gitea
1be79cbd3e
- Remove telegram_notif.sh and all Telegram references - Remove webhook.conf fail2ban action (dashboard webhook stays) - docker-npm.conf: iptables ban/unban only, no lifecycle hooks - Merge docker-compose.cloudflare.yml into docker-compose.yml CF_EMAIL/CF_APIKEY always present — fill in to enable WAF banning - Remove TELEGRAM_BOT_TOKEN/TELEGRAM_CHAT_ID from compose - Drop .env.example dependency — all config inline in compose file Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
63 lines
3.5 KiB
Docker
63 lines
3.5 KiB
Docker
# ── F2B Control Center ────────────────────────────────────────────────────────
|
||
# Single-container image: Fail2Ban + Node.js dashboard + supervisord
|
||
#
|
||
# Build: docker build -t f2b-control-center .
|
||
# Run: docker-compose up -d
|
||
# ─────────────────────────────────────────────────────────────────────────────
|
||
|
||
FROM node:18-slim
|
||
|
||
LABEL org.opencontainers.image.title="F2B Control Center" \
|
||
org.opencontainers.image.description="Fail2Ban + dashboard for Nginx Proxy Manager" \
|
||
org.opencontainers.image.licenses="MIT"
|
||
|
||
# ── System dependencies ───────────────────────────────────────────────────────
|
||
# fail2ban – the core banning daemon
|
||
# supervisor – process manager (runs fail2ban + node in one container)
|
||
# iptables – default ban action backend (requires NET_ADMIN + NET_RAW)
|
||
# ipset – optional; used by some fail2ban actions for performance
|
||
# curl – used by the webhook action and healthcheck
|
||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||
fail2ban \
|
||
supervisor \
|
||
iptables \
|
||
ipset \
|
||
curl \
|
||
&& rm -rf /var/lib/apt/lists/*
|
||
|
||
# ── Dashboard dependencies ────────────────────────────────────────────────────
|
||
WORKDIR /app
|
||
COPY dashboard/package*.json ./
|
||
RUN npm ci --omit=dev --prefer-offline
|
||
|
||
# ── Dashboard source ──────────────────────────────────────────────────────────
|
||
COPY dashboard/server.js ./
|
||
COPY dashboard/public ./public/
|
||
|
||
# ── Default fail2ban config (copied to /etc/fail2ban on first run) ────────────
|
||
COPY fail2ban/ /etc/f2b-defaults/
|
||
|
||
# ── Process management ────────────────────────────────────────────────────────
|
||
COPY supervisor.conf /etc/supervisor/conf.d/f2b-control-center.conf
|
||
|
||
# ── Startup and health ────────────────────────────────────────────────────────
|
||
COPY entrypoint.sh /entrypoint.sh
|
||
COPY healthcheck.sh /healthcheck.sh
|
||
RUN chmod +x /entrypoint.sh /healthcheck.sh
|
||
|
||
# ── Runtime directories ───────────────────────────────────────────────────────
|
||
RUN mkdir -p /data /nginx-logs /var/log /var/run/fail2ban
|
||
|
||
# ── Persistent volumes ────────────────────────────────────────────────────────
|
||
# /data – ban-history.json and other app state
|
||
# /nginx-logs – mount your NPM log directory here (read-only)
|
||
# /etc/fail2ban – persists user-edited jail config across image updates
|
||
VOLUME ["/data", "/nginx-logs", "/etc/fail2ban"]
|
||
|
||
EXPOSE 4000
|
||
|
||
HEALTHCHECK --interval=30s --timeout=10s --start-period=25s --retries=3 \
|
||
CMD /healthcheck.sh
|
||
|
||
ENTRYPOINT ["/entrypoint.sh"]
|