schiwagoaandClaude Opus 5.5
2e3f79236c
Web interface to view, ban and unban fail2ban IPs on several hosts via SSH, generalised from the private f2b-web tool. - Web UI (Flask/Waitress): hosts.yaml, local/OIDC/proxy authentication, English/German UI, origin map, optional Loki/Grafana/GeoIP, CLI helpers - Agent f2b-webctl with install.sh/uninstall.sh (dedicated user + sudo, from= restriction, protected networks, manual jail) - Hardened Docker image, examples, documentation, smoke test, testbed Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
35 lines
1.6 KiB
Docker
35 lines
1.6 KiB
Docker
# fail2ban-webui – web interface for fail2ban on several hosts (Flask + Waitress)
|
||
# Build: docker build -f docker/Dockerfile -t fail2ban-webui:dev .
|
||
FROM python:3.13.17-slim-trixie
|
||
|
||
ARG VERSION=dev
|
||
LABEL org.opencontainers.image.title="fail2ban-webui" \
|
||
org.opencontainers.image.description="Web interface to view, ban and unban fail2ban IPs on several hosts via SSH" \
|
||
org.opencontainers.image.source="https://git.retronerd.at/schiwagoa/fail2ban-webui" \
|
||
org.opencontainers.image.licenses="MIT" \
|
||
org.opencontainers.image.version="${VERSION}"
|
||
|
||
# ssh needs a passwd entry for its UID – therefore a fixed user 10050
|
||
RUN apt-get update \
|
||
&& apt-get install -y --no-install-recommends openssh-client tzdata \
|
||
&& rm -rf /var/lib/apt/lists/* \
|
||
&& useradd --uid 10050 --user-group --no-create-home --home-dir /tmp --shell /usr/sbin/nologin f2bweb \
|
||
&& mkdir -p /data /config \
|
||
&& chown 10050:10050 /data
|
||
|
||
WORKDIR /app
|
||
COPY requirements.txt .
|
||
# pip, setuptools and the bundled ensurepip wheels are not needed at runtime –
|
||
# removing them also removes their (vendored) packages from security scans
|
||
RUN pip install --no-cache-dir -r requirements.txt && pip uninstall -y pip setuptools wheel 2>/dev/null; rm -rf /usr/local/lib/python3.*/ensurepip /root/.cache
|
||
|
||
COPY app/ /app/
|
||
|
||
USER 10050:10050
|
||
ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 HOME=/tmp APP_VERSION=${VERSION}
|
||
EXPOSE 8080
|
||
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
|
||
CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=3)"
|
||
ENTRYPOINT ["python", "-m", "webui"]
|
||
CMD ["serve"]
|