Initial release: F2B Control Center v1.0

Dockerized Fail2Ban + dashboard for Nginx Proxy Manager.

- Single-container image (fail2ban + Node.js + supervisord)
- Pre-built NPM filters: badbot, http-errors, npm-probe, manual-bans
- Web dashboard with live ban feed, log scanner, AbuseIPDB integration
- Configurable via environment variables and .env file
- Persistent volumes for config and ban history
- Webhook support for ban event notifications
- README, .gitignore, MIT license

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fail2ban/filter.d/badbot.conf

@@ -0,0 +1,28 @@
+# ── F2B Control Center — badbot filter ───────────────────────────────────────
+#
+# Blocks known malicious scanners, vulnerability testers, and exploit frameworks
+# by their HTTP User-Agent string.
+#
+# LOG FORMAT:
+#   Primary pattern matches NPM logs with [Client IP] real-IP field:
+#     PROXY_IP - - [date] "GET /" 200 146 "-" "UserAgent" [Client REAL_IP]
+#
+#   If your NPM logs have the client IP at line start (standard nginx combined),
+#   uncomment the alternative failregex lines instead.
+# ─────────────────────────────────────────────────────────────────────────────
+
+[Definition]
+
+# ── Primary: NPM [Client IP] format ──────────────────────────────────────────
+failregex = ^[^ ]+ - -[^\[]*\[[^\]]+\] "[A-Z]+ [^"]*" \d{3} \d+ "[^"]*" "(?:masscan|zgrab|python-requests|Go-http-client/1\.1|[Nn]uclei|sqlmap|dirbuster|gobuster|nikto|nmap|wfuzz|Metasploit|libwww-perl|WPScan|ZmEu|jorgee|NetcraftSurveyAgent|Expanse|Shodan|censys|BinaryEdge|internet-measurement|SemrushBot|AhrefsBot)[^"]*" \[Client <HOST>\]
+
+# ── Alternative: standard nginx combined format (IP at line start) ────────────
+# Uncomment and comment out the Primary line above to use this instead.
+# failregex = ^<HOST> - -[^\[]*\[[^\]]+\] "[A-Z]+ [^"]*" \d{3} \d+ "[^"]*" "(?:masscan|zgrab|python-requests|Go-http-client/1\.1|[Nn]uclei|sqlmap|dirbuster|gobuster|nikto|nmap|wfuzz|Metasploit|libwww-perl|WPScan|ZmEu|jorgee|NetcraftSurveyAgent|Expanse|Shodan|censys|BinaryEdge|internet-measurement)[^"]*"
+
+ignoreregex =
+
+# ── Notes ────────────────────────────────────────────────────────────────────
+# Add more UA patterns to the failregex alternation as needed.
+# Test your filter with:
+#   fail2ban-regex /nginx-logs/proxy-host-1_access.log /etc/fail2ban/filter.d/badbot.conf