# changelog

## Timeline (since 0.3.1)
```

0.3.1 ──► 0.3.2 ──► 0.3.3 ──► 0.3.4 ──► 0.4.0 ──► 0.5.0
🔐🌐     ⚙️🌐     ⚙️🌐     ⚙️🌐     🌐🐳    ⚙️🔐🌐
  │         │         │         │         │         │
  │         │         │         │         │         └─ Multi-server with https endpoint & Admin Authentication
  │         │         │         │         └─ Marker system, copy clipboard & Docker Version
  │         │         │         └─ Warnings & pending status
  │         │         └─ Jail-specific blocklists & filters
  │         └─ Aggregated Fail2Ban stats
  └─ Secure JSON proxy, daily logs, mobile, favicon


##########  Legend #########

🔐 Security
🌐 UI
⚙️ Backend
🐳 Docker

```

# Detailed Changes for all Versions (since 0.3.1)

## Changes made for 0.5.2

- Helper-Scripts/manage-users.sh
- Helper-Scripts/manage-clients.sh
- Web-UI/includes/actions/action_report-ip.php
- Web-UI/includes/actions/reports/abuseipdb.php
- Web-UI/includes/actions/reports/ipinfo.php
- Backend/multi/syncback.sh
- Backend/multi/fail2ban_log2json.sh
- Docs/Adding-Clients.md
- Web-UI/includes/auth.php
- Web-UI/includes/header.php

---


* **Fixed Stored Cross-Site Scripting (XSS) via Client Sync (0.5.1 Hotfix):** Resolved a critical vulnerability in `backsync.php` and `blocklist-overlay.js` where malicious or compromised sync clients could upload a manipulated JSON file containing arbitrary JavaScript payloads (e.g., inside the `ip` or `jail` fields). The UI has been refactored to ban `innerHTML` usage, shifting entirely to secure `textContent` and `createElement` DOM manipulation to neutralize any script execution hazards.
* **Fixed Authentication Bypass on Read Plane (0.5.2):** Resolved an architectural flaw where unauthenticated network sessions were automatically assigned a default `viewer` role, leaving sensitive firewall history, server configurations, and blocking aggregations open to anonymous actors. Access is now strictly guarded at the global gateway level.
* **Fixed Shell Command Injection in Helper Scripts (0.5.2):** Patched `manage_users.sh` and `manage-clients.sh` where user-supplied inputs containing specific shell characters (like apostrophes) were interpreted as executable PHP program text. Data payloads are now passed securely using isolated environment variables (`getenv()`).
* **Fixed Credentials Leak in Process Table (0.5.2):** Hardened the multi-server sync engine (`syncback.sh` and `fail2ban_log2json.sh`) to prevent sync passwords (`CLIENT_PASS`) from leaking into the host's public process listing (`argv`). Commands are now packaged dynamically inside localized, temporary configuration files (`chmod 600`).
* **Secured API Lookup Restrictions & Data Sanitization:** Overhauled `action_report-ip.php` to mandate active administrator verification before reaching outbound services, preventing blind exploitation of paid lookups (AbuseIPDB / IPinfo). Integrated native IP structure enforcement (`FILTER_VALIDATE_IP`).


---

## Changes made for 0.5.1

Web-UI => assets => js => blocklist-overlay.js
Web-UI => endpoint => backsync.php

CVE Nr.: <as soon as i get it>


## Changes made for 0.5.0

### Restructuring `archive/` directory
The archive structure has been reorganized for multi-server support:

```
archive/
└── %server%/ <= Hostname or choosen Name for Host
├── fail2ban/ <= daily json files from fail2ban
├── blocklists/ <= blocklists
└── ufw/ <= future feature
```

Standardserver has to be set in config

### Centralized Path Configuration

**Dynamic Path Management**
- New `paths.php` introduced for centralized path management
   - `$PATHS['config']` → `/opt/Fail2Ban-Report/Settings/`  
   - `$PATHS['blocklists']` → server-specific blocklist paths  
- Usage:
```php
require_once __DIR__ . "/paths.php";
$NEEDED_PATH = $PATHS["blocklists"];
```

