mirror of
https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin.git
synced 2026-07-21 11:38:59 +02:00
📝 55 feature clean readme doc (#70)
* 📝 Clean documentation in Readme * 📝 Update readme * 📝 Place exemples in seperated README * ⬆️ Update traefik to 2.9.6 and crowdsec to 1.4.3 in exemples * 📝 Add exemple at the right place
This commit is contained in:
mathieuHa
@@ -8,7 +8,7 @@
|
||||
|
||||
This plugin aims to implement a Crowdsec Bouncer in a traefik plugin.
|
||||
|
||||
> [CrowdSec](https://www.crowdsec.net/) is an open-source and collaborative IPS (Intrusion Prevention System) and a security suite.
|
||||
> [CrowdSec](https://www.crowdsec.net/) is an open-source and collaborative IPS (Intrusion Prevention System) and a security suite.
|
||||
> We leverage local behavior analysis and crowd power to build the largest CTI network in the world.
|
||||
|
||||
The purpose is to enable treafik to authorize or block requests from IPs based on their reputation and behavior.
|
||||
@@ -195,20 +195,20 @@ http:
|
||||
|
||||
#### Fill variable with value of file
|
||||
|
||||
`CrowdsecLapiTlsCertificateBouncerKey`, `CrowdsecLapiTlsCertificateBouncer`, `CrowdsecLapiTlsCertificateAuthority` and `CrowdsecLapiKey` can be provided with the content as raw or through a file path that Traefik can read.
|
||||
`CrowdsecLapiTlsCertificateBouncerKey`, `CrowdsecLapiTlsCertificateBouncer`, `CrowdsecLapiTlsCertificateAuthority` and `CrowdsecLapiKey` can be provided with the content as raw or through a file path that Traefik can read.
|
||||
The file variable will be used as preference if both content and file are provided for the same variable.
|
||||
|
||||
Format is:
|
||||
- Content: VariableName: XXX
|
||||
- File : VariableNameFILE: /path
|
||||
- File : VariableNameFile: /path
|
||||
|
||||
#### Authenticate with LAPI
|
||||
|
||||
You can authenticate to the LAPI either with LAPIKEY or by using client certificates.
|
||||
You can authenticate to the LAPI either with LAPIKEY or by using client certificates.
|
||||
Please see below for more details on each option.
|
||||
|
||||
#### Generate LAPI KEY
|
||||
You can generate a crowdsec API key for the LAPI.
|
||||
You can generate a crowdsec API key for the LAPI.
|
||||
You can follow the documentation here: https://docs.crowdsec.net/docs/user_guides/lapi_mgmt/
|
||||
|
||||
```bash
|
||||
@@ -241,15 +241,15 @@ docker-compose up -d
|
||||
|
||||
#### Use certificates to authenticate with CrowdSec
|
||||
|
||||
You can follow the example in exemples/tls-auth to view how to authenticate with client certificates with the LAPI.
|
||||
You can follow the example in `exemples/tls-auth` to view how to authenticate with client certificates with the LAPI.
|
||||
In that case communications with the LAPI must go through HTTPS.
|
||||
|
||||
A script is available to generate certificates in exemples/tls-auth/gencerts.sh and must be in the same directory as the inputs for the PKI creation.
|
||||
A script is available to generate certificates in `exemples/tls-auth/gencerts.sh` and must be in the same directory as the inputs for the PKI creation.
|
||||
|
||||
#### Use HTTPS to communicate with the LAPI
|
||||
|
||||
To communicate with the LAPI in HTTPS you need to either accept any certificates by setting the crowdsecLapiTLSInsecureVerify to true or add the CA used by the server certificate of Crowdsec using crowdsecLapiTLSCertificateAuthority or crowdsecLapiTLSCertificateAuthorityFile.
|
||||
Set the crowdsecLapiScheme to https.
