schiwagoaandClaude Opus 5.5
2e3f79236c
Web interface to view, ban and unban fail2ban IPs on several hosts via SSH, generalised from the private f2b-web tool. - Web UI (Flask/Waitress): hosts.yaml, local/OIDC/proxy authentication, English/German UI, origin map, optional Loki/Grafana/GeoIP, CLI helpers - Agent f2b-webctl with install.sh/uninstall.sh (dedicated user + sudo, from= restriction, protected networks, manual jail) - Hardened Docker image, examples, documentation, smoke test, testbed Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
65 lines
2.1 KiB
YAML
65 lines
2.1 KiB
YAML
# Local testbed: web UI + two fail2ban hosts (dummy actions, nothing is really blocked).
|
|
# The agents are set up with agent/install.sh at start:
|
|
# agent1 user f2bweb + sudo, key only accepted from the testbed network
|
|
# agent2 user root, key in authorized_keys2 (like hosts managed by Keywarden)
|
|
#
|
|
# docker compose build
|
|
# docker compose run --rm -it webui hash-password >> .env (test password of your choice)
|
|
# docker compose run --rm webui keygen
|
|
# docker compose run --rm -T --entrypoint sh webui -c 'cat > /data/hosts.yaml' < hosts.yaml
|
|
# docker compose up -d agent1 agent2
|
|
# docker compose run --rm webui keyscan --yes
|
|
# docker compose up -d webui -> http://127.0.0.1:18080 (login: see .env)
|
|
# docker compose down -v -> remove everything
|
|
#
|
|
# hosts.yaml lives in the data volume: Docker Desktop cannot bind-mount network drives.
|
|
name: f2bwebui-testbed
|
|
|
|
services:
|
|
webui:
|
|
build: { context: ../.., dockerfile: docker/Dockerfile, args: { VERSION: testbed } }
|
|
image: fail2ban-webui:testbed
|
|
env_file: .env
|
|
environment:
|
|
CONFIG_FILE: /data/hosts.yaml
|
|
read_only: true
|
|
tmpfs: [/tmp]
|
|
cap_drop: [ALL]
|
|
security_opt: [no-new-privileges:true]
|
|
volumes:
|
|
- webui-data:/data
|
|
ports:
|
|
- "127.0.0.1:18080:8080"
|
|
networks: [testbed]
|
|
|
|
agent1:
|
|
build: { context: ../.., dockerfile: dev/testbed/agent/Dockerfile }
|
|
image: f2bwebui-testbed-agent
|
|
hostname: agent1
|
|
environment:
|
|
INSTALL_ARGS: "--from 172.31.231.0/24 --protect 203.0.113.250"
|
|
SAMPLE_BANS: "203.0.113.7 198.51.100.23 2001:db8::42"
|
|
volumes:
|
|
- webui-data:/keys:ro
|
|
networks: [testbed]
|
|
|
|
agent2:
|
|
image: f2bwebui-testbed-agent
|
|
hostname: agent2
|
|
environment:
|
|
INSTALL_ARGS: "--user root --authorized-keys-file /root/.ssh/authorized_keys2 --manual-jail blocklist"
|
|
SAMPLE_BANS: "8.8.4.4 1.1.1.1"
|
|
volumes:
|
|
- webui-data:/keys:ro
|
|
networks: [testbed]
|
|
|
|
volumes:
|
|
webui-data:
|
|
|
|
networks:
|
|
testbed:
|
|
name: f2bwebui-testbed.dockernetwork.local
|
|
ipam:
|
|
config:
|
|
- subnet: 172.31.231.0/24
|