mirror of
https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin.git
synced 2026-07-21 11:38:59 +02:00
fix readme
This commit is contained in:
+1
-2
@@ -7,7 +7,6 @@ import: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
|||||||
summary: 'Crowdsec Bouncer Traefik Plugin'
|
summary: 'Crowdsec Bouncer Traefik Plugin'
|
||||||
|
|
||||||
testData:
|
testData:
|
||||||
bouncer:
|
enabled: false
|
||||||
enabled: true
|
|
||||||
crowdsecLapiKey: 40796d93c2958f9e58345514e67740e5
|
crowdsecLapiKey: 40796d93c2958f9e58345514e67740e5
|
||||||
|
|
||||||
|
|||||||
@@ -12,7 +12,7 @@ The crowdsec utility will provide the community blocklist which contains highly
|
|||||||
|
|
||||||
When used with crowdsec it will leverage the local API which will analyze traefik logs and take decisions on the requests made by users/bots. Malicious actors will be banned based on patterns against your website.
|
When used with crowdsec it will leverage the local API which will analyze traefik logs and take decisions on the requests made by users/bots. Malicious actors will be banned based on patterns against your website.
|
||||||
|
|
||||||
There is 3 operating mode for this plugin:
|
There are 3 operating modes (CrowdsecMode) for this plugin:
|
||||||
- none -> If the client IP is on ban list, it will get a http code 403 response.
|
- none -> If the client IP is on ban list, it will get a http code 403 response.
|
||||||
Otherwise, request will continue as usual. All request call the Crowdsec LAPI
|
Otherwise, request will continue as usual. All request call the Crowdsec LAPI
|
||||||
|
|
||||||
@@ -42,7 +42,7 @@ The following declaration (given here in YAML) defines a plugin:
|
|||||||
# Static configuration
|
# Static configuration
|
||||||
|
|
||||||
experimental:
|
experimental:
|
||||||
localPlugins:
|
plugins:
|
||||||
bouncer:
|
bouncer:
|
||||||
moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||||
```
|
```
|
||||||
@@ -58,7 +58,7 @@ http:
|
|||||||
entryPoints:
|
entryPoints:
|
||||||
- web
|
- web
|
||||||
middlewares:
|
middlewares:
|
||||||
- my-plugin
|
- crowdsec
|
||||||
|
|
||||||
services:
|
services:
|
||||||
service-foo:
|
service-foo:
|
||||||
@@ -70,14 +70,15 @@ http:
|
|||||||
crowdsec:
|
crowdsec:
|
||||||
plugin:
|
plugin:
|
||||||
bouncer:
|
bouncer:
|
||||||
enabled: true
|
enabled: false
|
||||||
crowdseclapikey: 40796d93c2958f9e58345514e67740e5
|
crowdsecLapiKey: privateKey
|
||||||
|
crowdsecLapiHost: crowdsec:8080
|
||||||
|
crowdsecLapiScheme: http
|
||||||
|
crowdsecMode: stream
|
||||||
updateIntervalSeconds: 60
|
updateIntervalSeconds: 60
|
||||||
defaultDecisionSeconds: 60
|
defaultDecisionSeconds: 60
|
||||||
crowdsecLapiHost:
|
|
||||||
crowdsecLapiScheme:
|
|
||||||
crowdsecMode: stream
|
|
||||||
```
|
```
|
||||||
|
Except for the crowdsecLapiKey, these are the default value of the plugin.
|
||||||
|
|
||||||
### Local Mode
|
### Local Mode
|
||||||
|
|
||||||
@@ -103,10 +104,10 @@ The source code of the plugin should be organized as follows:
|
|||||||
└── vendor/*
|
└── vendor/*
|
||||||
```
|
```
|
||||||
|
|
||||||
For local developpement a docker-compose-local.yml is provided and reproduce the directory layout needed by traefik. This works once you have generated and filled your LAPI-KEY, if not look below for informations
|
For local developpement a docker-compose.local.yml is provided and reproduce the directory layout needed by traefik. This works once you have generated and filled your LAPI-KEY (crowdsecLapiKey), if not look below for informations
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
docker-compose -f docker-compose-local.yml up -d
|
docker-compose -f docker-compose.local.yml up -d
|
||||||
```
|
```
|
||||||
|
|
||||||
#### Generate LAPI-KEY
|
#### Generate LAPI-KEY
|
||||||
@@ -114,8 +115,8 @@ You need to generate a crowdsec API key for the LAPI.