> Last 3 Hardcoded Paths are in:
> - `paths.php` → To avoid circular reference
> - `auth.php` → To avoid circular reference
> - `action_report-ip.php` → not integrated in multiserver logic for now (_no need to function propper_)

### UI

- new dropdown for server-list to switch between servers

## Authentication for Admin-Actions

1. **Session-based Authentication**
   - Secure sessions with `session_set_cookie_params`:  
     - `HttpOnly = true`  
     - `Secure = true` (HTTPS only)  
     - `SameSite = Strict`  
   - Session timeout set to 30 minutes  
   - Session roles: `viewer` (default) / `admin`  

2. **Login / Logout Functionality**
   - Login form with username & password  
   - Password verification using `password_verify()` (bcrypt)  
   - Session regeneration after successful login (`session_regenerate_id(true)`)  
   - Logout destroys the session and redirects back to login page  

3. **User Management via JSON File**
   - File: `users.json` located outside the web root (`/opt/Fail2Ban-Report/Settings/users.json`)  
   - No default users – users must be created via shell script  
   - File permissions: `chown root:www-data` + `chmod 0660`  
   - All admin and viewer information loaded from this file  

4. **Admin-only Actions**
   - `block-ip.php` and `unblock-ip.php` check `is_admin()`  
   - Viewers cannot execute these actions and receive clear error messages  

5. **UI Adjustments**
   - Role display, e.g., `Viewer` or `Admin`  
   - Server selection preserved correctly across sessions
   - Login Form in Header
   - Logout button resets role to `Viewer`  

#### Roles
  - `Block` and `Unblock` Features need now Admin Role to work
  - Users with Roles `Viewer` or `Admin` can be added with provided .sh Script `manage-users.sh`



### fail2ban_log2json.sh

**Changes:**
- **Support for "Increase Ban" events:**  
  - Added parsing logic for `Increase Ban` events in addition to `Ban` and `Unban`.
  - Extracts the IP from `Increase Ban` lines separately.
  - Ensures only lines with valid IPs are included in the JSON output.
- **Updated grep pattern:**  
  - From `grep -E "(^|[^A-Za-z])(Ban|Unban) "` to `grep -E "(Ban|Unban)"` to capture `Increase Ban`.
- **Output path adjustment:**  
  - `OUTPUT_JSON_DIR` updated from `/opt/Fail2Ban-Report/archive/YOUR-HOSTNAME/fail2ban` to `/var/www/Fail2Ban-Report/archive`.
- **Minor cleanup:**  
  - Last comma removal logic kept to ensure valid JSON.

---

### jsonreader.js

**Changes:**
- **Increase Ban handling in table:**
  - `Increase Ban` events are no longer rendered as separate rows to avoid flooding the table.
  - Counts `Increase Ban` events per IP and marks the corresponding `Ban`/`Unban` row with a yellow marker (`🟡`).
  - Appends the count of `Increase Ban` events in parentheses next to the yellow marker.
- **Marker logic updated:**
  - Red marker (`🔴`) now indicates multiple `Ban`/`Unban` events per IP.
  - Yellow marker (`🟡`) indicates that `Increase Ban` events exist for that IP, even if no repeated `Ban`/`Unban`.
  - Combination of red and yellow markers can appear if both conditions apply.
- **Filtering remains consistent:**
  - Marker filter logic updated to respect new marker assignments.
- **Step restructuring for clarity:**
  - Added steps for counting `Increase Ban`, filtering, marker assignment, marker filtering, jail dropdown rebuild, sorting, and rendering.

**Behavioral impact:**
- Reduces duplicate rows caused by multiple `Increase Ban` events.
- Highlights IPs with `Increase Ban` activity on the same day.
- Table rendering and filtering continue to work as before with updated marker system.

