Security Hardening: Proaktive Kontosperren, Fail2Ban-Integration, SecurityLogger, Alerting und API-Schutz

sql/schema.sql

@@ -14,11 +14,14 @@ CREATE TABLE IF NOT EXISTS dc_users (
   role ENUM('admin','installer') NOT NULL DEFAULT 'admin',
   last_login_at DATETIME NULL,
   disabled TINYINT(1) NOT NULL DEFAULT 0,
+  failed_login_count INT NOT NULL DEFAULT 0,
+  locked_until DATETIME NULL,
   -- Vorgesehen, aber noch nicht ausgewertet: es gibt bislang keine
   -- TOTP-Pruefung im Anmeldeweg.
   totp_secret VARCHAR(64) NULL,
   created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  KEY ix_users_role (role)
+  KEY ix_users_role (role),
+  KEY ix_users_locked (locked_until)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
 CREATE TABLE IF NOT EXISTS dc_settings (
@@ -26,6 +29,15 @@ CREATE TABLE IF NOT EXISTS dc_settings (
   svalue TEXT NOT NULL
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
+CREATE TABLE IF NOT EXISTS dc_rate_limits (
+  ip            VARBINARY(16) NOT NULL,
+  bucket        VARCHAR(64)   NOT NULL DEFAULT 'default',
+  window_start  DATETIME      NOT NULL,
+  request_count INT           NOT NULL DEFAULT 1,
+  PRIMARY KEY (ip, bucket, window_start),
+  KEY ix_rate_limits_window (window_start)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
 -- Core Projects Table (Shared across Lizenzen, Watchdog, UpdateService)
 CREATE TABLE IF NOT EXISTS dc_projects (
   id INT AUTO_INCREMENT PRIMARY KEY,