From a24ab962e1e340fb6e73fcbf9bfa2ec84b6823d6 Mon Sep 17 00:00:00 2001
From: gitea <gitea@thisisfake.lol>
Date: Fri, 20 Feb 2026 19:57:52 +0000
Subject: [PATCH] docs: wire in screenshots

---
 README.md    |  8 +++-----
 USERGUIDE.md | 13 ++++++-------
 2 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/README.md b/README.md
index 26a6816..f6864fd 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 > Fail2Ban management dashboard for Nginx Proxy Manager — bans scanners, bots, and exploit probers automatically, with a browser UI to monitor and control everything.
 
-<!-- SCREENSHOT: Main dashboard — full grid of ban cards visible, mix of BADBOT/NPM-PROBE/HTTP-ERRORS jail badges, AbuseIPDB scores showing on several cards, dark terminal UI -->
+![F2B Control Center — main dashboard](Screenshots/Full%20Ban%20Grid.png)
 
 ---
 
@@ -103,11 +103,9 @@ Get your Global API Key at: https://dash.cloudflare.com/profile/api-tokens
 
 See **[USERGUIDE.md](USERGUIDE.md)** for a plain-English walkthrough of every dashboard feature.
 
-<!-- SCREENSHOT: Filter tab row — all tab buttons visible ([ALL][BADBOT][NPM][HTTP-ERRORS][PRISON][WHITELIST][EXEMPT][SCAN]), one tab active/highlighted -->
+![Filter tabs](Screenshots/Filter%20Tab%20Row.png)
 
-<!-- SCREENSHOT: Scan results panel — several suspect IP cards visible with [BAN], [EXEMPT], [THREAT], [RECORDS] buttons; one card showing an AbuseIPDB score -->
-
-<!-- SCREENSHOT: Live log stream — scrolling fail2ban log output showing ban events in real time, terminal-style -->
+![Live log stream](Screenshots/Scan%20Log%20Stream.png)
 
 ---
 
diff --git a/USERGUIDE.md b/USERGUIDE.md
index 299247b..1ff07af 100644
--- a/USERGUIDE.md
+++ b/USERGUIDE.md
@@ -18,7 +18,7 @@ The dashboard gives you a live view of what's happening, and lets you take actio
 
 Navigate to `http://YOUR_SERVER_IP:4000` in your browser.
 
-<!-- SCREENSHOT: Full dashboard on first load — ban grid visible with several cards, filter tabs across the top, action bar below the tabs, dark retro-terminal theme -->
+![F2B Control Center dashboard](Screenshots/Full%20Ban%20Grid.png)
 
 ---
 
@@ -26,7 +26,7 @@ Navigate to `http://YOUR_SERVER_IP:4000` in your browser.
 
 The main view is a grid of cards — one card per banned IP address.
 
-<!-- SCREENSHOT: Close-up of 2-3 ban cards side by side — showing IP, jail badge (e.g. BADBOT), ban expiry time, AbuseIPDB score, and action buttons -->
+![Ban cards](Screenshots/Full%20Ban%20Grid.png)
 
 Each card shows:
 
@@ -54,7 +54,7 @@ Every ban comes from a "jail" — a rule set that detected bad behaviour:
 
 ## Filter Tabs
 
-<!-- SCREENSHOT: The filter tab row at full width — [ALL] [BADBOT] [NPM] [HTTP-ERRORS] [PRISON] [WHITELIST] [EXEMPT] [SCAN] — with one tab highlighted/active -->
+![Filter tabs](Screenshots/Filter%20Tab%20Row.png)
 
 The row of buttons across the top filters the grid:
 
@@ -82,7 +82,7 @@ Each card has buttons for acting on that IP:
 
 ## The Action Bar
 
-<!-- SCREENSHOT: The action bar — IP address input field on the left, dropdown selector showing options (ARREST / PAROLE / WHITELIST / SEARCH), GO button on the right -->
+![Action bar](Screenshots/Action%20Bar.png)
 
 The bar just below the filter tabs lets you act on any IP by address — even ones that aren't currently banned:
 
@@ -101,7 +101,6 @@ Actions available here:
 
 ## Scan
 
-<!-- SCREENSHOT: Scan results — 4-5 suspect IP cards visible, each with [BAN], [EXEMPT], [THREAT], [RECORDS] buttons; one card showing a high AbuseIPDB score in red -->
 
 The Scan reads your NPM access logs and surfaces IP addresses that are behaving suspiciously but haven't been banned yet. Click **`[SCAN]`** in the filter tabs to run it.
 
@@ -134,7 +133,7 @@ When in doubt about an IP you've reviewed: use Exempt. Reserve Whitelist for thi
 
 ## Live Log
 
-<!-- SCREENSHOT: Live log stream panel — scrolling text of fail2ban log output showing detection events and ban notices, monospace font, dark background, newest entry at bottom -->
+![Live log stream](Screenshots/Scan%20Log%20Stream.png)
 
 The live log shows fail2ban's activity as it happens — every detection, ban, and unban in real time. Useful for confirming that a ban landed, watching a scan in progress, or just seeing what's hitting your server right now.
 
@@ -142,7 +141,7 @@ The live log shows fail2ban's activity as it happens — every detection, ban, a
 
 ## Access Log Viewer (Records)
 
-<!-- SCREENSHOT: Per-IP log viewer — showing a filtered list of HTTP requests from one IP: method, path, status code, timestamp, one or two suspicious paths highlighted -->
+![Per-IP access log viewer](Screenshots/Per-IP%20Records.png)
 
 Click **`[RECORDS]`** on any ban card or scan result to open a filtered view of the NPM access log for that specific IP. You'll see every request it made — what paths it hit, what status codes it got back, and when.