|
||||
To communicate with the LAPI in HTTPS you need to either accept any certificates by setting the `crowdsecLapiTLSInsecureVerify` to true or add the CA used by the server certificate of Crowdsec using `crowdsecLapiTLSCertificateAuthority` or `crowdsecLapiTLSCertificateAuthorityFile`.
|
||||
Set the `crowdsecLapiScheme` to https.
|
||||
|
||||
Crowdsec must be listening in HTTPS for this to work.
|
||||
Please see the tls-auth exemple or the official documentation: [https://docs.crowdsec.net/docs/local_api/tls_auth/](https://docs.crowdsec.net/docs/local_api/tls_auth/)
|
||||
@@ -300,180 +300,23 @@ make run_local
|
||||
|
||||
1. Behind another proxy service (ex: clouflare)
|
||||
|
||||
You need to configure your Traefik to trust Forwarded headers by your front proxy
|
||||
In the example we use another instance of traefik with the container named cloudflare to simulate a front proxy
|
||||
|
||||
The "internal" Traefik instance is configured to trust the cloudflare forward headers
|
||||
This helps Traefik choose the right IP of the client: see https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers
|
||||
```yaml
|
||||
- "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
|
||||
```
|
||||
|
||||
We configure the middleware to trust as well the IP:
|
||||
```yaml
|
||||
- "traefik.http.middlewares.crowdsec1.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
|
||||
```
|
||||
|
||||
To play the demo environment run:
|
||||
```bash
|
||||
make run_behindproxy
|
||||
```
|
||||
A complete exemple is available in [exemples/behind-proxy/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/exemples/behind-proxy/README.md)
|
||||
|
||||
2. With Redis as an external shared cache
|
||||
|
||||
The plugin must be configured to connect to a redis instance
|
||||
```yaml
|
||||
redisCacheHost: "redis:6379"
|
||||
```
|
||||
Here **redis** is the hostname of a container located in the same network as Traefik and **6379** is the default port of redis
|
||||
|
||||
To play the demo environment run:
|
||||
```bash
|
||||
make run_cacheredis
|
||||
```
|
||||
A complete exemple is available in [exemples/redis-cache/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/exemples/redis-cache/README.md)
|
||||
|
||||
3. Using Trusted IP (ex: LAN OR VPN) that won't get filtered by crowdsec
|
||||
|
||||
You need to configure your Traefik to trust Forwarded headers by your front proxy
|
||||
In the example we use a whoami container protected by crowdsec, and we ban our IP before allowing using TrustedIPs
|
||||
|
||||
If you are using another proxy in front, you need to add its IP in the trusted IP for the forwarded headers.
|
||||
This helps Traefik choose the right IP of the client: see https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers
|
||||
The "internal" Traefik instance is configured to trust the forward headers
|
||||
```yaml
|
||||
- "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
|
||||
```
|
||||
|
||||
We configure the middleware to trust as well as the IP of the intermediate proxy if needed:
|
||||
```yaml
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
|
||||
```
|
||||
|
||||
Add your IP to the ban list
|
||||
```bash
|
||||
docker exec crowdsec cscli decisions add --ip 10.0.10.30 -d 10m
|
||||
```
|
||||
You should get a 403 on http://localhost/foo
|
||||
|
||||
> Replace *10.0.10.30* by your IP
|
||||
|
||||
Add the IPs that will not be filtered by the plugin
|
||||
```yaml
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.clientTrustedips=10.0.10.30/32"
|
||||
```
|
||||
|
||||
> Replace *10.0.10.30/32* by your IP or IP range, so it's not getting checked against ban cache of crowdsec
|
||||
|
||||
You should get a 200 on http://localhost/foo even if you are on the ban cache
|
||||
|
||||
To play the demo environment run:
|
||||
```bash
|
||||
make run_trustedips
|
||||
```
|
||||
A complete exemple is available in [exemples/trusted-ips/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/exemples/trusted-ips/README.md)
|
||||
|
||||
4. Using Crowdsec and Traefik installed as binary in a single VM
|
||||
|
||||
Please see details in `exemples/binary-vm/README.md`
|
||||
|
||||
To play the demo environment run:
|
||||
```bash
|
||||
make run_binaryvm
|
||||
```
|
||||
A complete exemple is available in [exemples/binary-vm/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/exemples/binary-vm/README.md)
|
||||
|
||||
5. Using https communication and tls authentication with Crowdsec
|
||||
|
||||
##### Summary
|
||||
This example demonstrates the use of https between the Traefik plugin and the Crowdsec LAPI.