#### index.php
changed the dropdown-list to match the new Marker assignment


### Fail2Ban-Report 0.5.0 – Backend / Endpoint Updates

```
endpoint/
├── index.php       # Responsible for generating and serving daily JSON logs (Fail2Ban events)
├── update.php      # Endpoint for clients to request which blocklists have updates
├── download.php    # Endpoint for clients to download updated blocklists for syncing
├── backsync.php    # Endpoint for clients to upload updated blocklists; replaces server-side blocklists
└── .htaccess       # Security: IP allowlist to restrict access to trusted clients only

```

### 1. Endpoint (`/endpoint/`)
- New HTTPS endpoint for clients to send JSON data (`fail2ban-events-*.json` and `*.blocklist.json`).
- Authentication using:
  - Username  
  - Password (bcrypt)  
  - UUID  
  - IP address (optional whitelist via `.htaccess`)  
- File type handling:
  - **fail2ban-events-*.json:** overwrites existing file in `archive/<username>/fail2ban/`  
  - **\*.blocklist.json:** locked via `flock`; existing entries are updated (`pending=false`) or deleted depending on transmitted status  
- Automatic creation of client folders in `archive/` on first upload  
- Correct permissions set for web server (`root:www-data`)  


---

### 2. Client Script for JSON Creation & Upload (`fail2ban_log2json.sh`)
- Generates daily JSON from Fail2Ban logs (`fail2ban-events-YYYYMMDD.json`).  
- Uploads the JSON directly to the endpoint using `curl` with authentication (Username + Password + UUID).  
- Logs upload results locally.  
- All key settings (log file, output directory, endpoint URL, auth credentials) configurable at the top of the script.  

---

### 3. Client List Management Helper (`manage-clients.sh`)
- CLI tool to add, edit, or delete client entries.  
- Each client has:
  - Username  
  - Password (bcrypt, server-side hash)  
  - UUID  
  - IP address  
- Stored in `client-list.json` (`/opt/Fail2Ban-Report/Settings/`).  
- Password hash generated via PHP `password_hash()`.  

---

### 4. Client UUID Generation (`create-client-uuid.sh`)
- Script to generate a client UUID for installation or rotation.  
- Stores UUID in `/opt/Fail2Ban-Report/Settings/client-uuid`.  
- Lightweight, intended for initialization or rotation only.  

---

### 5. `.htaccess` for Endpoint
- Separate `.htaccess` in the `endpoint/` folder to override global security rules.  
- By default, only `index.php` is accessible; all other files blocked.  
- Optional IP whitelist (`Require ip <IP>`) can be enabled.  
- Optional Basic Auth can be added.  
- Prevents directory listing and access to sensitive files.  

---

### Summary
- Fully new endpoint infrastructure for client JSON push/pull.  
- Client scripts for upload, UUID, and client list management created.  
- Security enhanced through combined authentication and dedicated `.htaccess` for endpoint.  
- Flexible file handling for Fail2Ban events and blocklists implemented.




---

## Changes made for V 0.4.0

### Optimized `firewall-update.sh` for faster processing, improving performance with large JSON files.

#### Changed
- **Batch blocking of IPs**
  - Original: Loops through each active IP and runs `ufw deny from "$ip"` immediately if not already blocked.
  - New: Collects all new active IPs per jail and executes `ufw deny from "$ip"` in one batch section before performing a single `ufw reload`.

- **UFW reload behavior**
  - Original: No explicit reload after blocking; relied on UFW to apply rules instantly.
  - New: Explicit `ufw reload` after all block actions are done to ensure all deny rules are active before proceeding.

- **Unblocking procedure**
  - Original: For each inactive IP:
    - Lists all matching UFW rules.
    - Deletes them immediately without reload between rules.
  - New: For each inactive IP:
    - Performs `ufw status numbered` before deletion to ensure correct rule numbering.
    - Deletes rules one-by-one **with reload after each deletion** to avoid numbering mismatches.

- **JSON update timing**
  - Original: Updates JSON and cleans inactive entries after processing each IP.
  - New: Updates and cleans JSON **once per jail** after all block/unblock actions are completed.

