mirror of
https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin.git
synced 2026-07-21 11:38:59 +02:00
Update Readme and docker-compose files with docs
This commit is contained in:
MathieuHa
@@ -23,12 +23,22 @@ There are 4 operating modes (CrowdsecMode) for this plugin:
|
||||
| none | If the client IP is on ban list, it will get a http code 403 response. Otherwise, request will continue as usual. All request call the Crowdsec LAPI |
|
||||
| live | If the client IP is on ban list, it will get a http code 403 response. Otherwise, request will continue as usual. The bouncer can leverage use of a local cache in order to reduce the number of requests made to the Crowdsec LAPI. It will keep in cache the status for each IP that makes queries. |
|
||||
| stream | Stream Streaming mode allows you to keep in the local cache only the Banned IPs, every requests that does not hit the cache is authorized. Every minute, the cache is updated with news from the Crowdsec LAPI. |
|
||||
| alone | Streaming mode but the blacklisted IPs are fetched on the CAPI. Every 2 hours, the cache is updated with news from the Crowdsec CAPI.|
|
||||
| alone | Standalone mode, similar to the streaming mode but the blacklisted IPs are fetched on the CAPI. Every 2 hours, the cache is updated with news from the Crowdsec CAPI. It does not include any localy banned IP, but can work without a crowdsec service|
|
||||
|
||||
The recommanded mode for performance is the streaming mode, decisions are updated every 60 sec by default and that's the only communication between traefik and crowdsec. Every requests that happens hits the cache for quick decisions.
|
||||
|
||||
## Usage
|
||||
|
||||
### Note
|
||||
Each middleware in traefik has it's own data and is instanciated by service.
|
||||
This means if there are 10 services protected by the bouncer in streaming alone or live mode, the cache will be duplicated to all 10 services.
|
||||
This is because traefik does not allow plugins to store data locally that can be consummed.
|
||||
|
||||
The synchronisation with the crowdsec service will happen also 10 times in the period selected.
|
||||
It should be taken into account when fixing this period so each middleware has time to sync data from crowdsec.
|
||||
|
||||
At each start of synchronisation, the middleware will wait a random number of seconds to avoid simultaneous calls to crowdsec.
|
||||
|
||||
### Variables
|
||||
- Enabled
|
||||
- bool
|
||||
@@ -45,7 +55,7 @@ The recommanded mode for performance is the streaming mode, decisions are update
|
||||
- Crowdsec LAPI available on which host.
|
||||
- CrowdsecLapiKey
|
||||
- string
|
||||
- Crowdsec LAPI generated key for the bouncer.
|
||||
- Crowdsec LAPI generated key for the bouncer : **must be unique by service**.
|
||||
- CrowdsecCapiLogin
|
||||
- string
|
||||
- Used only in `alone` mode, login for Crowdsec CAPI
|
||||
|
||||
+29
-16
@@ -2,7 +2,7 @@ version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.8.7"
|
||||
image: "traefik:v2.8.8"
|
||||
container_name: "traefik"
|
||||
command:
|
||||
# - "--log.level=DEBUG"
|
||||
@@ -16,7 +16,7 @@ services:
|
||||
- "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- logs:/var/log/traefik
|
||||
- logs-local:/var/log/traefik
|
||||
- ./:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
@@ -36,35 +36,48 @@ services:
|
||||
container_name: "simple-service1"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.whoami.rule=Host(`localhost`)"
|
||||
- "traefik.http.routers.whoami.entrypoints=web"
|
||||
- "traefik.http.routers.whoami.middlewares=crowdsec@docker"
|
||||
- "traefik.http.services.whoami.loadbalancer.server.port=80"
|
||||
# Definition of the router
|
||||
- "traefik.http.routers.router1.rule=Host(`localhost`) && Path(`/foo`)"
|
||||
- "traefik.http.routers.router1.entrypoints=web"
|
||||
- "traefik.http.routers.router1.middlewares=crowdsec1@docker"
|
||||
# Definition of the service
|
||||
- "traefik.http.services.service1.loadbalancer.server.port=80"
|
||||
# Definitin of the middleware
|
||||
- "traefik.http.middlewares.crowdsec1.plugin.bouncer.enabled=true"
|
||||
# crowdseclapikey must be uniq to the middleware attached to the service
|
||||
- "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
whoami2:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service2"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.whoami.rule=Host(`localhost`)"
|
||||
- "traefik.http.routers.whoami.entrypoints=web"
|
||||
- "traefik.http.routers.whoami.middlewares=crowdsec@docker"
|
||||