|
||||
|
||||
It is possible to communicate with the LAPI in https and still authenticate with API key.
|
||||
You can add the client TLS certificate generated to authenticate without any Token in the plugin.
|
||||
|
||||
However, note that it is not possible to authenticate with TLS client certificate without https setup for the LAPI.
|
||||
|
||||
The example is detailed below and will be placed in the `examples/tls-auth/README.md` file.
|
||||
|
||||
##### Details
|
||||
|
||||
Simple HTTPS communication: It is possible to talk to Crowdsec LAPI which is configured with a self-signed certificate
|
||||
In that case the setting **crowdsecLapiTLSInsecureVerify** must be set to true.
|
||||
|
||||
It is recommended to validate the certificate presented by Crowdsec LAPI using the Certificate Authority which created it.
|
||||
|
||||
You can provide the Certificate Authority using:
|
||||
* A file path readable by Traefik
|
||||
```yaml
|
||||
http:
|
||||
middlewares:
|
||||
crowdsec:
|
||||
plugin:
|
||||
bouncer:
|
||||
crowdsecLapiTlsCertificateAuthorityFile: /etc/traefik/certs/crowdsecCA.pem
|
||||
```
|
||||
* The PEM encoded certificate as a text variable
|
||||
|
||||
In the static file configuration of Traefik
|
||||
```yaml
|
||||
http:
|
||||
middlewares:
|
||||
crowdsec:
|
||||
plugin:
|
||||
bouncer:
|
||||
crowdsecLapiTlsCertificateAuthority: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEBzCCAu+gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
|
||||
MRAwDgYDVQQHDAdTZWF0dGxlMRMwEQYDVQQIDApXYXNoaW5ndG9uMSIwIAYDVQQK
|
||||
...
|
||||
C6qNieSwcvWL7C03ri0DefTQMY54r5wP33QU5hJ71JoaZI3YTeT0Nf+NRL4hM++w
|
||||
Q0veeNzBQXg1f/JxfeA39IDIX1kiCf71tGlT
|
||||
-----END CERTIFICATE-----
|
||||
```
|
||||
In a dynamic configuration of a provider (ex docker) as a Label
|
||||
```yaml
|
||||
services:
|
||||
whoami-foo:
|
||||
image: traefik/whoami
|
||||
labels:
|
||||
- |
|
||||
traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdsecLapiTlsCertificateAuthority=
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEBzCCAu+gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
|
||||
MRAwDgYDVQQHDAdTZWF0dGxlMRMwEQYDVQQIDApXYXNoaW5ndG9uMSIwIAYDVQQK
|
||||
...
|
||||
C6qNieSwcvWL7C03ri0DefTQMY54r5wP33QU5hJ71JoaZI3YTeT0Nf+NRL4hM++w
|
||||
Q0veeNzBQXg1f/JxfeA39IDIX1kiCf71tGlT
|
||||
-----END CERTIFICATE-----
|
||||
```
|
||||
|
||||
The example tls-auth presents 2 services, foo and bar which comes with the bouncer.
|
||||
At startup, certificates are created in a shared docker volume by a sidecar container which exits after.
|
||||
|
||||
Traefik will use client and CA certificates.
|
||||
The Bouncer will use server and CA certificates.
|
||||
|
||||
The service `whoami-foo` will authenticate with an **API key** over HTTPS after verifying the server certificate with CA.
|
||||
The service `whoami-bar` will authenticate with a **client certificate** signed by the CA.
