Initial version: npm-scanner image, filters, entrypoint, watcher, testbed

- Image based on crazymax/fail2ban:1.1.1 with inotify-tools
- Filters npm-scanner and npm-wplogin, tested with fail2ban-regex in the build
- jail.local generated from .env, optional npm-wplogin and recidive
- Watcher reloads the jails when NPM creates a new proxy host log
- check command, docs, testbed for LXC

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,40 @@
+# syntax=docker/dockerfile:1
+# npm-scanner – fail2ban for Nginx Proxy Manager
+# https://git.retronerd.at/schiwagoa/npm-scanner
+#
+# Build (multi-arch):
+#   docker buildx build --platform linux/amd64,linux/arm64 \
+#     -t git.retronerd.at/schiwagoa/npm-scanner:<version> --push .
+
+ARG FAIL2BAN_VERSION=1.1.1
+
+FROM crazymax/fail2ban:${FAIL2BAN_VERSION} AS base
+
+RUN apk add --no-cache inotify-tools
+
+COPY rootfs /
+RUN chmod 0755 /usr/local/bin/npm-scanner-init.sh /usr/local/bin/npm-newlog-watch.sh \
+  && chmod 0644 /etc/fail2ban/filter.d/npm-scanner.conf /etc/fail2ban/filter.d/npm-wplogin.conf
+
+# Filter tests – the build fails if a filter no longer matches as expected.
+FROM base AS test
+COPY tests /tests
+RUN sh /tests/run-filter-tests.sh && touch /tests/passed
+
+FROM base
+ARG VERSION=dev
+LABEL org.opencontainers.image.title="npm-scanner" \
+      org.opencontainers.image.description="fail2ban for Nginx Proxy Manager: bans scanners in DOCKER-USER" \
+      org.opencontainers.image.source="https://git.retronerd.at/schiwagoa/npm-scanner" \
+      org.opencontainers.image.licenses="MIT" \
+      org.opencontainers.image.version="${VERSION}"
+
+# Pulls in the test stage, so a plain `docker build` runs the tests too.
+COPY --from=test /tests/passed /usr/share/npm-scanner/filter-tests.passed
+
+ENV TZ="Europe/Vienna" \
+    F2B_LOG_TARGET="STDOUT" \
+    F2B_DB_PURGE_AGE="30d"
+
+ENTRYPOINT [ "/usr/local/bin/npm-scanner-init.sh" ]
+CMD [ "fail2ban-server", "-f", "-x", "-v", "start" ]