Episode 10: hardening - firewall rules Docker cannot bypass, Caddy access log and rate limiting, fail2ban in the right chain

- hardening/: ufw after.rules block for DOCKER-USER (ctorigdstport, not dport),
  fail2ban jail.local with sshd (systemd backend) and caddy-probes (chain DOCKER-USER),
  filter for the JSON access log, sshd hardening.conf, README with the order and
  the two traps measured in the episode
- caddy/Dockerfile: xcaddy build with caddy-ratelimit, compose builds the image
- Caddyfile: common snippet (JSON access log, Server header stripped), vault /admin 404,
  rate_limit zones on the vault token endpoint and the git login form
- HARDENING.md: firewall and fail2ban sections rewritten around what the port scan saw

Claude-Session: https://claude.ai/code/session_017iP581CYtPfxdZYPPAyWZA

compose.yml

@@ -58,7 +58,8 @@ volumes:
 
 services:
   caddy:
-    image: caddy:2-alpine
+    image: selfhostedops/caddy:ratelimit   # episode 10: own image with caddy-ratelimit
+    build: ./caddy
     restart: unless-stopped
     ports:
       - "80:80"
@@ -69,6 +70,7 @@ services:
       ACME_EMAIL: ${ACME_EMAIL}
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - ./logs/caddy:/var/log/caddy   # episode 10: JSON access log on the host for fail2ban
       - caddy_data:/data
       - caddy_config:/config
     networks: [proxy]