#### Unchanged
- Locking mechanism using `/tmp/{jail}.blocklist.lock` remains identical.
- Validation of prerequisites (`jq`, `ufw`).
- Ownership and permission setting (`chown www-data:www-data`, `chmod 644`).
- Logging format and verbosity remain compatible.

### Small Changes for Statistics in Header

small changes where made in the following files:
- `header.php` **History** visual Changes
- `fail2ban-logstats.php` **History** visual Changes
- `fail2ban-logstats.js` **History** visual Changes
- `index.php` **Sort** per IP
- `style.css` several small changes

### 🟡🔴 Warnings Feature - Changelog

#### New Features
- **IP Event Marker System**:  
  - Highlights IPs appearing multiple times with the same event (`Ban`/`Unban`) in the current view.
  - Highlights IPs present in multiple jails in the current view.
  - Visual markers:
    - 🟡 Yellow → Multiple same events
    - 🔴 Red → Appears in multiple jails
    - ⚪ Grey → No marker
- **Sortable & Filterable 'Mark' Column**:  
  - Added a new column `Mark` in the main result table.
  - Column is fully sortable like other columns.
  - Marker filter dropdown added to filter by marker type:
    - All
    - Yellow
    - Red
    - Yellow + Red
    - None
- **Dynamic Filtering**:
  - Markers update in real-time when filters (`Action`, `Jail`, `IP`, `Date`) are changed.
  - Table automatically updates to reflect filtered marker status.

#### UI Enhancements
- Marker column added between `Action` and `IP` for better visibility.
- Marker filter dropdown integrated into existing filters, maintaining logical order.
- Supports responsive layout using flexbox, keeping filters and buttons aligned.
- changed display time for ban unban and info messages to 7 seconds

#### Implementation Notes
- Marker calculation is based on the currently displayed dataset, not the full JSON.
- No changes to backend JSON structure are required; marker is computed client-side.
- Fully compatible with existing sort and filter system.


### ✨ New Feature: Copy Filtered Data to Clipboard

- **Added** a new "Copy to Clipboard" button to export the currently **filtered table data**.
- **Implemented** a dedicated JavaScript file `assets/js/table-export.js` for the copy functionality.
- **Integration** with existing DataTables filtering logic to ensure only visible/filtered rows are copied.
- **Output Format**: Tab-separated values (TSV) with all HTML tags removed for clean text export.
- **User Feedback**: 
  - Shows a warning if there’s no data to copy.
  - Shows a success or error alert based on the clipboard operation result.


### List of changed files

- firewall-update.sh
- index.php
- includes/unblock-ip.php
- includes/blocklist-stats.php
- includes/fail2ban-logstats.php
- includes/header.php
- includes/unblock-ip.php
- includes/warnings.php
- assets/css/style.css
- assets/js/fail2ban-logstats.js
- assets/js/jsonreader.js
- assets/js/table-export.js



---

## Changes made for V 0.3.4 (Fix)

Json Files should not loose Data anymore when several write processes trying to write the json file at the same time.

- `firewall-update.sh`: Added FLOCK to lock json when writing
- `block-ip.php`: Added FLOCK to lock json when writing
- `unblock-ip.php`: Added FLOCK to lock json when writing
- `blocklist-stats.php`: Shows now more correct States of active and pending when blocking and unblocking



## Changes made for V 0.3.3 (QoL Update)

- **Warning System and Pending Status Indicators**
  - `config.ini`: Added new `[Warnings]` section to configure thresholds for warning and critical levels (Events per minute per jail).
  - `includes/warnings.php`: New backend script that scans the latest event log for jails exceeding defined thresholds.
  - `assets/js/warnings.js`: New JavaScript file to fetch warning data and render status indicators in the header.
  - `includes/header.php`: Updated to include warning and critical indicators (colored dots and summary).
  - `assets/css/style.css`: Added "Warning Dots" section to style the new header indicators.
  - `includes/block-ip.php`: Now writes a `pending: true` flag when an IP is manually blocked.
  - `includes/unblock-ip.php`: Sets `pending: true` when an IP is manually unblocked.
  - `firewall-update.sh`: Automatically sets `pending: false` for processed entries during block/unblock operations.
  - `assets/js/blocklist-stats.js`: Updated to display pending entries for both block and unblock actions.


