We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
docs: Add config reload documentation Configuration-Reference.md: - Added Configuration Reload section - Documented reload flow (edit -> check -> apply) - Service types and SIGHUP support - Module to service mapping - Config tracking via checksums - systemctl reload support CLI-Commands-Reference.md: - Added Configuration Management section - Documented config show/get/set/reset commands - Documented config reload command - Added nftban health config command Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs(zabbix): Add Zabbix 7.x template and server inventory documentation - Add Zabbix 7.x template reference (template_groups format) - Document 18 new server inventory metrics - Add Zabbix inventory_link mappings table - Update import instructions for Zabbix 7.0+ Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: Update Project Statistics for v1.3.0 - Updated version to v1.3.0 (January 22, 2026) - Pure Code: 165,336 lines (Go: 58,592, Bash: 106,744) - Total Lines: 220,785 - Total Files: 592 - Added v1.3.0 features: Zabbix Integration, Generic Connectors, Unified Exporter - Updated growth table and architecture diagram Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: Add zabbix/connector CLI docs and timer schedule - CLI-Commands-Reference: Add zabbix and connector command sections - Configuration-Reference: Add zabbix and connectors config sections - Home: Add Timer-Schedule link - Timer-Schedule: New page (migrated from main repo docs/) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: Add Zabbix and Connectors documentation (v1.3.0) New pages: - Zabbix-Integration.md: Native Zabbix trapper export with LLD - Connectors-Guide.md: ES, Kafka, syslog, file export Updated: - Home.md: Added Monitoring & Export section with links Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: Add trust module documentation - Add nftban trust command section to CLI reference - Document all trust subcommands (list, enable, disable, update, status) - Add trust.conf configuration section with all 28 settings - Document supported providers: Cloudflare, AWS, Google, Azure, etc. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: Update CLI command count to 52 - configaudit, configtest, flush, queue now in registry - Updated date to January 15, 2026 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: Add cPanel and Portmapper security guides New documentation: - cPanel-Compatibility.md: cPHulk coexistence, xtables fix, isolation model - Portmapper-Security.md: Port 111 security, BSI/Hetzner alerts, remediation Updated: - Home.md: Add Panel Integration and Security Guides sections Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: Update project statistics for v1.0.30 - Total pure code: 97,015 lines (Go: 33,143 + Bash: 63,872) - Total with comments/config/web: 173,788 lines - 539 files across 6 categories - Project size: LARGE (50K-250K category) - Added registry architecture section - Updated protection modules (7 modules) - Updated feature statistics (48 CLI commands, 960 config keys) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: Add Registry Architecture wiki page New page documenting NFTBan's unified registry system: - commands.registry.yml (51 CLI commands) - config-registry.json (24 config files) - config-schema.json (960 config keys) - reports-registry.json (18 report types) Includes: - Registry overview diagram - Schema documentation - Validation commands (nftban health registries) - Query examples - Best practices Also updates Home.md with link to new page. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs(config): Add dual-mode architecture and Suricata config docs - Add "Dual-Mode Architecture" section explaining Classic vs Suricata modes - Document mode selection (auto/classic/suricata/hybrid) - Add Suricata availability checks explanation - Document correct EVE JSON path (/var/log/nftban/suricata/eve-alerts.json) - Add suricata.conf examples for ddos, portscan, and login modules - Update login monitoring to include suricata.conf section Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs(login): Add scorer.conf documentation - Document point-based scoring system for login monitoring - Add scorer.conf to file tree structure - Document ban thresholds (temp/escalate/permanent) - Document score decay and IP retention settings - Add per-service score values table (SSH, Mail, FTP, Panels, WordPress) - Include practical scoring examples - Update version to 1.1.0 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: Add Security overview page and update Home navigation - Create Security.md landing page with links to all security docs - Add Platform & CI section to Home.md navigation - Link to Supported-Platforms and CI-Failure-Classification Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: Add platform contract and CI failure classification - Supported-Platforms.md: Authoritative tier definitions, build matrix, kernel/nftables requirements, polkit paths per distro family - CI-Failure-Classification.md: P0/P1/P2 severity mapping, failure classes A-E, required evidence, anti-patterns for review Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: Update DEB install commands to use apt install - Change from dpkg -i to apt install ./package.deb - apt handles dependencies automatically - Fix Ubuntu package filenames (ubuntu24.04 not ubuntu2404) - Update Mode 1 and Mode 2 installation steps Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: Add Debian 13 (Trixie) support - Add Debian 13 to supported distributions table - Add Debian 13 distro config example - Add Debian 13 installation instructions for Mode 1 and Mode 2 - Add Debian 13 quick install command Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs(install): Replace git clone with package install method Mode 1 & 2 Installation: - Replace git clone + install.sh with wget + dpkg/dnf - Add distro-specific package URLs for Debian 11/12, Ubuntu 22.04/24.04 - Add RPM packages for Rocky/Alma 8/9, Fedora 40+ - Simplify to: wget package, dpkg -i, nftban enable - Mode 2 now uses base package + nftban gui enable Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs(panel): Update CLI reference with cPanel, Plesk, CWP, CyberPanel - Add cPanel, Plesk to panel command description - Add full panel list to supported