From 4843b86b45274cb21067d13bd579bce4feb9c1b6 Mon Sep 17 00:00:00 2001 From: Max Lerebourg Date: Thu, 29 Sep 2022 07:19:36 +0200 Subject: [PATCH] fix readme --- .traefik.yml | 5 ++-- README.md | 25 ++++++++++--------- docker-compose-local.yml | 54 ---------------------------------------- docker-compose.yml | 3 ++- 4 files changed, 17 insertions(+), 70 deletions(-) delete mode 100644 docker-compose-local.yml diff --git a/.traefik.yml b/.traefik.yml index 5f29052..6362443 100644 --- a/.traefik.yml +++ b/.traefik.yml @@ -7,7 +7,6 @@ import: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin summary: 'Crowdsec Bouncer Traefik Plugin' testData: - bouncer: - enabled: true - crowdsecLapiKey: 40796d93c2958f9e58345514e67740e5 + enabled: false + crowdsecLapiKey: 40796d93c2958f9e58345514e67740e5 diff --git a/README.md b/README.md index b43c078..39da318 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ The crowdsec utility will provide the community blocklist which contains highly When used with crowdsec it will leverage the local API which will analyze traefik logs and take decisions on the requests made by users/bots. Malicious actors will be banned based on patterns against your website. -There is 3 operating mode for this plugin: +There are 3 operating modes (CrowdsecMode) for this plugin: - none -> If the client IP is on ban list, it will get a http code 403 response. Otherwise, request will continue as usual. All request call the Crowdsec LAPI @@ -42,7 +42,7 @@ The following declaration (given here in YAML) defines a plugin: # Static configuration experimental: - localPlugins: + plugins: bouncer: moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin ``` @@ -58,7 +58,7 @@ http: entryPoints: - web middlewares: - - my-plugin + - crowdsec services: service-foo: @@ -70,14 +70,15 @@ http: crowdsec: plugin: bouncer: - enabled: true - crowdseclapikey: 40796d93c2958f9e58345514e67740e5 + enabled: false + crowdsecLapiKey: privateKey + crowdsecLapiHost: crowdsec:8080 + crowdsecLapiScheme: http + crowdsecMode: stream updateIntervalSeconds: 60 defaultDecisionSeconds: 60 - crowdsecLapiHost: - crowdsecLapiScheme: - crowdsecMode: stream ``` +Except for the crowdsecLapiKey, these are the default value of the plugin. ### Local Mode @@ -103,10 +104,10 @@ The source code of the plugin should be organized as follows: └── vendor/* ``` -For local developpement a docker-compose-local.yml is provided and reproduce the directory layout needed by traefik. This works once you have generated and filled your LAPI-KEY, if not look below for informations +For local developpement a docker-compose.local.yml is provided and reproduce the directory layout needed by traefik. This works once you have generated and filled your LAPI-KEY (crowdsecLapiKey), if not look below for informations ```bash -docker-compose -f docker-compose-local.yml up -d +docker-compose -f docker-compose.local.yml up -d ``` #### Generate LAPI-KEY @@ -114,8 +115,8 @@ You need to generate a crowdsec API key for the LAPI. You can follow the documentation here: https://docs.crowdsec.net/docs/user_guides/lapi_mgmt/ ```bash -docker-compose -f docker-compose-local.yml up -d crowdsec -docker exec crowdsec cscli bouncers add crowdsecBouncer +docker-compose -f docker-compose.local.yml up -d crowdsec +docker exec crowdsec cscli bouncers add TRAEFIK ``` This LApi key must be set where is noted FIXME-LAPI-KEY in the docker-compose-test.yml diff --git a/docker-compose-local.yml b/docker-compose-local.yml deleted file mode 100644 index 7ed880c..0000000 --- a/docker-compose-local.yml +++ /dev/null @@ -1,54 +0,0 @@ -version: "3.8" - -services: - traefik: - image: "traefik:v2.8.7" - container_name: "traefik" - command: - # - "--log.level=DEBUG" - - "--accesslog" - - "--accesslog.filepath=/var/log/traefik/traefik.log" - - "--api.insecure=true" - - "--providers.docker=true" - - "--providers.docker.exposedbydefault=false" - - "--entrypoints.web.address=:80" - - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" - volumes: - - "/var/run/docker.sock:/var/run/docker.sock:ro" - - "logs:/var/log/traefik" - - ./:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin - ports: - - 8000:80 - - 8080:8080 - - whoami: - image: traefik/whoami - container_name: "simple-service" - labels: - - "traefik.enable=true" - - "traefik.http.routers.whoami.rule=Host(`localhost`)" - - "traefik.http.routers.whoami.entrypoints=web" - - "traefik.http.routers.whoami.middlewares=crowdsec@docker" - - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true" - - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY" - - crowdsec: - image: crowdsecurity/crowdsec:v1.4.1 - container_name: "crowdsec" - command: rm -rf /etc/crowdsec/acquis.yaml - environment: - COLLECTIONS: crowdsecurity/traefik - CUSTOM_HOSTNAME: crowdsec - BOUNCER_KEY_TRAEFIK: FIXME-LAPI-KEY - depends_on: - - 'traefik' - volumes: - - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro - - logs:/var/log/traefik:ro - - crowdsec-db:/var/lib/crowdsec/data/ - - crowdsec-config:/etc/crowdsec/ - -volumes: - logs: - crowdsec-db: - crowdsec-config: \ No newline at end of file diff --git a/docker-compose.yml b/docker-compose.yml index 919f567..f52fb7c 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -12,7 +12,8 @@ services: - "--providers.docker=true" - "--providers.docker.exposedbydefault=false" - "--entrypoints.web.address=:80" - - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" + + - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" volumes: - "/var/run/docker.sock:/var/run/docker.sock:ro" - "logs:/var/log/traefik"