|
||||
|
||||
Access to a route that communicate via https and authenticate with API-key:
|
||||
```
|
||||
curl http://localhost:80/foo
|
||||
```
|
||||
Access to a route that communicate via https and authenticate with a client certificate:
|
||||
```
|
||||
curl http://localhost:80/bar
|
||||
```
|
||||
Access to the traefik dashboard
|
||||
```
|
||||
curl http://localhost:8080/dashboard/#/
|
||||
```
|
||||
|
||||
To play the demo environnement run:
|
||||
```bash
|
||||
make run_tlsauth
|
||||
```
|
||||
|
||||
Note:
|
||||
> This example is still in Beta and use a new version of Crowdsec (v1.4.3) at time of writing
|
||||
A functionnality has been disabled in Crowdsec in order to make the example work DISABLE_AGENT: "true"
|
||||
A complete exemple is available in [exemples/tls-auth/README.md](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/blob/main/exemples/tls-auth/README.md)
|
||||
|
||||
6. Using Crowdsec and Traefik in Kubernetes
|
||||
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
# Exemple
|
||||
## Behind another proxy service (ex: clouflare)
|
||||
|
||||
You need to configure your Traefik to trust Forwarded headers by your front proxy
|
||||
In the example we use another instance of traefik with the container named cloudflare to simulate a front proxy
|
||||
|
||||
The "internal" Traefik instance is configured to trust the cloudflare forward headers
|
||||
This helps Traefik choose the right IP of the client: see https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers
|
||||
```yaml
|
||||
- "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
|
||||
```
|
||||
|
||||
We configure the middleware to trust as well the IP:
|
||||
```yaml
|
||||
- "traefik.http.middlewares.crowdsec1.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
|
||||
```
|
||||
|
||||
To play the demo environment run:
|
||||
```bash
|
||||
make run_behindproxy
|
||||
```
|
||||
@@ -2,7 +2,7 @@ version: "3.8"
|
||||
|
||||
services:
|
||||
cloudflare:
|
||||
image: "traefik:v2.9.4"
|
||||
image: "traefik:v2.9.6"
|
||||
container_name: "cloudflare"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
@@ -22,7 +22,7 @@ services:
|
||||
- 8080:8080
|
||||
|
||||
traefik:
|
||||
image: "traefik:v2.9.4"
|
||||
image: "traefik:v2.9.6"
|
||||
container_name: "traefik"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
@@ -36,7 +36,7 @@ services:
|
||||
- "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.3"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.7"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- logs-traefik:/var/log/traefik
|
||||
@@ -88,7 +88,7 @@ services:
|
||||
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.4.1
|
||||
image: crowdsecurity/crowdsec:v1.4.3
|
||||
container_name: "crowdsec"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
|
||||
@@ -1,3 +1,5 @@
|
||||
# Exemple
|
||||
|
||||
### Install vagrant
|
||||
|
||||
##### On linux
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
DEBIAN_FRONTEND=noninteractive sudo apt-get update && sudo apt-get install wget -y
|
||||
# DEBIAN_FRONTEND=noninteractive sudo apt-get upgrade -y --assume-yes
|
||||
wget -O traefik.tar.gz "https://github.com/traefik/traefik/releases/download/v2.9.5/traefik_v2.9.5_linux_amd64.tar.gz"
|
||||
wget -O traefik.tar.gz "https://github.com/traefik/traefik/releases/download/v2.9.6/traefik_v2.9.6_linux_amd64.tar.gz"
|
||||
tar -zxvf traefik.tar.gz
|
||||
# inspired from https://gist.github.com/ubergesundheit/7c9d875befc2d7bfd0bf43d8b3862d85
|
||||
sudo mv ./traefik /usr/local/bin/
|
||||
|
||||
@@ -0,0 +1,13 @@
|
||||
# Exemple
|
||||
## With Redis as an external shared cache
|
||||
|
||||
The plugin must be configured to connect to a redis instance
|
||||
```yaml
|
||||
redisCacheHost: "redis:6379"
|
||||
```
|
||||
Here **redis** is the hostname of a container located in the same network as Traefik and **6379** is the default port of redis
|
||||
|
||||
To play the demo environment run:
|
||||
```bash
|
||||
make run_cacheredis
|
||||
```
|
||||
@@ -2,7 +2,7 @@ version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.9.4"
|
||||
image: "traefik:v2.9.6"
|
||||
container_name: "traefik"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
@@ -15,7 +15,7 @@ services:
|
||||
- "--entrypoints.web.address=:80"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.4"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.7"
|
||||
# - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
@@ -68,7 +68,7 @@ services:
|
||||
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.4.1
|
||||
image: crowdsecurity/crowdsec:v1.4.3
|
||||
container_name: "crowdsec"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
|
||||
@@ -0,0 +1,93 @@
|
||||
# Exemple
|
||||
## Using https communication and tls authentication with Crowdsec
|
||||
|
||||
##### Summary
|
||||
This example demonstrates the use of https between the Traefik plugin and the Crowdsec LAPI.
