schiwagoaandClaude Opus 5.5
d7dcd9d6b1
- Image based on crazymax/fail2ban:1.1.1 with inotify-tools - Filters npm-scanner and npm-wplogin, tested with fail2ban-regex in the build - jail.local generated from .env, optional npm-wplogin and recidive - Watcher reloads the jails when NPM creates a new proxy host log - check command, docs, testbed for LXC Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
45 lines
1.5 KiB
YAML
45 lines
1.5 KiB
YAML
# npm-scanner – fail2ban for Nginx Proxy Manager (Docker)
|
||
# Source: https://git.retronerd.at/schiwagoa/npm-scanner
|
||
# Base: https://github.com/crazy-max/docker-fail2ban
|
||
#
|
||
# No own bridge network on purpose: fail2ban has to set its rules in the
|
||
# firewall of the HOST (chain DOCKER-USER). In a bridge network it would only
|
||
# change the firewall of its own container.
|
||
|
||
name: npm-scanner
|
||
|
||
services:
|
||
npm-scanner:
|
||
image: git.retronerd.at/schiwagoa/npm-scanner:${NPM_SCANNER_VERSION:-latest}
|
||
# Build locally instead of pulling:
|
||
# build: .
|
||
container_name: npm-scanner
|
||
restart: unless-stopped
|
||
init: true # tini: reaps the watcher and tail processes
|
||
network_mode: host
|
||
cap_add:
|
||
- NET_ADMIN
|
||
- NET_RAW
|
||
env_file: .env
|
||
environment:
|
||
TZ: ${TZ:-Europe/Vienna}
|
||
F2B_LOG_LEVEL: ${F2B_LOG_LEVEL:-INFO}
|
||
F2B_DB_PURGE_AGE: ${F2B_DB_PURGE_AGE:-30d} # history for increasing ban times
|
||
volumes:
|
||
- ./data:/data # fail2ban DB + own additions
|
||
- ${NPM_LOG_DIR:?NPM_LOG_DIR missing in .env}:/logs/npm1:ro
|
||
- ${NPM_LOG_DIR2:-${NPM_LOG_DIR}}:/logs/npm2:ro # jlesage: second directory (logs/)
|
||
# Optional, for fail2ban-client on the host / fail2ban-webui:
|
||
# - /run/npm-scanner:/var/run/fail2ban
|
||
healthcheck:
|
||
test: ["CMD", "fail2ban-client", "ping"]
|
||
interval: 60s
|
||
timeout: 10s
|
||
retries: 3
|
||
start_period: 30s
|
||
logging:
|
||
driver: json-file
|
||
options:
|
||
max-size: "10m"
|
||
max-file: "3"
|