|
|||||||
You can follow the documentation here: https://docs.crowdsec.net/docs/user_guides/lapi_mgmt/
|
You can follow the documentation here: https://docs.crowdsec.net/docs/user_guides/lapi_mgmt/
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
docker-compose -f docker-compose-local.yml up -d crowdsec
|
docker-compose -f docker-compose.local.yml up -d crowdsec
|
||||||
docker exec crowdsec cscli bouncers add crowdsecBouncer
|
docker exec crowdsec cscli bouncers add TRAEFIK
|
||||||
```
|
```
|
||||||
|
|
||||||
This LApi key must be set where is noted FIXME-LAPI-KEY in the docker-compose-test.yml
|
This LApi key must be set where is noted FIXME-LAPI-KEY in the docker-compose-test.yml
|
||||||
|
|||||||
@@ -1,54 +0,0 @@
|
|||||||
version: "3.8"
|
|
||||||
|
|
||||||
services:
|
|
||||||
traefik:
|
|
||||||
image: "traefik:v2.8.7"
|
|
||||||
container_name: "traefik"
|
|
||||||
command:
|
|
||||||
# - "--log.level=DEBUG"
|
|
||||||
- "--accesslog"
|
|
||||||
- "--accesslog.filepath=/var/log/traefik/traefik.log"
|
|
||||||
- "--api.insecure=true"
|
|
||||||
- "--providers.docker=true"
|
|
||||||
- "--providers.docker.exposedbydefault=false"
|
|
||||||
- "--entrypoints.web.address=:80"
|
|
||||||
- "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
|
||||||
volumes:
|
|
||||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
|
||||||
- "logs:/var/log/traefik"
|
|
||||||
- ./:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
|
||||||
ports:
|
|
||||||
- 8000:80
|
|
||||||
- 8080:8080
|
|
||||||
|
|
||||||
whoami:
|
|
||||||
image: traefik/whoami
|
|
||||||
container_name: "simple-service"
|
|
||||||
labels:
|
|
||||||
- "traefik.enable=true"
|
|
||||||
- "traefik.http.routers.whoami.rule=Host(`localhost`)"
|
|
||||||
- "traefik.http.routers.whoami.entrypoints=web"
|
|
||||||
- "traefik.http.routers.whoami.middlewares=crowdsec@docker"
|
|
||||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
|
||||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY"
|
|
||||||
|
|
||||||
crowdsec:
|
|
||||||
image: crowdsecurity/crowdsec:v1.4.1
|
|
||||||
container_name: "crowdsec"
|
|
||||||
command: rm -rf /etc/crowdsec/acquis.yaml
|
|
||||||
environment:
|
|
||||||
COLLECTIONS: crowdsecurity/traefik
|
|
||||||
CUSTOM_HOSTNAME: crowdsec
|
|
||||||
BOUNCER_KEY_TRAEFIK: FIXME-LAPI-KEY
|
|
||||||
depends_on:
|
|
||||||
- 'traefik'
|
|
||||||
volumes:
|
|
||||||
- ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
|
|
||||||
- logs:/var/log/traefik:ro
|
|
||||||
- crowdsec-db:/var/lib/crowdsec/data/
|
|
||||||
- crowdsec-config:/etc/crowdsec/
|
|
||||||
|
|
||||||
volumes:
|
|
||||||
logs:
|
|
||||||
crowdsec-db:
|
|
||||||
crowdsec-config:
|
|
||||||
+2
-1
@@ -12,7 +12,8 @@ services:
|
|||||||
- "--providers.docker=true"
|
- "--providers.docker=true"
|
||||||
- "--providers.docker.exposedbydefault=false"
|
- "--providers.docker.exposedbydefault=false"
|
||||||
- "--entrypoints.web.address=:80"
|
- "--entrypoints.web.address=:80"
|
||||||
- "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
|
||||||
|
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||||
volumes:
|
volumes:
|
||||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||||
- "logs:/var/log/traefik"
|
- "logs:/var/log/traefik"
|
||||||
|
|||||||
Reference in New Issue
Block a user