|
||||
|
||||
It is possible to communicate with the LAPI in https and still authenticate with API key.
|
||||
You can add the client TLS certificate generated to authenticate without any Token in the plugin.
|
||||
|
||||
However, note that it is not possible to authenticate with TLS client certificate without https setup for the LAPI.
|
||||
|
||||
##### Details
|
||||
|
||||
Simple HTTPS communication: It is possible to talk to Crowdsec LAPI which is configured with a self-signed certificate
|
||||
In that case the setting **crowdsecLapiTLSInsecureVerify** must be set to true.
|
||||
|
||||
It is recommended to validate the certificate presented by Crowdsec LAPI using the Certificate Authority which created it.
|
||||
|
||||
You can provide the Certificate Authority using:
|
||||
* A file path readable by Traefik
|
||||
```yaml
|
||||
http:
|
||||
middlewares:
|
||||
crowdsec:
|
||||
plugin:
|
||||
bouncer:
|
||||
crowdsecLapiTlsCertificateAuthorityFile: /etc/traefik/certs/crowdsecCA.pem
|
||||
```
|
||||
* The PEM encoded certificate as a text variable
|
||||
|
||||
In the static file configuration of Traefik
|
||||
```yaml
|
||||
http:
|
||||
middlewares:
|
||||
crowdsec:
|
||||
plugin:
|
||||
bouncer:
|
||||
crowdsecLapiTlsCertificateAuthority: |-
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEBzCCAu+gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
|
||||
MRAwDgYDVQQHDAdTZWF0dGxlMRMwEQYDVQQIDApXYXNoaW5ndG9uMSIwIAYDVQQK
|
||||
...
|
||||
C6qNieSwcvWL7C03ri0DefTQMY54r5wP33QU5hJ71JoaZI3YTeT0Nf+NRL4hM++w
|
||||
Q0veeNzBQXg1f/JxfeA39IDIX1kiCf71tGlT
|
||||
-----END CERTIFICATE-----
|
||||
```
|
||||
In a dynamic configuration of a provider (ex docker) as a Label
|
||||
```yaml
|
||||
services:
|
||||
whoami-foo:
|
||||
image: traefik/whoami
|
||||
labels:
|
||||
- |
|
||||
traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdsecLapiTlsCertificateAuthority=
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEBzCCAu+gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
|
||||
MRAwDgYDVQQHDAdTZWF0dGxlMRMwEQYDVQQIDApXYXNoaW5ndG9uMSIwIAYDVQQK
|
||||
...
|
||||
C6qNieSwcvWL7C03ri0DefTQMY54r5wP33QU5hJ71JoaZI3YTeT0Nf+NRL4hM++w
|
||||
Q0veeNzBQXg1f/JxfeA39IDIX1kiCf71tGlT
|
||||
-----END CERTIFICATE-----
|
||||
```
|
||||
|
||||
The example tls-auth presents 2 services, foo and bar which comes with the bouncer.
