Add trusted IP and network management to Fail2Ban

[Vaso73]

Summary

Add a global trusted IP/network allowlist to the Fail2Ban section of the Monitor Security page. Administrators can add, edit, and remove IPv4, IPv6, or CIDR entries that Fail2Ban must never ban across the sshd, proxmox, and proxmenux jails.

Implementation

• persist managed entries in /etc/fail2ban/jail.d/99-proxmenux-ignore.local
• preserve legacy [DEFAULT] ignoreip values from /etc/fail2ban/jail.local on first use
• keep 127.0.0.0/8 and ::1 protected and non-removable
• validate and normalize IPv4, IPv6, and CIDR input with Python ipaddress
• reject invalid, /0, multicast, unspecified, duplicate, and already-covered entries
• write atomically, reload Fail2Ban, and restore the previous configuration if reload fails
• normalize IPv4-mapped client addresses and avoid offering loopback as the detected client IP
• expose authenticated GET/POST/PUT/DELETE API operations

UI

• trusted-address table aligned with the existing Firewall visual language
• distinct system/trusted and IP/CIDR badges
• add, edit, and delete actions with localized feedback
• clear warning about trusting an entire network
• KPI cards for protections, currently banned IPs, total bans, and failed attempts
• complete English and Slovak strings with English fallback through the existing i18n system

Validation

• python3 -m unittest scripts/tests/test_fail2ban_trusted_networks.py -q — 12 tests passed
• English/Slovak message parity — 3,632 leaf keys in each, no missing keys
• npm run build — passed
• live deployment on Proxmox test host — service active and main page HTTP 200
• verified the effective ignore list is identical in sshd, proxmox, and proxmenux
• manually verified add IP, edit IP to CIDR, persistence after refresh, delete, invalid input, protected loopback entries, and preservation of unrelated entries

Safety notes

The allowlist is global by design so an administrator cannot assume an address is trusted while one jail still bans it. Broad networks are allowed only after an explicit warning; /0 is rejected. Existing configuration is rolled back automatically when Fail2Ban rejects a reload.

[MacRimi]

@Vaso73 solid piece of work. A few things worth calling out:

• Atomic write + reload-with-rollback turns editing fail2ban from a "not
  today" operation into a normal one. That's the piece I would have asked
  for.
• Rejecting /0, multicast, unspecified, duplicates and already-covered
  entries covers the entire "I typoed myself out" class of mistakes.
• Global-by-design allowlist is the right call — same trust surface across
  all three jails or none.
• Preserving the legacy [DEFAULT] ignoreip on first use protects existing
  setups.

Reviewing shortly.