### Changelog: Multi-Selection UI and Backend Handling for Ban and Report Actions

### User Interface & Frontend Logic
- **`assets/js/jsonreader.js`**  
  - Changed from action buttons per row to checkboxes for multi-selection of IPs.  
  - Updated rendering logic to support checkbox inputs and bulk selection filtering.

- **`assets/js/action.js`**  
  - Listens on new "Ban" and "Report" buttons instead of old "Action!" buttons.  
  - Collects selected checkbox data and passes arrays of IPs and jails to action collector.

- **`index.php`**  
  - Replaced old checkboxes/buttons with dedicated "Ban" and "Report" buttons for bulk actions.

- **`assets/js/action-collector.js`**  
  - Refactored to accept arrays of IPs and corresponding jails for ban or report actions.  
  - Sends POST requests with multiple IPs to backend PHP endpoints.  
  - Displays notifications for each action with success/info/error styling.

- **`assets/js/notifications.js`** *(new)*  
  - Dedicated notification handling for displaying colored messages (success/info/error).  
  - Extracted from previous action.js notification code.

- **`includes/header.php`**  
  - Included `notifications.js` for notification display support.

### Backend Logic and API
- **`includes/actions/action_ban-ip.php`**  
  - Modified to accept arrays of IPs in POST data.  
  - Calls `blockIp()` for each IP separately, aggregates results.  
  - Returns combined messages with per-IP success, info, or error details.

- **`includes/block-ip.php`**  
  - Updated `blockIp()` function to accept either single IP or array of IPs.  
  - Reads and writes jail-specific blocklist JSON files (e.g. `ssh.blocklist.json`).  
  - Returns detailed results including a new `type` field (`success`, `info`, `error`) for better UI feedback.  
  - Differentiates already blocked IPs (info) vs newly blocked IPs (success).


- **`includes/actions/action_report-ip.php`**  
  - Refactored to support multi-IP reports while sending individual requests internally for each IP and each report service.  
  - Added API-friendly delay (`usleep(500000)`) between requests to avoid rate limits.  
  - Improved aggregation of results and messages with detailed per-IP, per-service data and overall success determination.  
  - Outputs combined JSON response with structured `results` array for frontend consumption.

- **`includes/actions/reports/abuseipdb.php`**  
  - No structural changes, but behavior benefits from backend delay to reduce API call frequency.  
  - Provides detailed report counts and dynamic message types (success, info, error) based on abuse report counts.

- **`includes/actions/reports/ipinfo.php`**  
  - New report integration for IPInfo API, fetching geolocation and network metadata for queried IPs.  
  - Returns informative messages including hostname, location (city, region, country), organization, and other IP details.  
  - Handles API errors and missing keys gracefully, providing clear error messages in JSON format.  
  - Used alongside AbuseIPDB for richer combined IP intelligence reports.  


- Improved error handling and message formatting for multi-IP operations.

---


## Changes made for V 0.3.2 (improvements)
> This update brings several improvements — blocklists are now separated by jail, marking another step towards better Fail2Ban integration.  
> Additionally, many new helpful statistics have been added to the header, along with a new jail filter in the blocklist overview.  
> As expected from a reporting tool, stats are essential, so i added some basic stats.


- **Blocklist per Jail Implementation**
  - The blocklist JSON files are now created and managed individually per Fail2Ban jail instead of using a single global `blocklist.json`.
    → New files like `sshd.blocklist.json`, `dovecot.blocklist.json`, `unknown.blocklist.json` are created automatically on demand.
  - This separation prevents blocklist files from growing too large and enables finer control and filtering by jail.

- **Blocklist Filtering UI Enhancement**
  - The blocklist overlay UI now supports filtering entries by one or multiple jails via a multi-select dropdown.
  - The search input matches IP and jail names simultaneously, combined with date filtering.
  - If an IP appears in multiple blocklists, all occurrences are shown to improve visibility.

