Added fail2ban, though not sure its configured correctly yet

Author: jc21

docker/Dockerfile

@@ -53,6 +53,12 @@ ENV SUPPRESS_NO_CONFIG_WARNING=1 \
 
 RUN echo "fs.file-max = 65535" > /etc/sysctl.conf
 
+# fail2ban
+RUN apt-get update \
+	&& apt-get install -y --no-install-recommends fail2ban \
+	&& apt-get clean \
+	&& rm -rf /var/lib/apt/lists/* /etc/fail2ban
+
 # s6 overlay
 COPY scripts/install-s6 /tmp/install-s6
 RUN /tmp/install-s6 "${TARGETPLATFORM}" && rm -rf /tmp/*

docker/dev/Dockerfile

@@ -22,13 +22,13 @@ ENV GOPROXY=$GOPROXY \
 
 RUN echo "fs.file-max = 65535" > /etc/sysctl.conf
 
-# usql and node
+# usql, node, fail2ban
 RUN curl -fsSL https://deb.nodesource.com/setup_16.x | bash - \
 	&& apt-get update \
-	&& apt-get install -y --no-install-recommends nodejs vim dnsutils \
+	&& apt-get install -y --no-install-recommends nodejs vim dnsutils fail2ban \
 	&& npm install --___location=global yarn \
 	&& apt-get clean \
-	&& rm -rf /var/lib/apt/lists/* \
+	&& rm -rf /var/lib/apt/lists/* /etc/fail2ban \
 	&& go install github.com/xo/usql@master
 
 # Task
@@ -42,8 +42,6 @@ RUN rm -f /etc/nginx/conf.d/production.conf
 # s6 overlay
 COPY scripts/install-s6 /tmp/install-s6
 RUN /tmp/install-s6 && rm -rf /tmp/*
-#RUN curl -L -o /tmp/s6-overlay-amd64.tar.gz "https://github.com/just-containers/s6-overlay/releases/download/v1.22.1.0/s6-overlay-amd64.tar.gz" \
-#	&& tar -xzf /tmp/s6-overlay-amd64.tar.gz -C /
 
 # Fix for golang dev:
 RUN chown -R 1000:1000 /opt/go

docker/rootfs/etc/s6-overlay/s6-rc.d/backend/run

@@ -1,4 +1,6 @@
 #!/command/with-contenv bash
+# shellcheck shell=bash
+
 set -e
 
 echo "❯ Starting backend ..."

docker/rootfs/etc/s6-overlay/s6-rc.d/fail2ban/dependencies.d/prepare

@@ -0,0 +1,5 @@
+#!/command/with-contenv bash
+# shellcheck shell=bash
+
+echo "❯ Starting fail2ban ..."
+exec /usr/bin/fail2ban-client -c /fail2ban -x -vv -f start

docker/rootfs/etc/s6-overlay/s6-rc.d/fail2ban/run

@@ -0,0 +1 @@
+longrun

docker/rootfs/etc/s6-overlay/s6-rc.d/fail2ban/type

@@ -1,4 +1,6 @@
 #!/command/with-contenv bash
+# shellcheck shell=bash
+
 set -e
 
 # This service is DEVELOPMENT only.

docker/rootfs/etc/s6-overlay/s6-rc.d/frontend/run

@@ -1,4 +1,6 @@
 #!/command/with-contenv bash
+# shellcheck shell=bash
+
 set -e
 
 echo "❯ Starting nginx ..."

docker/rootfs/etc/s6-overlay/s6-rc.d/nginx/run

@@ -1,4 +1,6 @@
 #!/command/with-contenv bash
+# shellcheck shell=bash
+
 set -e
 
 DATA_PATH=/data
@@ -47,6 +49,14 @@ chown -R npmuser:npmuser /var/log/nginx
 mkdir -p /tmp/npmuserhome
 chown -R npmuser:npmuser /tmp/npmuserhome
 
+# fail2ban configuration
+mkdir -p /fail2ban/{action.d,filter.d,jail.d,log}
+chown -R npmuser:npmuser /fail2ban
+mkdir -p /var/run/fail2ban
+mkdir -p /data/logs/fail2ban
+chown nobody:nogroup /data/logs/fail2ban
+chmod 02755 /data/logs/fail2ban
+
 echo
 echo "-------------------------------------
  _   _ ____  __  __

docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/script.sh

@@ -1 +1,2 @@
+# shellcheck shell=bash
 /etc/s6-overlay/s6-rc.d/prepare/script.sh