schiwagoaandClaude Opus 5.5
d7dcd9d6b1
- Image based on crazymax/fail2ban:1.1.1 with inotify-tools - Filters npm-scanner and npm-wplogin, tested with fail2ban-regex in the build - jail.local generated from .env, optional npm-wplogin and recidive - Watcher reloads the jails when NPM creates a new proxy host log - check command, docs, testbed for LXC Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
41 lines
1.5 KiB
Docker
41 lines
1.5 KiB
Docker
# syntax=docker/dockerfile:1
|
||
# npm-scanner – fail2ban for Nginx Proxy Manager
|
||
# https://git.retronerd.at/schiwagoa/npm-scanner
|
||
#
|
||
# Build (multi-arch):
|
||
# docker buildx build --platform linux/amd64,linux/arm64 \
|
||
# -t git.retronerd.at/schiwagoa/npm-scanner:<version> --push .
|
||
|
||
ARG FAIL2BAN_VERSION=1.1.1
|
||
|
||
FROM crazymax/fail2ban:${FAIL2BAN_VERSION} AS base
|
||
|
||
RUN apk add --no-cache inotify-tools
|
||
|
||
COPY rootfs /
|
||
RUN chmod 0755 /usr/local/bin/npm-scanner-init.sh /usr/local/bin/npm-newlog-watch.sh \
|
||
&& chmod 0644 /etc/fail2ban/filter.d/npm-scanner.conf /etc/fail2ban/filter.d/npm-wplogin.conf
|
||
|
||
# Filter tests – the build fails if a filter no longer matches as expected.
|
||
FROM base AS test
|
||
COPY tests /tests
|
||
RUN sh /tests/run-filter-tests.sh && touch /tests/passed
|
||
|
||
FROM base
|
||
ARG VERSION=dev
|
||
LABEL org.opencontainers.image.title="npm-scanner" \
|
||
org.opencontainers.image.description="fail2ban for Nginx Proxy Manager: bans scanners in DOCKER-USER" \
|
||
org.opencontainers.image.source="https://git.retronerd.at/schiwagoa/npm-scanner" \
|
||
org.opencontainers.image.licenses="MIT" \
|
||
org.opencontainers.image.version="${VERSION}"
|
||
|
||
# Pulls in the test stage, so a plain `docker build` runs the tests too.
|
||
COPY --from=test /tests/passed /usr/share/npm-scanner/filter-tests.passed
|
||
|
||
ENV TZ="Europe/Vienna" \
|
||
F2B_LOG_TARGET="STDOUT" \
|
||
F2B_DB_PURGE_AGE="30d"
|
||
|
||
ENTRYPOINT [ "/usr/local/bin/npm-scanner-init.sh" ]
|
||
CMD [ "fail2ban-server", "-f", "-x", "-v", "start" ]
|