- **Backend and Frontend Adjustments**
  - `includes/block-ip.php`: Enhanced to write to and manage jail-specific blocklist files.
  - `includes/get-blocklist.php`: Aggregates entries from all `.blocklist.json` files and returns a combined JSON to the frontend.
  - `includes/actions/action_ban-ip.php`: Passes the jail name along with the IP for correct blocklist assignment.
  - `assets/js/blocklist-overlay.js` (renamed from blocklist.js): Updated to handle multi-jail filtering and render aggregated blocklist data with filtering controls.
  - HTML updated with a multi-select `<select>` element for jail filtering in the overlay.

- **Benefits**
  - Improved scalability and organization of blocklist data.
  - Better user experience through intuitive filtering and visibility.
  - Clear separation of blocklists per Fail2Ban jail without complicating the user workflow.

- **Jail-Aware Unban System**
  - The unban process has been fully adapted to support per-jail blocklists (e.g. `sshd.blocklist.json`, `dovecot.blocklist.json`) instead of the previous global `blocklist.json`.
  - The function `unblockIp()` in `includes/unblock-ip.php` now accepts a second parameter `$jail` and determines the correct blocklist file based on the jail name.
    → The jail name is normalized to lowercase and used to locate the appropriate `*.blocklist.json` file.
  - Improved validation and error handling:
    - Returns a specific message if the jail-specific blocklist file is missing.
    - Detects if an IP was already inactive.
    - Ensures only the correct jail's blocklist is modified.
  - Updated `includes/actions/action_unban-ip.php` to:
    - Accept both `ip` and `jail` via POST.
    - Pass the jail parameter to `unblockIp()`.
    - Return meaningful JSON responses for success or failure.
  - Ensures compatibility with multi-jail environments and prepares for full UI integration of jail-specific unban operations.

- **firewall-update.sh Multi-Jail Support and Cleanup**
  - The firewall update script now processes all `*.blocklist.json` files inside the archive directory (e.g. `/opt/Fail2Ban-Report/archive/`), supporting per-jail blocklists.
  - IPs marked as `"active": false` are automatically removed from UFW firewall rules and then deleted from their respective JSON files to keep blocklists clean and manageable.
  - New IPs with `"active": true` are added to UFW if not already blocked.
  - The script ensures proper file ownership (`www-data`) and permissions (`644`) after each update.
  - Optional logging feature with timestamps can be enabled or disabled (default off).
  - Robust error handling for missing dependencies (`jq` or `ufw`) with clean exits and log messages.
  - Fully backward compatible with existing `.blocklist.json` files, requiring only configuration of the archive directory path.

- **Blocklist Stats Overview**
  - A new stats section was added to display a real-time overview of active and pending entries across all jail-specific blocklists (e.g. `sshd.blocklist.json`, `apache-auth.blocklist.json`).
  - Introduced backend script `includes/blocklist-stats.php`:
    - Scans all `*.blocklist.json` files in the `archive/` directory.
    - Extracts the jail name from the filename and counts `active = true` and `active = false` entries.
    - Returns a JSON structure like:
      ```json
      {
        "sshd": { "active": 12, "pending": 3 },
        "apache-auth": { "active": 5, "pending": 2 }
      }
      ```
  - Frontend integration:
    - Added a new stats block in the header next to existing Fail2Ban stats, showing per-jail active and pending counts.
    - Implemented JavaScript (`assets/js/blocklist-stats.js`) to fetch and render stats dynamically.
    - Blocklist Stats refresh automatically every 10 seconds.


- Extended Fail2Ban Statistics:
  - Backend (`includes/fail2ban-logstats.php`):
    - Enhanced JSON output to include aggregated event counts for yesterday, last 7 days, and last 30 days.
    - Aggregation performed by merging daily JSON event files based on file order (newest first), without relying on date functions.
    - Added structured JSON response with keys: `aggregated.yesterday`, `aggregated.last_7_days`, and `aggregated.last_30_days`.
  - Frontend (`assets/js/fail2ban-logstats.js`):
    - Updated JavaScript to fetch and display aggregated stats alongside today's stats.
    - Added dynamic population of new DOM elements showing event counts, bans, unbans, and unique IPs for the aggregated timeframes.
    - Gracefully handles errors and missing data for aggregated stats.


