diff --git a/Makefile b/Makefile index 949ec86..7b621f5 100644 --- a/Makefile +++ b/Makefile @@ -67,7 +67,7 @@ show_dev_logs: clean_all_docker: docker-compose -f exemples/behind-proxy/docker-compose.cloudflare.yml down --remove-orphans docker-compose -f exemples/redis-cache/docker-compose.redis.yml down --remove-orphans - docker-compose -f exemples/trusted-ips/docker-compose.redis.yml down --remove-orphans + docker-compose -f exemples/trusted-ips/docker-compose.trusted.yml down --remove-orphans docker-compose -f docker-compose.local.yml down --remove-orphans docker-compose -f docker-compose.yml down --remove-orphans diff --git a/docker-compose.local.yml b/docker-compose.local.yml index 2b5b6f5..a87e892 100644 --- a/docker-compose.local.yml +++ b/docker-compose.local.yml @@ -4,6 +4,7 @@ services: traefik: image: "traefik:v2.9.4" container_name: "traefik" + restart: unless-stopped command: - "--log.level=DEBUG" - "--accesslog" @@ -24,33 +25,36 @@ services: depends_on: - crowdsec - whoami1: + whoami-foo: image: traefik/whoami - container_name: "simple-service1" + container_name: "simple-service-foo" + restart: unless-stopped labels: - "traefik.enable=true" - - "traefik.http.routers.router1.rule=Path(`/foo`)" - - "traefik.http.routers.router1.entrypoints=web" - - "traefik.http.routers.router1.middlewares=crowdsec1@docker" - - "traefik.http.services.service1.loadbalancer.server.port=80" - - "traefik.http.middlewares.crowdsec1.plugin.bouncer.enabled=true" - - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5" + - "traefik.http.routers.router-foo.rule=Path(`/foo`)" + - "traefik.http.routers.router-foo.entrypoints=web" + - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" + - "traefik.http.services.service-foo.loadbalancer.server.port=80" + - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true" + - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5" whoami2: image: traefik/whoami - container_name: "simple-service2" + container_name: "simple-service-bar" + restart: unless-stopped labels: - "traefik.enable=true" - - "traefik.http.routers.router2.rule=Path(`/bar`)" - - "traefik.http.routers.router2.entrypoints=web" - - "traefik.http.routers.router2.middlewares=crowdsec2@docker" - - "traefik.http.services.service2.loadbalancer.server.port=80" - - "traefik.http.middlewares.crowdsec2.plugin.bouncer.enabled=true" - - "traefik.http.middlewares.crowdsec2.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7" + - "traefik.http.routers.router-bar.rule=Path(`/bar`)" + - "traefik.http.routers.router-bar.entrypoints=web" + - "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker" + - "traefik.http.services.service-bar.loadbalancer.server.port=80" + - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true" + - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7" crowdsec: image: crowdsecurity/crowdsec:v1.4.1 container_name: "crowdsec" + restart: unless-stopped environment: COLLECTIONS: crowdsecurity/traefik CUSTOM_HOSTNAME: crowdsec diff --git a/docker-compose.yml b/docker-compose.yml index 13ae2f5..c786113 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -4,6 +4,7 @@ services: traefik: image: "traefik:v2.9.4" container_name: "traefik" + restart: unless-stopped command: - "--accesslog" - "--accesslog.filepath=/var/log/traefik/access.log" @@ -25,43 +26,46 @@ services: whoami1: image: traefik/whoami - container_name: "simple-service-1" + container_name: "simple-service-foo" + restart: unless-stopped labels: - "traefik.enable=true" # Definition of the router - - "traefik.http.routers.router1.rule=Path(`/foo`)" - - "traefik.http.routers.router1.entrypoints=web" - - "traefik.http.routers.router1.middlewares=crowdsec2@docker" + - "traefik.http.routers.router-foo.rule=Path(`/foo`)" + - "traefik.http.routers.router-foo.entrypoints=web" + - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" # Definition of the service - - "traefik.http.services.service1.loadbalancer.server.port=80" + - "traefik.http.services.service-foo.loadbalancer.server.port=80" # Definition of the middleware - - "traefik.http.middlewares.crowdsec1.plugin.bouncer.enabled=true" + - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true" # crowdseclapikey must be unique to the middleware attached to the service - - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-1" + - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-1" # forwardedheaderstrustedips should be the IP of the proxy that is in front of traefik (if any) - - "traefik.http.middlewares.crowdsec1.