# npm-scanner – fail2ban for Nginx Proxy Manager (Docker)
# Source: https://git.retronerd.at/schiwagoa/npm-scanner
# Base:   https://github.com/crazy-max/docker-fail2ban
#
# No own bridge network on purpose: fail2ban has to set its rules in the
# firewall of the HOST (chain DOCKER-USER). In a bridge network it would only
# change the firewall of its own container.

name: npm-scanner

services:
  npm-scanner:
    image: git.retronerd.at/schiwagoa/npm-scanner:${NPM_SCANNER_VERSION:-latest}
    # Build locally instead of pulling:
    # build: .
    container_name: npm-scanner
    restart: unless-stopped
    init: true                      # tini: reaps the watcher and tail processes
    network_mode: host
    cap_add:
      - NET_ADMIN
      - NET_RAW
    env_file: .env
    environment:
      TZ: ${TZ:-Europe/Vienna}
      F2B_LOG_LEVEL: ${F2B_LOG_LEVEL:-INFO}
      F2B_DB_PURGE_AGE: ${F2B_DB_PURGE_AGE:-30d}   # history for increasing ban times
    volumes:
      - ./data:/data                                   # fail2ban DB + own additions
      - ${NPM_LOG_DIR:?NPM_LOG_DIR missing in .env}:/logs/npm1:ro
      - ${NPM_LOG_DIR2:-${NPM_LOG_DIR}}:/logs/npm2:ro  # jlesage: second directory (logs/)
      # Optional, for fail2ban-client on the host / fail2ban-webui:
      # - /run/npm-scanner:/var/run/fail2ban
    healthcheck:
      test: ["CMD", "fail2ban-client", "ping"]
      interval: 60s
      timeout: 10s
      retries: 3
      start_period: 30s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"