[{"_1":2,"_203":-5,"_204":-5},"loaderData",{"_3":4,"_18":19,"_25":26,"_176":177},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16,"_17":11},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","dockerRebrandTour","routes/_layout",{"_20":-5,"_21":22,"_23":11,"_24":22},"username","isAskGordonEnabled",true,"showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":89,"_110":111,"_164":-5,"_165":11,"_166":22,"_167":11,"_168":11,"_169":-5,"_170":11,"_171":-5,"_172":173,"_174":112,"_175":-7},"canonicalUrl","https://hub.docker.com/r/xomoxcc/f2b-api/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","xomoxcc","reponame","f2b-api","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":74,"_79":11,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2026-10-30T17:44:48.076503Z","description","","is_private","last_updated","2026-10-30T18:02:49.361232Z","last_modified","2026-10-30T17:58:17.010929Z","media_types",[56],"application/vnd.oci.image.index.v1+json","name","pull_count",160,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","[![https://github.com/vroomfondel/somestuff/raw/main/f2bapistuff/logo_f2bapistuff_250x250.png](https://github.com/vroomfondel/somestuff/raw/main/f2bapistuff/logo_f2bapistuff_250x250.png)](https://github.com/vroomfondel/somestuff/tree/main/f2bapistuff)\n\n# f2b-api: fail2ban with a remote ban API\n\nOne Debian trixie image (fail2ban 1.1.0, iptables-nft, msmtp, python3-typer) for both ends of a remote-ban setup: a fail2ban **client** that cannot block anything itself (a container behind a proxy) and a **server** that owns the firewall of the machine the attackers actually reach. The client's bans are mirrored into a jail on the server, one jail per client.\n\n## Roles (entrypoint.sh)\n\n| `CMD` | Role |\n|------------|---------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `fail2ban` | fail2ban-server. Client: `F2B_HUB_SYNC=1` and a mounted `/etc/f2b-hub/{url,token}`. Server: the `remote-` jails, `NET_ADMIN`, host network |\n| `api` | `f2b_api.py serve --listen --port `: the HTTP API, talks to the server's fail2ban only through its socket directory, needs no capabilities |\n\nEnvironment for `fail2ban`:\n\n| Variable | Default | Meaning |\n|---------------------|--------------------------------------|----------------------------------------------------------------------------------------------|\n| `F2B_LOGTARGET` | `STDOUT` | fail2ban log target; a file when `recidive` should read it |\n| `F2B_DBFILE` | `/var/lib/fail2ban/fail2ban.sqlite3` | ban database, mount it to keep bans across restarts |\n| `F2B_DBPURGEAGE` | `8d` | how long finished bans stay in the database |\n| `F2B_TOUCH` | – | `path[:uid] ...`: log files created before the start (a missing file fails the whole server) |\n| `F2B_HUB_SYNC` | `0` | `1` starts `f2b_hub_sync.py` next to fail2ban (client side) |\n| `F2B_SYNC_INTERVAL` | `300` | seconds between full reconciles |\n| `F2B_SYNC_TRIGGER` | `/run/f2b-hub-resync` | file whose presence triggers a reconcile within 5 s |\n\n## Client side\n\nJails use `banaction = hubapi`: every ban is posted at once to `POST /f2b/v1/ban`, with `/etc/f2b-hub/url` and `/etc/f2b-hub/token` mounted read-only. Unbans are **not** posted; they only touch the trigger file, and `f2b_hub_sync.py` posts the union of all local jails to `POST /f2b/v1/state` within 5 s, and every `F2B_SYNC_INTERVAL` anyway. The server has one jail per client, the client several: a direct unban at the end of one jail's ban would free an address another jail (e.g. `recidive`) still holds. The periodic reconcile also heals bans the server missed. `f2b_hub_sync.py once` pushes the list a single time.\n\nFilters shipped: `dovecot24` (Dovecot 2.4 file log format) and `remote-ban` (for the server jails).\n\n```ini\n[DEFAULT]\nbackend = polling\nbanaction = hubapi\nbanaction_allports = hubapi\naction = %(action_)s\n\n[dovecot]\nenabled = true\nfilter = dovecot24\nlogpath = /var/log/mail/dovecot.log\n```\n\n## Server side\n\nJails `remote-` (`filter = remote-ban`, `logpath = /dev/null`, `backend = polling`, a real `banaction`), fed only by the API. Run two containers from this image: `fail2ban` with `NET_ADMIN`/`NET_RAW` in the host network owning the jails, and `api` without capabilities sharing only fail2ban's socket directory (`/run/fail2ban`). Never mount the host's own fail2ban socket into the API container.\n\n| File | Content |\n|------------------------|-----------------------------------------------------------------------------|\n| `/etc/f2b-api/tokens` | ` ` per line; tokens of at least 32 characters; `#` comments |\n| `/etc/f2b-api/protect` | networks that are never banned, one IPv4 address or CIDR per line |\n\nOnly global IPv4 addresses outside the protect list are accepted; private, reserved and multicast addresses are rejected with 422.