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5" + - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5" whoami2: image: traefik/whoami - container_name: "simple-service-2" + container_name: "simple-service-bar" + restart: unless-stopped labels: - "traefik.enable=true" # Definition of the router - - "traefik.http.routers.router2.rule=Path(`/bar`)" - - "traefik.http.routers.router2.entrypoints=web" - - "traefik.http.routers.router2.middlewares=crowdsec2@docker" + - "traefik.http.routers.router-bar.rule=Path(`/bar`)" + - "traefik.http.routers.router-bar.entrypoints=web" + - "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker" # Definition of the service - - "traefik.http.services.service2.loadbalancer.server.port=80" + - "traefik.http.services.service-bar.loadbalancer.server.port=80" # Definitin of the middleware - - "traefik.http.middlewares.crowdsec2.plugin.bouncer.enabled=true" + - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true" # crowdseclapikey must be unique to the middleware attached to the service - - "traefik.http.middlewares.crowdsec2.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-2" + - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-2" # forwardedheaderstrustedips should be the IP of the proxy that is in front of traefik (if any) - - "traefik.http.middlewares.crowdsec2.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5" + - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5" crowdsec: image: crowdsecurity/crowdsec:v1.4.1 container_name: "crowdsec" + restart: unless-stopped environment: COLLECTIONS: crowdsecurity/traefik CUSTOM_HOSTNAME: crowdsec diff --git a/exemples/behind-proxy/docker-compose.cloudflare.yml b/exemples/behind-proxy/docker-compose.cloudflare.yml index a69fb25..3ce093a 100644 --- a/exemples/behind-proxy/docker-compose.cloudflare.yml +++ b/exemples/behind-proxy/docker-compose.cloudflare.yml @@ -4,6 +4,7 @@ services: cloudflare: image: "traefik:v2.9.4" container_name: "cloudflare" + restart: unless-stopped command: # - "--log.level=DEBUG" - "--accesslog" @@ -23,6 +24,7 @@ services: traefik: image: "traefik:v2.9.4" container_name: "traefik" + restart: unless-stopped command: # - "--log.level=DEBUG" - "--accesslog" @@ -34,10 +36,10 @@ services: - "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5" - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" - - "--experimental.plugins.bouncer.version=v1.2.0" + - "--experimental.plugins.bouncer.version=v1.1.3" volumes: - /var/run/docker.sock:/var/run/docker.sock:ro - - logs-dev:/var/log/traefik + - logs-traefik:/var/log/traefik ports: - 90:80 - 9080:8080 @@ -46,26 +48,49 @@ services: whoami1: image: traefik/whoami - container_name: "simple-service1" + container_name: "simple-service-foo" + restart: unless-stopped labels: - "traefik.enable=true" # Definition of the router - - "traefik.http.routers.router1.rule=Path(`/foo`)" - - "traefik.http.routers.router1.entrypoints=web" - - "traefik.http.routers.router1.middlewares=crowdsec1@docker" + - "traefik.http.routers.router-foo.rule=Path(`/foo`)" + - "traefik.http.routers.router-foo.entrypoints=web" + - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" # Definition of the service - - "traefik.http.services.service1.loadbalancer.server.port=80" + - "traefik.http.services.service-foo.loadbalancer.server.port=80" # Definitin of the middleware - - "traefik.http.middlewares.crowdsec1.plugin.bouncer.enabled=true" + - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true" # crowdseclapikey must be uniq to the middleware attached to the service - - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5" - - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdsecmode=live" - - "traefik.http.middlewares.crowdsec1.