services table Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs(metrics): Add Metrics Architecture documentation - New Metrics-Architecture.md with full Agent/Storage model guide - Updated Home.md: Mode 2 now "GUI + Metrics" with stack options - Updated Configuration-Reference.md: New metrics config section - Updated CLI-Commands-Reference.md: New metrics commands - Updated Installation-Guide.md: Metrics setup options Modes documented: - A: Prometheus all-in-one - B: vmagent -> remote backend - C1: Prometheus -> local VictoriaMetrics - C2: vmagent -> local VictoriaMetrics - Pro: NFTBan Pro subscription Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs(suricata): Add Alert-First workflow and rule management Complete the Rules Management section with: - Alert-First workflow diagram (detect → alert → review → promote) - Rule set logic formula: Final = (AutoDetected ∪ UserWhitelist) − UserBlacklist - Configuration file structure (/etc/nftban/suricata/config/) - Step-by-step workflow commands - Custom rules SID range (9000000-9999999) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: Add comprehensive Suricata IDS Integration guide Complete reference for all 31 Suricata subcommands: - Profiles (minimal/standard/maximum) - Detection filters management - Service scanning and recommendations - Rules management and SID statistics - Custom rules CRUD operations - EVE dual-output model documentation Complements auto-generated CLI reference with detailed examples. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: Update Suricata EVE paths for dual-output model Reflect NFTBan architecture alignment changes: - eve.json → eve-alerts.json (alert-only daemon path) - Add eve-audit.json (optional forensic log) - Add eve-stats.json (optional stats/flow log) - Update logrotate configuration examples - Add Suricata log paths to FHS table 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: Add GeoIP config commands to CLI reference - Add geoip status command - Add geoip config subcommands (show, set-source, set-key, test-download) - Update description to show DB-IP and MaxMind support
docs: Update GeoIP guide with DB-IP as default provider - DB-IP Lite is now the default (no registration required) - MaxMind GeoLite2 as optional with license key - Added provider comparison table - Updated configuration commands - Simplified troubleshooting section
docs: Focus on NFTBan strengths, update CLI count to 47 - Remove competitor comparison table from Project-Statistics - Replace with NFTBan metrics (135K lines, 47 commands, 5 binaries) - Update Firewall-Conflict-Detection to highlight Login Monitor feature - Update CLI command count from 44 to 47 in Home.md 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs(wiki): Consolidate 7 installation pages into 1 comprehensive guide CONSOLIDATION (21 → 14 pages): ─────────────────────────────────────────────────────────────── Merged 7 fragmented installation pages into single guide: ✅ Installation-Guide.md (2,810 lines) - NEW Deleted pages (7): ❌ Installation-Prerequisites.md (839 lines) ❌ DNS-and-Network-Requirements.md (652 lines) ❌ Package-Prerequisites-Implementation.md (466 lines) ❌ Go-Build-Requirements.md (627 lines) ❌ Choosing-Installation-Mode.md (327 lines) ❌ Mode-1-CLI-Only-Installation.md (550 lines) ❌ Mode-2-GUI-Prometheus-Installation.md (898 lines) STRUCTURE: ─────────────────────────────────────────────────────────────── Installation-Guide.md contains: ├─ Table of Contents (with anchor links) ├─ Prerequisites (system, network, packages, Go) ├─ Choose Installation Mode (comparison, decision guide) ├─ Mode 1 Installation (CLI-only setup) ├─ Mode 2 Installation (GUI + Prometheus) ├─ Post-Installation (security, optimization) └─ Troubleshooting (all scenarios) BENEFITS: ─────────────────────────────────────────────────────────────── ✅ 33% fewer pages (21 → 14) ✅ One-stop installation guide (no page hopping) ✅ Better SEO (consolidated content) ✅ Easier maintenance (1 file vs 7) ✅ Improved user experience Updated Home.md with new links to Installation-Guide.md Last Updated: December 31, 2025
docs(wiki): Add Project Statistics page with code metrics - Total: 135,921 lines across 305 files - Bash: 76,666 lines (56.4%) - CLI + core modules - Go: 31,986 lines (23.5%) - high-performance backend - Web: 13,206 lines (9.7%) - HTML/JS/CSS dashboard - 3-4x larger than traditional firewall tools Includes detailed breakdowns by directory, averages, growth history, and comparison to similar projects. Last Updated: December 31, 2025 (v1.0.21)
docs(wiki): Complete rewrite of Groups-and-Permissions for v1.0 COMPLETE REWRITE to match actual v1.0 implementation: CORRECT GROUP NAMES (from actual polkit rules): - nftban (NOT nftban-cli) - operators with full access - nftban-auditor (NOT nftban-auditors) - read-only auditors - nftban-panel (NEW) - panel integration with reload-only KEY CORRECTIONS: ✅ 3-group model (not 3 or 4 with wrong names) ✅ Group names match polkit rules exactly ✅ nftban group gets Polkit service management (NO SUDO!) ✅ Removed all references to obsolete nftban-cli and nftban-web groups ✅ Added complete nftban-panel documentation ✅ Updated permission matrices to match reality ✅ Added examples for each group use case POLKIT RULES ALIGNMENT: - 10-nftban-systemd.rules: nftban group (full service management) - 20-nftban-auditor.rules: nftban-auditor group (read-only) - 30-nftban-panel.rules: nftban-panel group (reload-only) MAJOR IMPROVEMENTS: - Clear explanation of Polkit-based "no sudo" service management - Detailed permission matrix showing what each group can/cannot do - Panel integration architecture and security model - Migration guide from old group names - Troubleshooting section - Security best practices This is now the authoritative reference for NFTBAN v1.0 groups.
docs(wiki): Update Groups-and-Permissions to match v1.0 implementation (WIP) - Change from 3-group to 4-group model - Correct group names: nftban (not nftban-cli), nftban-auditor (not plural), nftban-panel (NEW) - Update header with NFTBAN enterprise branding - Clarify nftban GROUP vs nftban SYSTEM USER distinction WARNING: Page needs complete rewrite - contains outdated references Next: Align all sections with actual polkit rules in packaging/polkit-1/rules.d/
docs(wiki): Update CLI Commands Reference header with NFTBAN branding