: fail2ban-webui:testbed
    env_file: .env
    environment:
      CONFIG_FILE: /data/hosts.yaml
    read_only: true
    tmpfs: [/tmp]
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    volumes:
      - webui-data:/data
    ports:
      - "127.0.0.1:18080:8080"
    networks: [testbed]

  agent1:
    build: { context: ../.., dockerfile: dev/testbed/agent/Dockerfile }
    image: f2bwebui-testbed-agent
    hostname: agent1
    environment:
      INSTALL_ARGS: "--from 172.31.231.0/24 --protect 203.0.113.250"
      SAMPLE_BANS: "203.0.113.7 198.51.100.23 2001:db8::42"
    volumes:
      - webui-data:/keys:ro
    networks: [testbed]

  agent2:
    image: f2bwebui-testbed-agent
    hostname: agent2
    environment:
      INSTALL_ARGS: "--user root --authorized-keys-file /root/.ssh/authorized_keys2 --manual-jail blocklist"
      SAMPLE_BANS: "8.8.4.4 1.1.1.1"
    volumes:
      - webui-data:/keys:ro
    networks: [testbed]

volumes:
  webui-data:

networks:
  testbed:
    name: f2bwebui-testbed.dockernetwork.local
    ipam:
      config:
        - subnet: 172.31.231.0/24