- "traefik.http.services.whoami.loadbalancer.server.port=80"
|
||||
# Definition of the router
|
||||
- "traefik.http.routers.router2.rule=Host(`localhost`) && Path(`/bar`)"
|
||||
- "traefik.http.routers.router2.entrypoints=web"
|
||||
- "traefik.http.routers.router2.middlewares=crowdsec2@docker"
|
||||
# Definition of the service
|
||||
- "traefik.http.services.service2.loadbalancer.server.port=80"
|
||||
# Definitin of the middleware
|
||||
- "traefik.http.middlewares.crowdsec2.plugin.bouncer.enabled=true"
|
||||
# crowdseclapikey must be uniq to the middleware attached to the service
|
||||
- "traefik.http.middlewares.crowdsec2.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.4.1
|
||||
container_name: "crowdsec"
|
||||
command: rm -rf /etc/crowdsec/acquis.yaml
|
||||
environment:
|
||||
COLLECTIONS: crowdsecurity/traefik
|
||||
CUSTOM_HOSTNAME: crowdsec
|
||||
BOUNCER_KEY_TRAEFIK: 40796d93c2958f9e58345514e67740e5
|
||||
BOUNCER_KEY_TRAEFIK_1: 40796d93c2958f9e58345514e67740e5
|
||||
BOUNCER_KEY_TRAEFIK_2: 44c36dac5c4140af9f06f397508e82c7
|
||||
volumes:
|
||||
- ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
|
||||
- logs:/var/log/traefik:ro
|
||||
- crowdsec-db:/var/lib/crowdsec/data/
|
||||
- crowdsec-config:/etc/crowdsec/
|
||||
|
||||
labels:
|
||||
- "traefik.enable=false"
|
||||
volumes:
|
||||
logs:
|
||||
crowdsec-db:
|
||||
crowdsec-config:
|
||||
logs-local:
|
||||
crowdsec-db-local:
|
||||
crowdsec-config-local:
|
||||
+35
-10
@@ -2,7 +2,7 @@ version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.8.7"
|
||||
image: "traefik:v2.8.8"
|
||||
container_name: "traefik"
|
||||
command:
|
||||
# - "--log.level=DEBUG"
|
||||
@@ -14,6 +14,7 @@ services:
|
||||
- "--entrypoints.web.address=:80"
|
||||
|
||||
- "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
- "--experimental.plugins.bouncer.version=v1.0.6"
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
- "logs:/var/log/traefik"
|
||||
@@ -23,30 +24,54 @@ services:
|
||||
depends_on:
|
||||
- 'crowdsec'
|
||||
|
||||
whoami:
|
||||
whoami1:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service"
|
||||
container_name: "simple-service-1"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.whoami.rule=Host(`localhost`)"
|
||||
- "traefik.http.routers.whoami.entrypoints=web"
|
||||
- "traefik.http.routers.whoami.middlewares=crowdsec@docker"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY"
|
||||
# Definition of the router
|
||||
- "traefik.http.routers.router1.rule=Host(`localhost`) && Path(`/foo`)"
|
||||
- "traefik.http.routers.router1.entrypoints=web"
|
||||
- "traefik.http.routers.router1.middlewares=crowdsec2@docker"
|
||||
# Definition of the service
|
||||
- "traefik.http.services.service1.loadbalancer.server.port=80"
|
||||
# Definitin of the middleware
|
||||
- "traefik.http.middlewares.crowdsec1.plugin.bouncer.enabled=true"
|
||||
# crowdseclapikey must be uniq to the middleware attached to the service
|
||||
- "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-1"
|
||||
|
||||
whoami2:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service-2"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
# Definition of the router
|
||||
- "traefik.http.routers.router2.rule=Host(`localhost`) && Path(`/bar`)"
|
||||
- "traefik.http.routers.router2.entrypoints=web"
|
||||
- "traefik.http.routers.router2.middlewares=crowdsec2@docker"
|
||||
# Definition of the service
|
||||
- "traefik.http.services.service2.loadbalancer.server.port=80"
|
||||
# Definitin of the middleware
|
||||
- "traefik.http.middlewares.crowdsec2.plugin.bouncer.enabled=true"
|
||||
# crowdseclapikey must be uniq to the middleware attached to the service
|
||||
- "traefik.http.middlewares.crowdsec2.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-2"
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.4.1
|
||||
container_name: "crowdsec"
|
||||
command: rm -rf /etc/crowdsec/acquis.yaml
|
||||
environment:
|
||||
COLLECTIONS: crowdsecurity/traefik
|
||||
CUSTOM_HOSTNAME: crowdsec
|
||||
BOUNCER_KEY_TRAEFIK: FIXME-LAPI-KEY
|
||||
# We need to register one api key per service we will use
|
||||
BOUNCER_KEY_TRAEFIK_1: FIXME-LAPI-KEY-1
|
||||
BOUNCER_KEY_TRAEFIK_2: FIXME-LAPI-KEY-2
|
||||
volumes:
|
||||
- ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
|
||||
- logs:/var/log/traefik:ro
|
||||
- crowdsec-db:/var/lib/crowdsec/data/
|
||||
- crowdsec-config:/etc/crowdsec/
|
||||
labels:
|
||||
- "traefik.enable=false"
|
||||
|
||||
volumes:
|
||||
logs:
|
||||
|
||||
Reference in New Issue
Block a user