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5" + - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5" + - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdsecmode=live" + - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5" + - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG" + + whoami2: + image: traefik/whoami + container_name: "simple-service-bar" + restart: unless-stopped + labels: + - "traefik.enable=true" + # Definition of the router + - "traefik.http.routers.router-bar.rule=Path(`/bar`)" + - "traefik.http.routers.router-bar.entrypoints=web" + - "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker" + # Definition of the service + - "traefik.http.services.service-bar.loadbalancer.server.port=80" + # Definitin of the middleware + - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true" + # crowdseclapikey must be uniq to the middleware attached to the service + - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7" + - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecmode=live" + - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5" + - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG" crowdsec: image: crowdsecurity/crowdsec:v1.4.1 container_name: "crowdsec" + restart: unless-stopped environment: COLLECTIONS: crowdsecurity/traefik CUSTOM_HOSTNAME: crowdsec @@ -73,14 +98,14 @@ services: BOUNCER_KEY_TRAEFIK_DEV_2: 44c36dac5c4140af9f06f397508e82c7 volumes: - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro - - logs-dev:/var/log/traefik:ro - - crowdsec-db-dev:/var/lib/crowdsec/data/ - - crowdsec-config-dev:/etc/crowdsec/ + - logs-cloudflare:/var/log/traefik:ro + - crowdsec-db-cloudflare:/var/lib/crowdsec/data/ + - crowdsec-config-cloudflare:/etc/crowdsec/ labels: - "traefik.enable=false" volumes: - logs-dev: + logs-traefik: logs-cloudflare: - crowdsec-db-dev: - crowdsec-config-dev: + crowdsec-db-cloudflare: + crowdsec-config-cloudflare: diff --git a/exemples/redis-cache/docker-compose.redis.yml b/exemples/redis-cache/docker-compose.redis.yml index de84146..0252418 100644 --- a/exemples/redis-cache/docker-compose.redis.yml +++ b/exemples/redis-cache/docker-compose.redis.yml @@ -4,6 +4,7 @@ services: traefik: image: "traefik:v2.9.4" container_name: "traefik" + restart: unless-stopped command: # - "--log.level=DEBUG" - "--accesslog" @@ -14,7 +15,7 @@ services: - "--entrypoints.web.address=:80" - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" - - "--experimental.plugins.bouncer.version=v1.1.2" + - "--experimental.plugins.bouncer.version=v1.1.3" # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" volumes: - /var/run/docker.sock:/var/run/docker.sock:ro @@ -27,47 +28,49 @@ services: - crowdsec - redis - whoami1: + whoami-foo: image: traefik/whoami - container_name: "simple-service1" + container_name: "simple-service-foo" + restart: unless-stopped labels: - "traefik.enable=true" # Definition of the router - - "traefik.http.routers.router1.rule=Path(`/foo`)" - - "traefik.http.routers.router1.entrypoints=web" - - "traefik.http.routers.router1.middlewares=crowdsec1@docker" + - "traefik.http.routers.router-foo.rule=Path(`/foo`)" + - "traefik.http.routers.router-foo.entrypoints=web" + - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" # Definition of the service - - "traefik.http.services.service1.loadbalancer.server.port=80" + - "traefik.http.services.service-foo.loadbalancer.server.port=80" # Definition of the middleware - - "traefik.http.middlewares.crowdsec1.plugin.bouncer.enabled=true" + - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true" # crowdseclapikey must be uniq to the middleware attached to the service - - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5" - - "traefik.http.middlewares.crowdsec1.plugin.bouncer.rediscacheenabled=true" - - "traefik.http.middlewares.crowdsec1.plugin.bouncer.loglevel=DEBUG" + - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5" + - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.rediscacheenabled=true" + - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG" - whoami2: - image: 4206969/spiderfoot - container_name: "simple-service2" - volumes: - - spiderfoot-data:/var/lib/spiderfoot + whoami-bar: + image: traefik/whoami + container_name: "simple-service-bar" + restart: unless-stopped labels: - "traefik.enable=true" # Definition of the router - - "traefik.http.routers.router2.rule=Host(`127.0.0.1`)" - - "traefik.http.routers.router2.entrypoints=web" - - "traefik.http.routers.router2.middlewares=crowdsec1@docker" + - "traefik.http.routers.router-bar.rule=Path(`/bar`)" + - "traefik.http.routers.router-bar.entrypoints=web" + - "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker" # Definition of the service - - "traefik.http.services.service2.loadbalancer.server.port=5001" + - "traefik.http.services.service-bar.loadbalancer.server.port=80" # Definition of the middleware - - "traefik.http.middlewares.crowdsec2.plugin.bouncer.enabled=true" + - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true" # crowdseclapikey must be uniq to the middleware attached to the service - - "traefik.http.middlewares.crowdsec2.