\n\n## API\n\n| Method | Path | Body | Effect |\n|--------|-----------------|------------------|---------------------------------------------|\n| `POST` | `/f2b/v1/ban` | `{\"ip\", \"jail\"}` | `fail2ban-client set remote- banip` |\n| `POST` | `/f2b/v1/unban` | `{\"ip\"}` | `… unbanip` |\n| `POST` | `/f2b/v1/state` | `{\"ips\": [...]}` | reconcile the jail to exactly this set |\n| `GET` | `/f2b/v1/state` | – | the client's banned addresses |\n\nAuthentication: `Authorization: Bearer `; each client sees only its own jail.\n\n## Tags\n\n`-` (e.g. `1.1.0-1`) and `latest`. Pin the versioned tag: the server container holds `NET_ADMIN`.\n\nSource: [vroomfondel/somestuff/f2bapistuff](https://github.com/vroomfondel/somestuff/tree/main/f2bapistuff)\n","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":22,"_83":11,"_84":11},"read","write","admin","user","storage_size",174602405,"orgData",{"_90":91,"_92":93,"_94":95,"_96":33,"_97":48,"_98":99,"_100":101,"_102":48,"_103":104,"_105":106,"_107":48,"_108":48,"_109":22},"id","6f318f246c8440b0aaa23a169c30bbc8","uuid","6f318f24-6c84-40b0-aaa2-3a169c30bbc8","type","organization","orgname","full_name","location","Ellerbek","company","XOMOX GmbH","profile_url","date_joined","2025-02-07T09:09:11.304991Z","gravatar_url","https://www.gravatar.com/avatar/1afeb5ce231a633bb22208de6879f7b6?s=80&r=g&d=mm","gravatar_email","badge","is_active","recentTags",[112,157],{"_113":44,"_114":115,"_116":117,"_118":119,"_90":120,"_121":122,"_50":145,"_146":115,"_147":148,"_149":56,"_57":150,"_151":152,"_153":129,"_154":145,"_155":66,"_156":22},"content_type","creator",11433645,"digest","sha256:9c8aef29e50ace6875c8371a40335033c64bc4524219f59ae828a1f23e692008","full_size",58657747,1376022959,"images",[123,138],{"_124":125,"_116":126,"_127":48,"_128":129,"_130":131,"_132":133,"_134":48,"_135":-5,"_136":119,"_63":66,"_137":-5},"architecture","amd64","sha256:628121935c46b91f8dc0d6019240f22fb6f8faea0bf5b69bafc8a51fc7a85f71","features","last_pulled","2026-10-31T12:21:01.64420769Z","last_pushed","2026-10-30T18:02:32.74464434Z","os","linux","os_features","os_version","size","variant",{"_124":139,"_116":140,"_127":48,"_128":141,"_130":142,"_132":133,"_134":48,"_135":-5,"_136":143,"_63":66,"_137":144},"arm64","sha256:30c4dcab6e83a07263c9b80726751aed9bf477a20c74e5f5e985e1012a93cecb","2026-10-30T20:41:49.97151989Z","2026-10-30T18:02:43.270436885Z",58666602,"v8","2026-10-30T18:02:48.856427Z","last_updater","last_updater_username","vroofoo","media_type","latest","repository",33124946,"tag_last_pulled","tag_last_pushed","tag_status","v2",{"_113":44,"_114":115,"_116":117,"_118":119,"_90":158,"_121":159,"_50":162,"_146":115,"_147":148,"_149":56,"_57":163,"_151":152,"_153":129,"_154":162,"_155":66,"_156":22},1376022879,[160,161],{"_124":125,"_116":126,"_127":48,"_128":129,"_130":131,"_132":133,"_134":48,"_135":-5,"_136":119,"_63":66,"_137":-5},{"_124":139,"_116":140,"_127":48,"_128":141,"_130":142,"_132":133,"_134":48,"_135":-5,"_136":143,"_63":66,"_137":144},"2026-10-30T18:02:43.962959Z","1.1.0-1","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxRunInCloud","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":178,"_185":186,"_172":201,"_202":11},{"_40":179,"_42":180,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":181,"_57":35,"_32":33,"_58":59,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":182,"_79":11,"_80":184,"_85":33,"_86":87},[],[44],[56],{"_75":11,"_76":183},[78],{"_82":22,"_83":11,"_84":11},"tags",{"_187":188,"_189":-5,"_190":-5,"_191":192},"count",2,"next","previous","results",[193,197],{"_113":44,"_114":115,"_116":117,"_118":119,"_90":120,"_121":194,"_50":145,"_146":115,"_147":148,"_149":56,"_57":150,"_151":152,"_153":129,"_154":145,"_155":66,"_156":22},[195,196],{"_124":125,"_116":126,"_127":48,"_128":129,"_130":131,"_132":133,"_134":48,"_135":-5,"_136":119,"_63":66,"_137":-5},{"_124":139,"_116":140,"_127":48,"_128":141,"_130":142,"_132":133,"_134":48,"_135":-5,"_136":143,"_63":66,"_137":144},{"_113":44,"_114":115,"_116":117,"_118":119,"_90":158,"_121":198,"_50":162,"_146":115,"_147":148,"_149":56,"_57":163,"_151":152,"_153":129,"_154":162,"_155":66,"_156":22},[199,200],{"_124":125,"_116":126,"_127":48,"_128":129,"_130":131,"_132":133,"_134":48,"_135":-5,"_136":119,"_63":66,"_137":-5},{"_124":139,"_116":140,"_127":48,"_128":141,"_130":142,"_132":133,"_134":48,"_135":-5,"_136":143,"_63":66,"_137":144},[],"canDeleteTags","actionData","errors"]

Digest	OS/ARCH	Compressed size
628121935c46	linux/amd64	55.94 MB
30c4dcab6e83	linux/arm64/v8	55.95 MB

xomoxcc/f2b-api

Tags for xomoxcc/f2b-api