# fail2ban-webui – web interface for fail2ban on several hosts (Flask + Waitress)
# Build: docker build -f docker/Dockerfile -t fail2ban-webui:dev .
FROM python:3.13.17-slim-trixie

ARG VERSION=dev
LABEL org.opencontainers.image.title="fail2ban-webui" \
      org.opencontainers.image.description="Web interface to view, ban and unban fail2ban IPs on several hosts via SSH" \
      org.opencontainers.image.source="https://git.retronerd.at/schiwagoa/fail2ban-webui" \
      org.opencontainers.image.licenses="MIT" \
      org.opencontainers.image.version="${VERSION}"

# ssh needs a passwd entry for its UID – therefore a fixed user 10050
RUN apt-get update \
 && apt-get install -y --no-install-recommends openssh-client tzdata \
 && rm -rf /var/lib/apt/lists/* \
 && useradd --uid 10050 --user-group --no-create-home --home-dir /tmp --shell /usr/sbin/nologin f2bweb \
 && mkdir -p /data /config \
 && chown 10050:10050 /data

WORKDIR /app
COPY requirements.txt .
# pip, setuptools and the bundled ensurepip wheels are not needed at runtime –
# removing them also removes their (vendored) packages from security scans
RUN pip install --no-cache-dir -r requirements.txt  && pip uninstall -y pip setuptools wheel 2>/dev/null;     rm -rf /usr/local/lib/python3.*/ensurepip /root/.cache

COPY app/ /app/

USER 10050:10050
ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 HOME=/tmp APP_VERSION=${VERSION}
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=3)"
ENTRYPOINT ["python", "-m", "webui"]
CMD ["serve"]