# syntax=docker/dockerfile:1
# npm-scanner – fail2ban for Nginx Proxy Manager
# https://git.retronerd.at/schiwagoa/npm-scanner
#
# Build (multi-arch):
#   docker buildx build --platform linux/amd64,linux/arm64 \
#     -t git.retronerd.at/schiwagoa/npm-scanner:<version> --push .

ARG FAIL2BAN_VERSION=1.1.1

FROM crazymax/fail2ban:${FAIL2BAN_VERSION} AS base

RUN apk add --no-cache inotify-tools

COPY rootfs /
RUN chmod 0755 /usr/local/bin/npm-scanner-init.sh /usr/local/bin/npm-newlog-watch.sh \
  && chmod 0644 /etc/fail2ban/filter.d/npm-scanner.conf /etc/fail2ban/filter.d/npm-wplogin.conf

# Filter tests – the build fails if a filter no longer matches as expected.
FROM base AS test
COPY tests /tests
RUN sh /tests/run-filter-tests.sh && touch /tests/passed

FROM base
ARG VERSION=dev
LABEL org.opencontainers.image.title="npm-scanner" \
      org.opencontainers.image.description="fail2ban for Nginx Proxy Manager: bans scanners in DOCKER-USER" \
      org.opencontainers.image.source="https://git.retronerd.at/schiwagoa/npm-scanner" \
      org.opencontainers.image.licenses="MIT" \
      org.opencontainers.image.version="${VERSION}"

# Pulls in the test stage, so a plain `docker build` runs the tests too.
COPY --from=test /tests/passed /usr/share/npm-scanner/filter-tests.passed

ENV TZ="Europe/Vienna" \
    F2B_LOG_TARGET="STDOUT" \
    F2B_DB_PURGE_AGE="30d"

ENTRYPOINT [ "/usr/local/bin/npm-scanner-init.sh" ]
CMD [ "fail2ban-server", "-f", "-x", "-v", "start" ]