schiwagoaandClaude Opus 5.5
b36499bbf5
- README: step-by-step installation of web UI and agent on one host, exactly as tested (agent after keygen, all "run" helpers before "up -d", http PUBLIC_URL and TRUSTED_PROXY_HOPS=0 without a proxy) - README: attach to an existing Nginx Proxy Manager in Docker – shared network via docker-compose.override.yaml, no published port, gw_priority so SSH to the agent keeps the source address of the own network (otherwise from= rejects it), TLS settings, test - install.sh --docker: the new manual jail bans in INPUT and DOCKER-USER - Running container: helpers via "docker compose exec … python -m webui" (run fails with "Address already in use"); troubleshooting entries Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1.7 KiB
1.7 KiB
Changelog
All notable changes are listed here. Versions follow Semantic Versioning.
[Unreleased] – 1.0.0
First public version, generalised from a private single-site tool.
Web UI
- Hosts in
config/hosts.yaml(name, address, port, user);F2B_HOSTSstill accepted - Authentication: local user (scrypt hash, lockout after failed logins), OpenID Connect, reverse-proxy mode with optional source-IP check and user header
- English and German UI with a language dropdown; new languages via
locales/xx.json - Optional Loki history, Grafana links and GeoIP (DB-IP Lite auto-download)
- Origin map: banned IPs as points on a world map (bundled, no external tiles); click filters the list
- CLI:
hash-password,keygen,keyscan,check(docker compose exec … python -m webui …while running) - GeoIP download sends its own user agent (db-ip.com rejects Python's default with 403)
- Hardened image: non-root, read-only root filesystem, no pip/setuptools at runtime, SSH client ignores the system ssh_config and never uses GSSAPI
- Log lines (
LOGIN_FAILED user=… ip=…) are safe for fail2ban: user-controlled values are sanitised, so no extra log lines can be injected
Agent
f2b-webctlreads/etc/f2b-webctl.conf; private, own and configured addresses are never banned- Error codes for translated messages,
versioncommand, fallback for fail2ban without--with-time install.sh/uninstall.sh: dedicated user with sudo rule (or root),from=restriction, custom authorized_keys file, optional manual jail, backups, dry run, self testinstall.sh --docker: manual jail bans in INPUT and DOCKER-USER (published Docker ports)