📝 Add documentation exemple 4 for vm binary usage (#45)

* 📝 Add documentation exemple 4 for vm binary usage

* :hammer:Update binary version

* 🔨 update

* 🔨 update

* 🚧 Working Crowdsec with tls auth

* 🐛 Add changes to download the plugin from the service

* 🔧 Add config middle for https

* 🔧 Update config for the exemple

* 🔧 Add conf for certs, working example

* 📝 Add doc for binary vm Readme

* 📝 update documentation for exemple and make

* 🚨 Fix lint

* 🚨 Fix Lint End of File

exemples/binary-vm/scripts/configure_crowdsec_certs.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+
+basepath="/home/vagrant/vagrant_data/crowdsec/certs"
+
+VERSION=$(curl --silent "https://api.github.com/repos/cloudflare/cfssl/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/')
+VNUMBER=${VERSION#"v"}
+wget https://github.com/cloudflare/cfssl/releases/download/${VERSION}/cfssl_${VNUMBER}_linux_amd64 -O cfssl
+chmod +x cfssl
+sudo mv cfssl /usr/local/bin
+
+VERSION=$(curl --silent "https://api.github.com/repos/cloudflare/cfssl/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/')
+VNUMBER=${VERSION#"v"}
+wget https://github.com/cloudflare/cfssl/releases/download/${VERSION}/cfssljson_${VNUMBER}_linux_amd64 -O cfssljson
+chmod +x cfssljson
+sudo mv cfssljson /usr/local/bin
+cfssljson -version
+
+mkdir -p /etc/crowdsec/certs
+
+# Generate the CA
+cfssl gencert --initca ${basepath}/ca.json 2>/dev/null | cfssljson --bare "/etc/crowdsec/certs/ca"
+# Generate an intermediate certificate that will be used to sign the client certificates
+cfssl gencert --initca ${basepath}/intermediate.json 2>/dev/null | cfssljson --bare "/etc/crowdsec/certs/inter"
+cfssl sign -ca "/etc/crowdsec/certs/ca.pem" -ca-key "/etc/crowdsec/certs/ca-key.pem" -config ${basepath}/profiles.json -profile intermediate_ca "/etc/crowdsec/certs/inter.csr" 2>/dev/null | cfssljson --bare "/etc/crowdsec/certs/inter"
+# Generate a server side certificate
+cfssl gencert -ca "/etc/crowdsec/certs/inter.pem" -ca-key "/etc/crowdsec/certs/inter-key.pem" -config ${basepath}/profiles.json -profile=server ${basepath}/server.json 2>/dev/null | cfssljson --bare "/etc/crowdsec/certs/server"
+# Generate a client certificate for the bouncer whoami
+cfssl gencert -ca "/etc/crowdsec/certs/inter.pem" -ca-key "/etc/crowdsec/certs/inter-key.pem" -config ${basepath}/profiles.json -profile=client ${basepath}/bouncer.json 2>/dev/null | cfssljson --bare "/etc/crowdsec/certs/bouncer"
+# Generate a client certificate for the agent
+cfssl gencert -ca "/etc/crowdsec/certs/inter.pem" -ca-key "/etc/crowdsec/certs/inter-key.pem" -config ${basepath}/profiles.json -profile=client ${basepath}/agent.json 2>/dev/null | cfssljson --bare "/etc/crowdsec/certs/agent"
+
+
+cp /home/vagrant/vagrant_data/crowdsec/config/config.yaml  /etc/crowdsec/config.yaml.local
+cp /home/vagrant/vagrant_data/crowdsec/config/local_api_credentials.yaml /etc/crowdsec/
+chmod +r /etc/crowdsec/config.yaml
+chmod +r /etc/crowdsec/local_api_credentials.yaml
+
+systemctl restart crowdsec
+
+mkdir /etc/traefik/crowdsec-certs
+cp /etc/crowdsec/certs/inter.pem /etc/traefik/crowdsec-certs/inter.pem
+cp /etc/crowdsec/certs/bouncer.pem /etc/traefik/crowdsec-certs/bouncer.pem
+cp /etc/crowdsec/certs/bouncer-key.pem /etc/traefik/crowdsec-certs/bouncer-key.pem
+chown -R traefik:traefik /etc/traefik/crowdsec-certs/
+
+systemctl restart traefik