---

### [0.3.1] – 2025-08-05
- Fixed: Relative path error in `action_unban-ip.php` when accessing `blocklist.json`.  
  → Hotfixed @ 13:10 CEST directly in main.

> Improved security by ensuring all JSON data is accessed only via PHP proxies, preventing direct client-side access.

> Shell scripts (.sh) currently still read and write the .json files directly since these files are still inside the web directory — but this will change soon.
For version 0.3.1, I focus on a clear frontend/backend separation by proxying all JSON access through PHP.
Moving the archive/ directory out of the web root to increase security is planned for the next major step in version 0.4.1.

---

## Changes made for V 0.3.1

### ✨ New Features

- **Daily Log Processing**
  - The Bash script `fail2ban_log2json.sh` will now collect only events from the current date creating a daily JSON file: (still overwriting)
    → `archive/fail2ban-events-YYYYMMDD.json`  => (same naming – fully compatible)
  - Benefit: Smaller, cleaner files and no cross-day mixing
  - Enables future statistical analysis
 
- **Ministats in Header**
  - `includes/header.php` header updated with:
    - JS variable `statsFile` for today's JSON
    - New HTML block `#fail2ban-stats` inside header section
  - Stats are displayed neatly beside the page title (flex layout)
  - Stats only show the current dates stats
 
- **Favicon**
  - `assets/css/favicon-32x32.png` added to make browsers happy

- **Mobile Friendly**
  - site is now more mobile friendy by adding `<meta name="viewport" content="width=device-width, initial-scale=0.8">`

---

### 🔐 Security Improvement: Secure JSON Access for display of Data

- **Proxy Access via PHP Script**
  - Added `includes/get-json.php` as a secure proxy to serve JSON files
  - Only authorized PHP scripts deliver JSON content to frontend JS

- **Updated Frontend JSON Loading**
  - `assets/js/jsonreader.js` now fetches JSON data through `includes/get-json.php?file=...`
  - No more direct file URL requests to `/archive/`
 
- **New PHP Proxy Endpoint**
  - Added `includes/get-blocklist.php` as a secure server-side proxy to serve `blocklist.json` data
  - This prevents direct client-side access to the raw JSON file in `/archive/`

- **Updated JS Blocklist Overlay**
  - Modified `assets/js/blocklist-overlay.js` to fetch blocklist data exclusively via the new PHP endpoint (`includes/get-blocklist.php`)
  - Removed all direct `.json` file fetches from the JS code
  - UI behavior and filtering remain unchanged, ensuring seamless user experience

- **Security Improvement**
  - By decoupling the JS from direct `.json` access, the blocklist data is better protected from unauthorized or direct URL access

---

### 🛠 Modified or Added Files

- `fail2ban_log2json.sh`  
  → Now filters only for today's entries and structures JSON accordingly

- `includes/header.php`  
  → Injects `statsFile` JS variable and adds stats HTML section

- `includes/fail2ban-logstats.php`  
  → **NEW**: Reads daily JSON data for the frontent script `assets/js/fail2ban-logstats.js`

- `assets/js/fail2ban-logstats.js`  
  → **NEW**: Reads daily Stats from `includes/fail2ban-logstats.php` and injects them into the UI

- `assets/css/style.css`  
  → Added `.inline-headlines` flex layout and style adjustments for stats block

- `includes/get-json.php`  
  → New PHP proxy endpoint for serving JSON files securely

- `assets/js/jsonreader.js`  
  → Modified to fetch JSON data through the PHP proxy instead of direct file access

- `includes/get-blocklist.php`
→ New PHP proxy endpoint to securely serve the blocklist JSON data

- `assets/js/blocklist-overlay.js`
→ Modified to fetch blocklist data via the PHP proxy (get-blocklist.php) instead of accessing the JSON file directly

- `.htaccess`
→ Added "deny access" to archive/ by default

---