Initial version: npm-scanner image, filters, entrypoint, watcher, testbed

- Image based on crazymax/fail2ban:1.1.1 with inotify-tools
- Filters npm-scanner and npm-wplogin, tested with fail2ban-regex in the build
- jail.local generated from .env, optional npm-wplogin and recidive
- Watcher reloads the jails when NPM creates a new proxy host log
- check command, docs, testbed for LXC

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,42 @@
+# npm-scanner – copy to .env and adjust
+#   cp .env.example .env && nano .env
+
+# Image tag in the registry
+NPM_SCANNER_VERSION=latest
+TZ=Europe/Vienna
+F2B_LOG_LEVEL=INFO
+
+# Log directories of NPM on the host
+#   jc21/nginx-proxy-manager:    <source of /data>/logs
+#   jlesage/nginx-proxy-manager: <source of /config>/log  and  .../logs
+# With only one directory, leave NPM_LOG_DIR2 empty or remove it.
+NPM_LOG_DIR=/home/docker-projekte/nginx/data/log
+NPM_LOG_DIR2=/home/docker-projekte/nginx/data/logs
+
+# Never ban (space separated): own public IP, LAN, VPN, monitoring
+WHITELIST=203.0.113.10 192.168.1.0/24
+
+# Firewall chain on the host (DOCKER-USER for NPM in Docker)
+F2B_CHAIN=DOCKER-USER
+
+# npm-scanner: 3 hits in 1 h -> 24 h, increasing up to 4 weeks
+SCANNER_MAXRETRY=3
+SCANNER_FINDTIME=1h
+SCANNER_BANTIME=24h
+SCANNER_MAXTIME=4w
+
+# npm-wplogin: WordPress login brute force
+ENABLE_WPLOGIN=false
+WPLOGIN_MAXRETRY=5
+WPLOGIN_FINDTIME=10m
+WPLOGIN_BANTIME=24h
+WPLOGIN_MAXTIME=4w
+
+# recidive: 3 bans in 1 week -> 4 weeks (INPUT + F2B_CHAIN)
+ENABLE_RECIDIVE=false
+RECIDIVE_MAXRETRY=3
+RECIDIVE_FINDTIME=1w
+RECIDIVE_BANTIME=4w
+
+# Watch new NPM proxy hosts automatically
+ENABLE_NEWLOG_WATCH=true