# Changelog

All notable changes are listed here. Versions follow [Semantic Versioning](https://semver.org).

## [Unreleased] – 1.0.0

First public version, generalised from a private single-site tool.

### Web UI
- Hosts in `config/hosts.yaml` (name, address, port, user); `F2B_HOSTS` still accepted
- Authentication: local user (scrypt hash, lockout after failed logins), OpenID Connect,
  reverse-proxy mode with optional source-IP check and user header
- English and German UI with a language dropdown; new languages via `locales/xx.json`
- Optional Loki history, Grafana links and GeoIP (DB-IP Lite auto-download)
- Origin map: banned IPs as points on a world map (bundled, no external tiles); click filters the list
- CLI: `hash-password`, `keygen`, `keyscan`, `check` (`docker compose exec … python -m webui …` while running)
- GeoIP download sends its own user agent (db-ip.com rejects Python's default with 403)
- Hardened image: non-root, read-only root filesystem, no pip/setuptools at runtime,
  SSH client ignores the system ssh_config and never uses GSSAPI
- Log lines (`LOGIN_FAILED user=… ip=…`) are safe for fail2ban: user-controlled values
  are sanitised, so no extra log lines can be injected

### Agent
- `f2b-webctl` reads `/etc/f2b-webctl.conf`; private, own and configured addresses are never banned
- Error codes for translated messages, `version` command, fallback for fail2ban without `--with-time`
- `install.sh` / `uninstall.sh`: dedicated user with sudo rule (or root), `from=` restriction,
  custom authorized_keys file, optional manual jail, backups, dry run, self test
- `install.sh --docker`: manual jail bans in INPUT and DOCKER-USER (published Docker ports)