Initial version: npm-scanner image, filters, entrypoint, watcher, testbed

- Image based on crazymax/fail2ban:1.1.1 with inotify-tools
- Filters npm-scanner and npm-wplogin, tested with fail2ban-regex in the build
- jail.local generated from .env, optional npm-wplogin and recidive
- Watcher reloads the jails when NPM creates a new proxy host log
- check command, docs, testbed for LXC

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dev/testbed/fake-npm-logs.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Writes log lines in Nginx Proxy Manager format, like NPM would.
+#
+#   ./fake-npm-logs.sh scan     <ip> [count] [host-id] [log|logs]   4xx on scanner paths
+#   ./fake-npm-logs.sh wplogin  <ip> [count] [host-id] [log|logs]   POST /wp-login.php
+#   ./fake-npm-logs.sh harmless <ip> [count] [host-id] [log|logs]   404 /favicon.ico, 200 /
+#   ./fake-npm-logs.sh fallback <ip> [count]                        444 on the default host
+#   ./fake-npm-logs.sh newhost  <host-id> [log|logs]                empty log of a new proxy host
+
+set -euo pipefail
+cd "$(dirname "$0")"
+
+cmd=${1:?command missing}
+now() { date -u '+%d/%b/%Y:%H:%M:%S +0000'; }
+proxy_line() { # status method path ip
+  printf '[%s] - %s %s - %s https test.example.com "%s" [Client %s] [Length 150] [Gzip -] [Sent-to 172.16.52.10] "curl/8.5.0" "-"\n' \
+    "$(now)" "$1" "$1" "$2" "$3" "$4"
+}
+
+case "$cmd" in
+  scan|wplogin|harmless)
+    ip=${2:?ip missing}; count=${3:-3}; host=${4:-1}; dir=npm-logs/${5:-log}
+    file="$dir/proxy-host-${host}_access.log"
+    mkdir -p "$dir"
+    paths=(/.env /.git/config /phpinfo.php /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php /actuator/env)
+    for ((i = 0; i < count; i++)); do
+      case "$cmd" in
+        scan)     proxy_line 404 GET "${paths[i % ${#paths[@]}]}" "$ip" ;;
+        wplogin)  proxy_line 200 POST /wp-login.php "$ip" ;;
+        harmless) proxy_line 404 GET /favicon.ico "$ip"; proxy_line 200 GET / "$ip" ;;
+      esac >> "$file"
+      sleep 0.2
+    done
+    echo "$cmd: $count × $ip -> $file"
+    ;;
+  fallback)
+    ip=${2:?ip missing}; count=${3:-3}
+    mkdir -p npm-logs/log
+    for ((i = 0; i < count; i++)); do
+      printf '%s - - [%s] "GET / HTTP/1.1" 444 0 "-" "curl/8.5.0"\n' "$ip" "$(now)" >> npm-logs/log/default-host_access.log
+      sleep 0.2
+    done
+    echo "fallback: $count × $ip -> npm-logs/log/default-host_access.log"
+    ;;
+  newhost)
+    host=${2:?host-id missing}; dir=npm-logs/${3:-log}
+    mkdir -p "$dir"
+    touch "$dir/proxy-host-${host}_access.log"
+    echo "newhost: $dir/proxy-host-${host}_access.log"
+    ;;
+  *)
+    sed -n '2,9p' "$0"; exit 1 ;;
+esac