Add LinuxServer Fail2ban adapter

2026-09-23 08:01:00 +00:00 · 2026-06-24 21:27:19 +08:00
parent 370a7adede
commit 7ef37036bc
17 changed files with 292 additions and 0 deletions
@@ -0,0 +1,5 @@
+CONTAINER_NAME=
+CONFIG_PATH=./data/config
+HOST_LOG_PATH=/var/log
+VERBOSITY=-vv
+TIME_ZONE=Asia/Shanghai
@@ -0,0 +1,75 @@
+additionalProperties:
+  formFields:
+  - default: ./data/config
+    edit: true
+    envKey: CONFIG_PATH
+    labelEn: Config folder path
+    labelZh: 配置文件路径
+    label:
+      en: Config folder path
+      zh: 配置文件路径
+      zh-Hant: 設定檔資料夾路徑
+      ja: 設定フォルダーのパス
+      ko: 설정 폴더 경로
+      ru: Путь к папке конфигурации
+      ms: Laluan folder konfigurasi
+      pt-br: Caminho da pasta de configuração
+    required: true
+    type: text
+  - default: /var/log
+    edit: true
+    envKey: HOST_LOG_PATH
+    labelEn: Host log path
+    labelZh: 主机日志路径
+    label:
+      en: Host log path
+      zh: 主机日志路径
+      zh-Hant: 主機日誌路徑
+      ja: ホストログパス
+      ko: 호스트 로그 경로
+      ru: Путь журналов хоста
+      ms: Laluan log hos
+      pt-br: Caminho de logs do host
+    required: true
+    type: text
+  - default: "-vv"
+    edit: true
+    envKey: VERBOSITY
+    labelEn: Log verbosity
+    labelZh: 日志详细级别
+    label:
+      en: Log verbosity
+      zh: 日志详细级别
+      zh-Hant: 日誌詳細層級
+      ja: ログ詳細レベル
+      ko: 로그 상세 수준
+      ru: Подробность журнала
+      ms: Tahap keterperincian log
+      pt-br: Nivel de detalhamento do log
+    required: true
+    type: select
+    values:
+    - label: "-v"
+      value: "-v"
+    - label: "-vv"
+      value: "-vv"
+    - label: "-vvv"
+      value: "-vvv"
+    - label: "-vvvv"
+      value: "-vvvv"
+  - default: Asia/Shanghai
+    edit: true
+    envKey: TIME_ZONE
+    labelEn: Time zone
+    labelZh: 时区
+    label:
+      en: Time zone
+      zh: 时区
+      zh-Hant: 時區
+      ja: タイムゾーン
+      ko: 시간대
+      ru: Часовой пояс
+      ms: Zon waktu
+      pt-br: Fuso horário
+    required: true
+    type: text
@@ -0,0 +1,19 @@
+services:
+  fail2ban:
+    image: "linuxserver/fail2ban:1.1.0"
+    container_name: ${CONTAINER_NAME}
+    restart: always
+    network_mode: host
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
+    volumes:
+      - "${CONFIG_PATH}:/config"
+      - "${HOST_LOG_PATH}:/var/log:ro"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=${TIME_ZONE}
+      - VERBOSITY=${VERBOSITY}
+    labels:
+      createdBy: "Apps"
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+mkdir -p ./data/config
+chown -R 1000:1000 ./data 2>/dev/null || true
@@ -0,0 +1,2 @@
+#!/bin/bash
+docker-compose down --volumes
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+mkdir -p ./data/config
+chown -R 1000:1000 ./data 2>/dev/null || true
@@ -0,0 +1,44 @@
+# Fail2ban LinuxServer
+
+## 产品介绍
+
+Fail2ban LinuxServer 使用 LinuxServer.io 维护的 `linuxserver/fail2ban` 镜像，提供 Fail2ban 主机入侵防护服务 能力。
+
+## 主要功能
+
+- 提供 日志监控和封禁规则 能力
+- 持久化保存配置和业务数据
+- 使用安装表单配置数据路径、主机日志路径和日志级别
+- 支持自定义时区
+
+## 访问说明
+
+Fail2ban 没有 Web 界面。安装完成后，在配置目录中编辑 jail 配置并查看 `/config/log/fail2ban/fail2ban.log`。
+
+## 运行说明
+
+该应用使用 host network，并需要 `NET_ADMIN`、`NET_RAW` 权限读取日志并管理封禁规则。默认 LinuxServer 配置中的 jail 处于禁用状态，请仅在确认日志路径和封禁规则后启用需要的 jail。
+
+## Introduction
+
+Fail2ban LinuxServer uses the LinuxServer.io maintained `linuxserver/fail2ban` image for log monitoring and ban rules.
+
+## Features
+
+- Provide log monitoring and ban rules
+- Persist configuration and application data
+- Configure data paths, host log path, and log verbosity from the install form
+- Configure the container time zone
+
+## Access
+
+Fail2ban does not provide a web interface. After installation, edit jail files in the config directory and check `/config/log/fail2ban/fail2ban.log`.