|
||||
At startup, certificates are created in a shared docker volume by a sidecar container which exits after.
|
||||
|
||||
Traefik will use client and CA certificates.
|
||||
The Bouncer will use server and CA certificates.
|
||||
|
||||
The service `whoami-foo` will authenticate with an **API key** over HTTPS after verifying the server certificate with CA.
|
||||
The service `whoami-bar` will authenticate with a **client certificate** signed by the CA.
|
||||
|
||||
Access to a route that communicate via https and authenticate with API-key:
|
||||
```
|
||||
curl http://localhost:80/foo
|
||||
```
|
||||
Access to a route that communicate via https and authenticate with a client certificate:
|
||||
```
|
||||
curl http://localhost:80/bar
|
||||
```
|
||||
Access to the traefik dashboard
|
||||
```
|
||||
curl http://localhost:8080/dashboard/#/
|
||||
```
|
||||
|
||||
To play the demo environnement run:
|
||||
```bash
|
||||
make run_tlsauth
|
||||
```
|
||||
|
||||
Note:
|
||||
> This example is still in Beta and use a new version of Crowdsec (v1.4.3) at time of writing
|
||||
A functionnality has been disabled in Crowdsec in order to make the example work DISABLE_AGENT: "true"
|
||||
@@ -15,7 +15,7 @@ services:
|
||||
- "--entrypoints.web.address=:80"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.6"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.7"
|
||||
# - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
|
||||
@@ -0,0 +1,39 @@
|
||||
# Exemple
|
||||
## Using Trusted IP (ex: LAN OR VPN) that won't get filtered by crowdsec
|
||||
|
||||
You need to configure your Traefik to trust Forwarded headers by your front proxy
|
||||
In the example we use a whoami container protected by crowdsec, and we ban our IP before allowing using TrustedIPs
|
||||
|
||||
If you are using another proxy in front, you need to add its IP in the trusted IP for the forwarded headers.
|
||||
This helps Traefik choose the right IP of the client: see https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers
|
||||
The "internal" Traefik instance is configured to trust the forward headers
|
||||
```yaml
|
||||
- "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
|
||||
```
|
||||
|
||||
We configure the middleware to trust as well as the IP of the intermediate proxy if needed:
|
||||
```yaml
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
|
||||
```
|
||||
|
||||
Add your IP to the ban list
|
||||
```bash
|
||||
docker exec crowdsec cscli decisions add --ip 10.0.10.30 -d 10m
|
||||
```
|
||||
You should get a 403 on http://localhost/foo
|
||||
|
||||
> Replace *10.0.10.30* by your IP
|
||||
|
||||
Add the IPs that will not be filtered by the plugin
|
||||
```yaml
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.clientTrustedips=10.0.10.30/32"
|
||||
```
|
||||
|
||||
> Replace *10.0.10.30/32* by your IP or IP range, so it's not getting checked against ban cache of crowdsec
|
||||
|
||||
You should get a 200 on http://localhost/foo even if you are on the ban cache
|
||||
|
||||
To play the demo environment run:
|
||||
```bash
|
||||
make run_trustedips
|
||||
```
|
||||
@@ -2,7 +2,7 @@ version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.9.4"
|
||||
image: "traefik:v2.9.6"
|
||||
container_name: "traefik"
|
||||
restart: unless-stopped
|
||||
command:
|
||||
@@ -15,7 +15,7 @@ services:
|
||||
- "--entrypoints.web.address=:80"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.3"
|
||||
- "--experimental.plugins.bouncer.version=v1.1.7"
|
||||
# - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
@@ -69,7 +69,7 @@ services:
|
||||
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.4.1
|
||||
image: crowdsecurity/crowdsec:v1.4.3
|
||||
container_name: "crowdsec"
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
|
||||
Reference in New Issue
Block a user