Initial version: npm-scanner image, filters, entrypoint, watcher, testbed

- Image based on crazymax/fail2ban:1.1.1 with inotify-tools
- Filters npm-scanner and npm-wplogin, tested with fail2ban-regex in the build
- jail.local generated from .env, optional npm-wplogin and recidive
- Watcher reloads the jails when NPM creates a new proxy host log
- check command, docs, testbed for LXC

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yaml

@@ -0,0 +1,44 @@
+# npm-scanner – fail2ban for Nginx Proxy Manager (Docker)
+# Source: https://git.retronerd.at/schiwagoa/npm-scanner
+# Base:   https://github.com/crazy-max/docker-fail2ban
+#
+# No own bridge network on purpose: fail2ban has to set its rules in the
+# firewall of the HOST (chain DOCKER-USER). In a bridge network it would only
+# change the firewall of its own container.
+
+name: npm-scanner
+
+services:
+  npm-scanner:
+    image: git.retronerd.at/schiwagoa/npm-scanner:${NPM_SCANNER_VERSION:-latest}
+    # Build locally instead of pulling:
+    # build: .
+    container_name: npm-scanner
+    restart: unless-stopped
+    init: true                      # tini: reaps the watcher and tail processes
+    network_mode: host
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
+    env_file: .env
+    environment:
+      TZ: ${TZ:-Europe/Vienna}
+      F2B_LOG_LEVEL: ${F2B_LOG_LEVEL:-INFO}
+      F2B_DB_PURGE_AGE: ${F2B_DB_PURGE_AGE:-30d}   # history for increasing ban times
+    volumes:
+      - ./data:/data                                   # fail2ban DB + own additions
+      - ${NPM_LOG_DIR:?NPM_LOG_DIR missing in .env}:/logs/npm1:ro
+      - ${NPM_LOG_DIR2:-${NPM_LOG_DIR}}:/logs/npm2:ro  # jlesage: second directory (logs/)
+      # Optional, for fail2ban-client on the host / fail2ban-webui:
+      # - /run/npm-scanner:/var/run/fail2ban
+    healthcheck:
+      test: ["CMD", "fail2ban-client", "ping"]
+      interval: 60s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"