feat: add crowdsec

apps/crowdsec/.env

@@ -0,0 +1,5 @@
+# Generate a key using the following command:
+# echo "$(openssl rand -base64 64 | tr -d '=/' | tr -d '\n')"
+CROWDSEC_LAPI_KEY=
+
+# Make sure to uncomment the related lines in TRAEFIK's compose.yaml, including the depends_on crowdsec condition.

apps/crowdsec/compose.yaml

@@ -0,0 +1,34 @@
+services:
+  crowdsec:
+    image: crowdsecurity/crowdsec
+    restart: unless-stopped
+    container_name: crowdsec
+    ports:
+      - 8080
+      - 7422
+    environment:
+      COLLECTIONS: "crowdsecurity/traefik crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules crowdsecurity/appsec-crs crowdsecurity/http-cve crowdsecurity/base-http-scenarios crowdsecurity/sshd"
+      CUSTOM_HOSTNAME: "crowdsec"
+      GID: "${PGID}"
+      BOUNCER_KEY_TRAEFIK: "${CROWDSEC_LAPI_KEY}"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.logLevel=debug"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=${CROWDSEC_LAPI_KEY}"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecappsecenabled=true"
+    volumes:
+      - ${DOCKER_DATA_DIR}/traefik:/var/log/traefik:ro
+      - ${DOCKER_DATA_DIR}/crowdsec:/var/lib/crowdsec/data/
+      - ./config:/etc/crowdsec/
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    healthcheck:
+      test: ["CMD", "cscli", "version"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+    profiles:
+      - crowdsec
+      - all
+  

apps/crowdsec/config/acquis.yaml

@@ -0,0 +1,11 @@
+filenames:
+  - /var/log/traefik/access.log
+labels:
+  type: traefik
+---
+listen_addr: 0.0.0.0:7422
+appsec_config: crowdsecurity/virtual-patching
+name: myAppSecComponent
+source: appsec
+labels:
+  type: appsec

apps/traefik/compose.yaml

@@ -18,6 +18,10 @@ services:
       - '--global.checkNewVersion=false'
       - '--log=true'
       - "--log.level=INFO"
+      - '--accesslog=true'
+      - "--accesslog.filepath=/data/access.log"
+      - "--accesslog.bufferingsize=100"
+      - "--accesslog.fields.names.StartUTC=drop"
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
       - "--providers.docker.network=${DOCKER_NETWORK?}"
@@ -40,11 +44,21 @@ services:
       - "--entryPoints.websecure.proxyProtocol.insecure=false"
       - "--entryPoints.websecure.forwardedHeaders.trustedIPs=${TRUSTED_IPS}"
       - "--entryPoints.websecure.proxyProtocol.trustedIPs=${TRUSTED_IPS}"
+      # If you dont mind applying crowdsec to all routers, just uncomment the line below
+      # - "--entryPoints.websecure.http.middlewares=crowdsec@docker"
+      # You can instead choose to add it to specific routers only
+      # e.g. in a service's labels: (dont uncomment the line below)
+      # - "traefik.http.routers.myservice.middlewares=crowdsec@docker
+
 
       - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
       - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL?}"
       - "--certificatesresolvers.letsencrypt.acme.storage=/data/acme.json"
       - "--certificatesresolvers.letsencrypt.acme.caserver=${LE_CA_SERVER?}"
+
+      # Uncomment when using crowdsec
+      # - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+      # - "--experimental.plugins.bouncer.version=v1.3.0"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock"
       - "${DOCKER_DATA_DIR}/traefik:/data"
@@ -63,6 +77,9 @@ services:
     depends_on:
       authelia:
         condition: service_healthy
+      # Uncomment when using crowdsec
+      # crowdsec:
+      #   condition: service_healthy
     profiles:
       - traefik
       - required