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7" - - "traefik.http.middlewares.crowdsec2.plugin.bouncer.rediscacheenabled=true" + - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7" + - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.rediscacheenabled=true" + - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG" crowdsec: image: crowdsecurity/crowdsec:v1.4.1 container_name: "crowdsec" + restart: unless-stopped environment: COLLECTIONS: crowdsecurity/traefik CUSTOM_HOSTNAME: crowdsec @@ -80,10 +83,11 @@ services: - crowdsec-config-redis:/etc/crowdsec/ labels: - "traefik.enable=false" - + redis: image: "redis:7.0.5-alpine" container_name: "redis" + restart: unless-stopped command: "redis-server --save 60 1" volumes: - redis-data:/data @@ -95,4 +99,3 @@ volumes: crowdsec-db-redis: crowdsec-config-redis: redis-data: - spiderfoot-data: diff --git a/exemples/trusted-ips/docker-compose.trusted.yml b/exemples/trusted-ips/docker-compose.trusted.yml index 21baad5..3841692 100644 --- a/exemples/trusted-ips/docker-compose.trusted.yml +++ b/exemples/trusted-ips/docker-compose.trusted.yml @@ -4,6 +4,7 @@ services: traefik: image: "traefik:v2.9.4" container_name: "traefik" + restart: unless-stopped command: # - "--log.level=DEBUG" - "--accesslog" @@ -14,7 +15,7 @@ services: - "--entrypoints.web.address=:80" - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" - - "--experimental.plugins.bouncer.version=v1.1.2" + - "--experimental.plugins.bouncer.version=v1.1.3" # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" volumes: - /var/run/docker.sock:/var/run/docker.sock:ro @@ -28,30 +29,54 @@ services: whoami1: image: traefik/whoami - container_name: "simple-service1" + container_name: "simple-service-foo" + restart: unless-stopped labels: - "traefik.enable=true" # Definition of the router - - "traefik.http.routers.router1.rule=Path(`/foo`)" - - "traefik.http.routers.router1.entrypoints=web" - - "traefik.http.routers.router1.middlewares=crowdsec@docker" + - "traefik.http.routers.router-foo.rule=Path(`/foo`)" + - "traefik.http.routers.router-foo.entrypoints=web" + - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" # Definition of the service - - "traefik.http.services.service1.loadbalancer.server.port=80" + - "traefik.http.services.service-foo.loadbalancer.server.port=80" # Definition of the middleware - - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true" + - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true" # crowdseclapikey must be uniq to the middleware attached to the service - - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5" + - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5" # Replace 10.0.10.30/32 by your IP range which is "trusted" - - "traefik.http.middlewares.crowdsec.plugin.bouncer.clienttrustedips=10.0.50.30/32" + - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.clienttrustedips=10.0.10.30/32" + - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG" + + whoami2: + image: traefik/whoami + container_name: "simple-service-bar" + restart: unless-stopped + labels: + - "traefik.enable=true" + # Definition of the router + - "traefik.http.routers.router-bar.rule=Path(`/bar`)" + - "traefik.http.routers.router-bar.entrypoints=web" + - "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker" + # Definition of the service + - "traefik.http.services.service-bar.loadbalancer.server.port=80" + # Definition of the middleware + - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true" + # crowdseclapikey must be uniq to the middleware attached to the service + - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7" + # Replace 10.0.10.30/32 by your IP range which is "trusted" + - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.clienttrustedips=10.0.10.30/32" + - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG" crowdsec: image: crowdsecurity/crowdsec:v1.4.1 container_name: "crowdsec" + restart: unless-stopped environment: COLLECTIONS: crowdsecurity/traefik CUSTOM_HOSTNAME: crowdsec BOUNCER_KEY_TRAEFIK_DEV_1: 40796d93c2958f9e58345514e67740e5 + BOUNCER_KEY_TRAEFIK_DEV_2: 44c36dac5c4140af9f06f397508e82c7 volumes: - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro - logs-trustedips:/var/log/traefik:ro