+
+## Runtime Notes
+
+This app uses host networking and requires `NET_ADMIN` and `NET_RAW` so it can read logs and manage ban rules. LinuxServer's default jail configuration is disabled; enable only the jails whose log paths and ban actions you have reviewed.
+
+## Links
+
+- LinuxServer image documentation: <https://docs.linuxserver.io/images/docker-fail2ban/>
+- Project website: <http://www.fail2ban.org/>
@@ -0,0 +1,30 @@
+name: Fail2ban LinuxServer
+tags:
+- Security
+title: Fail2ban 主机入侵防护服务
+description: Fail2ban 主机入侵防护服务
+additionalProperties:
+  key: fail2ban-linuxserver
+  name: Fail2ban LinuxServer
+  tags:
+  - Security
+  shortDescZh: Fail2ban 主机入侵防护服务
+  shortDescEn: Host intrusion prevention service maintained by LinuxServer.io
+  description:
+    en: Host intrusion prevention service maintained by LinuxServer.io
+    zh: Fail2ban 主机入侵防护服务
+    zh-Hant: Fail2ban 主機入侵防護服務
+    ja: LinuxServer.io が保守するホスト侵入防止サービス
+    ko: LinuxServer.io에서 유지 관리하는 호스트 침입 방지 서비스
+    ru: Служба предотвращения вторжений на хост, поддерживаемая LinuxServer.io
+    ms: Perkhidmatan pencegahan pencerobohan hos yang diselenggara oleh LinuxServer.io
+    pt-br: Servico de prevencao de intrusao no host mantido pela LinuxServer.io
+  type: tool
+  crossVersionUpdate: true
+  limit: 0
+  website: http://www.fail2ban.org/
+  github: https://github.com/linuxserver/docker-fail2ban
+  document: https://docs.linuxserver.io/images/docker-fail2ban/
+  architectures:
+  - amd64
+  - arm64
@@ -0,0 +1,5 @@
+CONTAINER_NAME=
+CONFIG_PATH=./data/config
+HOST_LOG_PATH=/var/log
+VERBOSITY=-vv
+TIME_ZONE=Asia/Shanghai
@@ -0,0 +1,75 @@
+additionalProperties:
+  formFields:
+  - default: ./data/config
+    edit: true
+    envKey: CONFIG_PATH
+    labelEn: Config folder path
+    labelZh: 配置文件路径
+    label:
+      en: Config folder path
+      zh: 配置文件路径
+      zh-Hant: 設定檔資料夾路徑
+      ja: 設定フォルダーのパス
+      ko: 설정 폴더 경로
+      ru: Путь к папке конфигурации
+      ms: Laluan folder konfigurasi
+      pt-br: Caminho da pasta de configuração
+    required: true
+    type: text
+  - default: /var/log
+    edit: true
+    envKey: HOST_LOG_PATH
+    labelEn: Host log path
+    labelZh: 主机日志路径
+    label:
+      en: Host log path
+      zh: 主机日志路径
+      zh-Hant: 主機日誌路徑
+      ja: ホストログパス
+      ko: 호스트 로그 경로
+      ru: Путь журналов хоста
+      ms: Laluan log hos
+      pt-br: Caminho de logs do host
+    required: true
+    type: text
+  - default: "-vv"
+    edit: true
+    envKey: VERBOSITY
+    labelEn: Log verbosity
+    labelZh: 日志详细级别
+    label:
+      en: Log verbosity
+      zh: 日志详细级别
+      zh-Hant: 日誌詳細層級
+      ja: ログ詳細レベル
+      ko: 로그 상세 수준
+      ru: Подробность журнала
+      ms: Tahap keterperincian log
+      pt-br: Nivel de detalhamento do log
+    required: true
+    type: select
+    values:
+    - label: "-v"
+      value: "-v"
+    - label: "-vv"
+      value: "-vv"
+    - label: "-vvv"
+      value: "-vvv"
+    - label: "-vvvv"
+      value: "-vvvv"
+  - default: Asia/Shanghai
+    edit: true
+    envKey: TIME_ZONE
+    labelEn: Time zone
+    labelZh: 时区
+    label:
+      en: Time zone
+      zh: 时区
+      zh-Hant: 時區
+      ja: タイムゾーン
+      ko: 시간대
+      ru: Часовой пояс
+      ms: Zon waktu
+      pt-br: Fuso horário
+    required: true
+    type: text
@@ -0,0 +1,19 @@
+services:
+  fail2ban:
+    image: "linuxserver/fail2ban:latest"
+    container_name: ${CONTAINER_NAME}
+    restart: always
+    network_mode: host
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
+    volumes:
+      - "${CONFIG_PATH}:/config"
+      - "${HOST_LOG_PATH}:/var/log:ro"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=${TIME_ZONE}
+      - VERBOSITY=${VERBOSITY}
+    labels:
+      createdBy: "Apps"
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+mkdir -p ./data/config
+chown -R 1000:1000 ./data 2>/dev/null || true
@@ -0,0 +1,2 @@
+#!/bin/bash
+docker-compose down --volumes
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+mkdir -p ./data/config
+chown -R 1000:1000 ./data 2>/dev/null || true