From b3a25eda9ff2d1e0e79640f6d769f366d8a3d654 Mon Sep 17 00:00:00 2001
From: Viren070 <viren070@protonmail.com>
Date: Tue, 15 Jul 2025 16:53:24 +0100
Subject: [PATCH] feat: add crowdsec

---
 apps/crowdsec/.env               |  5 +++++
 apps/crowdsec/compose.yaml       | 34 ++++++++++++++++++++++++++++++++
 apps/crowdsec/config/acquis.yaml | 11 +++++++++++
 apps/traefik/compose.yaml        | 17 ++++++++++++++++
 compose.yaml                     |  1 +
 5 files changed, 68 insertions(+)
 create mode 100644 apps/crowdsec/.env
 create mode 100644 apps/crowdsec/compose.yaml
 create mode 100644 apps/crowdsec/config/acquis.yaml

diff --git a/apps/crowdsec/.env b/apps/crowdsec/.env
new file mode 100644
index 0000000..831f435
--- /dev/null
+++ b/apps/crowdsec/.env
@@ -0,0 +1,5 @@
+# Generate a key using the following command:
+# echo "$(openssl rand -base64 64 | tr -d '=/' | tr -d '\n')"
+CROWDSEC_LAPI_KEY=
+
+# Make sure to uncomment the related lines in TRAEFIK's compose.yaml, including the depends_on crowdsec condition.
\ No newline at end of file
diff --git a/apps/crowdsec/compose.yaml b/apps/crowdsec/compose.yaml
new file mode 100644
index 0000000..c792aad
--- /dev/null
+++ b/apps/crowdsec/compose.yaml
@@ -0,0 +1,34 @@
+services:
+  crowdsec:
+    image: crowdsecurity/crowdsec
+    restart: unless-stopped
+    container_name: crowdsec
+    ports:
+      - 8080
+      - 7422
+    environment:
+      COLLECTIONS: "crowdsecurity/traefik crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules crowdsecurity/appsec-crs crowdsecurity/http-cve crowdsecurity/base-http-scenarios crowdsecurity/sshd"
+      CUSTOM_HOSTNAME: "crowdsec"
+      GID: "${PGID}"
+      BOUNCER_KEY_TRAEFIK: "${CROWDSEC_LAPI_KEY}"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.logLevel=debug"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=${CROWDSEC_LAPI_KEY}"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecappsecenabled=true"
+    volumes:
+      - ${DOCKER_DATA_DIR}/traefik:/var/log/traefik:ro
+      - ${DOCKER_DATA_DIR}/crowdsec:/var/lib/crowdsec/data/
+      - ./config:/etc/crowdsec/
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    healthcheck:
+      test: ["CMD", "cscli", "version"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+    profiles:
+      - crowdsec
+      - all
+  
diff --git a/apps/crowdsec/config/acquis.yaml b/apps/crowdsec/config/acquis.yaml
new file mode 100644
index 0000000..5dae17a
--- /dev/null
+++ b/apps/crowdsec/config/acquis.yaml
@@ -0,0 +1,11 @@
+filenames:
+  - /var/log/traefik/access.log
+labels:
+  type: traefik
+---
+listen_addr: 0.0.0.0:7422
+appsec_config: crowdsecurity/virtual-patching
+name: myAppSecComponent
+source: appsec
+labels:
+  type: appsec
\ No newline at end of file
diff --git a/apps/traefik/compose.yaml b/apps/traefik/compose.yaml
index 8c992c2..9537a90 100644
--- a/apps/traefik/compose.yaml
+++ b/apps/traefik/compose.yaml
@@ -18,6 +18,10 @@ services:
       - '--global.checkNewVersion=false'
       - '--log=true'
       - "--log.level=INFO"
+      - '--accesslog=true'
+      - "--accesslog.filepath=/data/access.log"
+      - "--accesslog.bufferingsize=100"
+      - "--accesslog.fields.names.StartUTC=drop"
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
       - "--providers.docker.network=${DOCKER_NETWORK?}"
@@ -40,11 +44,21 @@ services:
       - "--entryPoints.websecure.proxyProtocol.insecure=false"
       - "--entryPoints.websecure.forwardedHeaders.trustedIPs=${TRUSTED_IPS}"
       - "--entryPoints.websecure.proxyProtocol.trustedIPs=${TRUSTED_IPS}"
+      # If you dont mind applying crowdsec to all routers, just uncomment the line below
+      # - "--entryPoints.websecure.http.middlewares=crowdsec@docker"
+      # You can instead choose to add it to specific routers only
+      # e.g. in a service's labels: (dont uncomment the line below)
+      # - "traefik.http.routers.myservice.middlewares=crowdsec@docker
+
 
       - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
       - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL?}"
       - "--certificatesresolvers.letsencrypt.acme.storage=/data/acme.json"
       - "--certificatesresolvers.letsencrypt.acme.caserver=${LE_CA_SERVER?}"
+
+      # Uncomment when using crowdsec
+      # - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+      # - "--experimental.plugins.bouncer.version=v1.3.0"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock"
       - "${DOCKER_DATA_DIR}/traefik:/data"
@@ -63,6 +77,9 @@ services:
     depends_on:
       authelia:
         condition: service_healthy
+      # Uncomment when using crowdsec
+      # crowdsec:
+      #   condition: service_healthy
     profiles:
       - traefik
       - required
diff --git a/compose.yaml b/compose.yaml
index 70e89dc..96df917 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -16,6 +16,7 @@ include:
   - apps/byparr/compose.yaml
   - apps/cloudflare-ddns/compose.yaml
   - apps/comet/compose.yaml
+  - apps/crowdsec/compose.yaml
   - apps/dash/compose.yaml
   - apps/decypharr/compose.yaml
   - apps/dockge/compose.yaml