pretecno/crowdsec-bouncer-traefik-plugin
3
0
Fork 0
mirror of https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin.git synced 2026-07-21 11:38:59 +02:00
Code Issues Packages Releases Activity

update usage on readme, docker-compose and traefiker (#8)

Browse Source 
* Update readme, add about sectioj

* Update readme about

* Change parameter with capitalized letters

* Add docker-compose local and docker-compose for real world utilization

* Update readme and .traefik

* update readme and docker-compose

* Update .traefik

Co-authored-by: MathieuHa <mathieu@hanotaux.fr>
This commit is contained in:
mathieuHa
2022-09-28 23:06:16 +02:00
committed by GitHub
co-authored by MathieuHa
parent 57a97a0cf9
commit 5eb4077133
5 changed files with 70 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+62 -1
View File
@@ -6,6 +6,28 @@ This plugins aims to implement a Crowdsec Bouncer into a traefik plugin.
> [CrowdSec](https://www.crowdsec.net/) is an open-source and collaborative IPS (Intrusion Prevention System) and a security suite.
> We leverage local behavior analysis and crowd power to build the largest CTI network in the world.
The purpose is to enable treafik to authorize and block requests from IP based and their reputation and behavior.
The crowdsec utility will provide the community blocklist which contains highly reported and validated IP banned from the crowdsec network.
When used with crowdsec it will leverage the local API which will analyze traefik logs and take decisions on the requests made by users/bots. Malicious actors will be banned based on patterns against your website.
There is 3 operating mode for this plugin:
- none -> If the client IP is on ban list, it will get a http code 403 response.
Otherwise, request will continue as usual. All request call the Crowdsec LAPI
- live -> If the client IP is on ban list, it will get a http code 403 response.
Otherwise, request will continue as usual.
The bouncer can leverage use of a local cache in order to reduce the number
of requests made to the Crowdsec LAPI. It will keep in cache the status for
each IP that makes queries.
- stream -> Stream Streaming mode allows you to keep in the local cache only the Banned IPs,
every requests that does not hit the cache is authorized.
Every minute, the cache is updated with news from the Crowdsec LAPI.
The recommanded mode for performance is the streaming mode, decisions are updated every 60 sec by default and that's the only communication between traefik and crowdsec. Every requests that happens hits the cache for quick decisions.
## Usage
@@ -50,6 +72,11 @@ http:
bouncer:
enabled: true
crowdseclapikey: 40796d93c2958f9e58345514e67740e5
updateIntervalSeconds: 60
defaultDecisionSeconds: 60
crowdsecLapiHost:
crowdsecLapiScheme:
crowdsecMode: stream
```
### Local Mode
@@ -76,12 +103,46 @@ The source code of the plugin should be organized as follows:
└── vendor/*
```
For local developpement a docker-compose-local.yml is provided and reproduce the directory layout needed by traefik.
For local developpement a docker-compose-local.yml is provided and reproduce the directory layout needed by traefik. This works once you have generated and filled your LAPI-KEY, if not look below for informations
```bash
docker-compose -f docker-compose-local.yml up -d
```
#### Generate LAPI-KEY
You need to generate a crowdsec API key for the LAPI.
You can follow the documentation here: https://docs.crowdsec.net/docs/user_guides/lapi_mgmt/
```bash
docker-compose -f docker-compose-local.yml up -d crowdsec
docker exec crowdsec cscli bouncers add crowdsecBouncer
```
This LApi key must be set where is noted FIXME-LAPI-KEY in the docker-compose-test.yml
```yaml
...
whoami:
labels:
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY"
...
crowdsec:
environment:
BOUNCER_KEY_TRAEFIK: FIXME-LAPI-KEY
...
```
You can then run all the containers:
```bash
docker-compose -f docker-compose-local.yml up -d
```
#### Add manually an IP to the blocklist
```bash
docker-compose -f docker-compose-local.yml up -d crowdsec
docker exec crowdsec cscli decisions add --ip 10.0.0.10
```
### About
[maxlerebourg](https://github.com/maxlerebourg) and [I](https://github.com/mhanotaux) have been using traefik since 2020.