exemples/binary-vm/scripts/configure_traefik.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+
+sudo cp /home/vagrant/vagrant_data/traefik/traefik.yml /etc/traefik/traefik.yml
+sudo cp -a /home/vagrant/vagrant_data/traefik/conf /etc/traefik/
+sudo chown -R traefik:traefik /etc/traefik
+sudo mkdir /var/log/traefik
+sudo chown -R traefik:traefik /var/log/traefik
+
+sudo systemctl restart traefik.service
+sudo systemctl status traefik.service

exemples/binary-vm/scripts/install_crowdsec.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+
+curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
+sudo apt install crowdsec -y
+sudo cp /home/vagrant/vagrant_data/crowdsec/acquis.yaml /etc/crowdsec/acquis.yaml

exemples/binary-vm/scripts/install_traefik.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+
+sudo apt-get update && apt-get install wget -y && apt-get upgrade -y
+wget -O traefik.tar.gz "https://github.com/traefik/traefik/releases/download/v2.9.5/traefik_v2.9.5_linux_amd64.tar.gz"
+tar -zxvf traefik.tar.gz
+# inspired from https://gist.github.com/ubergesundheit/7c9d875befc2d7bfd0bf43d8b3862d85
+sudo mv ./traefik /usr/local/bin/
+sudo chown root:root /usr/local/bin/traefik
+sudo chmod 755 /usr/local/bin/traefik
+sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/traefik
+
+sudo groupadd -g 321 traefik
+sudo useradd \
+    -g traefik --no-user-group \
+    --home-dir /var/www --no-create-home \
+    --shell /usr/sbin/nologin \
+    --system --uid 321 traefik
+
+sudo mkdir /etc/traefik
+sudo mkdir /etc/traefik/acme
+sudo mkdir /etc/traefik/plugins-storage
+sudo chown -R root:root /etc/traefik
+sudo chown -R traefik:traefik /etc/traefik/acme
+sudo chown -R traefik:traefik /etc/traefik/plugins-storage
+
+sudo cp /home/vagrant/vagrant_data/traefik/traefik.service /etc/systemd/system/
+sudo chown root:root /etc/systemd/system/traefik.service
+sudo chmod 644 /etc/systemd/system/traefik.service
+sudo systemctl daemon-reload
+sudo systemctl start traefik.service
+sudo systemctl enable traefik.service

exemples/binary-vm/scripts/install_whoami.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+sudo apt-get update && apt-get install wget -y
+wget -O whoami.tar.gz "https://github.com/traefik/whoami/releases/download/v1.8.7/whoami_v1.8.7_linux_amd64.tar.gz"
+tar -zxvf whoami.tar.gz
+# inspired from https://gist.github.com/ubergesundheit/7c9d875befc2d7bfd0bf43d8b3862d85
+sudo mv ./whoami /usr/local/bin/
+sudo chown root:root /usr/local/bin/whoami
+sudo chmod 755 /usr/local/bin/whoami
+
+sudo groupadd -g 322 whoami
+sudo useradd \
+    -g whoami --no-user-group \
+    --home-dir /var/www --no-create-home \
+    --shell /usr/sbin/nologin \
+    --system --uid 322 whoami
+
+sudo cp /home/vagrant/vagrant_data/whoami.service /etc/systemd/system/
+sudo chown root:root /etc/systemd/system/whoami.service
+sudo chmod 644 /etc/systemd/system/whoami.service
+sudo systemctl daemon-reload
+sudo systemctl start whoami.service
+sudo systemctl enable whoami.service