mirror of
https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin.git
synced 2026-07-21 11:38:59 +02:00
📝 Add first diagrams (#144)
* 📝 Add first diagrams * 📝 Add diagram for none mode * 📝 Add diagrams for each mode * 📝 Fix rendering * 📝 Fix chart rendering * 🍱 fix readme * 🍱 fix readme --------- Co-authored-by: maxlerebourg <maxlerebourg@gmail.com> Co-authored-by: max.lerebourg <max.lerebourg@monisnap.com>
This commit is contained in:
mathieuHa
co-authored by
maxlerebourg
max.lerebourg
maxlerebourg
max.lerebourg
parent
615e7ccf69
commit
cb4f95d5d0
@@ -39,7 +39,7 @@ The following captcha providers are supported now:
|
|||||||
- [turnstile](https://www.cloudflare.com/fr-fr/products/turnstile/)
|
- [turnstile](https://www.cloudflare.com/fr-fr/products/turnstile/)
|
||||||
|
|
||||||
|
|
||||||
There are 4 operating modes (CrowdsecMode) for this plugin:
|
There are 5 operating modes (CrowdsecMode) for this plugin:
|
||||||
|
|
||||||
| Mode | Description |
|
| Mode | Description |
|
||||||
|------|------|
|
|------|------|
|
||||||
@@ -53,6 +53,247 @@ The `streaming mode` is recommended for performance, decisions are updated every
|
|||||||
|
|
||||||
The cache can be local to Traefik using the filesystem, or a separate Redis instance.
|
The cache can be local to Traefik using the filesystem, or a separate Redis instance.
|
||||||
|
|
||||||
|
Below are Mermaid diagrams detailling how each mode work:
|
||||||
|
|
||||||
|
<details><summary>Mode none workflow</summary>
|
||||||
|
|
||||||
|
> A Ban decision exists in CrowdsecLAPI
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
sequenceDiagram
|
||||||
|
participant User
|
||||||
|
participant TraefikPlugin
|
||||||
|
User->>TraefikPlugin: Can I access that webpage
|
||||||
|
create participant CrowdsecLAPI
|
||||||
|
TraefikPlugin-->>CrowdsecLAPI: Does the User IP has a Crowdsec Decision ?
|
||||||
|
Destroy CrowdsecLAPI
|
||||||
|
CrowdsecLAPI-->>TraefikPlugin: Yes a ban Decision
|
||||||
|
TraefikPlugin->>User: No, HTTP 403
|
||||||
|
```
|
||||||
|
|
||||||
|
> No decision in CrowdsecLAPI
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
sequenceDiagram
|
||||||
|
participant User
|
||||||
|
participant TraefikPlugin
|
||||||
|
User->>TraefikPlugin: Can I access that webpage
|
||||||
|
create participant CrowdsecLAPI
|
||||||
|
TraefikPlugin-->>CrowdsecLAPI: Does the User IP has a crowdsec decision ?
|
||||||
|
Destroy CrowdsecLAPI
|
||||||
|
CrowdsecLAPI-->>TraefikPlugin: Nothing, all good!
|
||||||
|
Destroy TraefikPlugin
|
||||||
|
TraefikPlugin->>Webserver: Forwarding this HTTP Request from User
|
||||||
|
Webserver->>User: HTTP Response
|
||||||
|
```
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
<details><summary>Mode live workflow</summary>
|
||||||
|
|
||||||
|
> A Ban decision exists in CrowdsecLAPI but not in cache
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
sequenceDiagram
|
||||||
|
participant User
|
||||||
|
participant TraefikPlugin
|
||||||
|
User->>TraefikPlugin: Can I access that webpage
|
||||||
|
create participant PluginCache
|
||||||
|
TraefikPlugin-->>PluginCache: Does the User IP has a crowdsec decision ?
|
||||||
|
PluginCache-->>TraefikPlugin: Nothing, all good!
|
||||||
|
create participant CrowdsecLAPI
|
||||||
|
TraefikPlugin-->>CrowdsecLAPI: Does the User IP has a crowdsec decision ?
|
||||||
|
Destroy CrowdsecLAPI
|
||||||
|
CrowdsecLAPI-->>TraefikPlugin: Yes a ban Decision
|
||||||
|
TraefikPlugin-->>PluginCache: Store the information for this IP for DefaultDecisionSeconds
|
||||||
|
Destroy PluginCache
|
||||||
|
PluginCache-->>TraefikPlugin: Done
|
||||||
|
TraefikPlugin->>User: No, HTTP 403
|
||||||
|
```
|
||||||
|
|
||||||
|
> No decision in cache
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
sequenceDiagram
|
||||||
|
participant User
|
||||||
|
participant TraefikPlugin
|
||||||
|
User->>TraefikPlugin: Can I access that webpage
|
||||||
|
create participant PluginCache
|
||||||
|
TraefikPlugin-->>PluginCache: Does the User IP has a crowdsec decision ?
|
||||||
|
PluginCache-->>TraefikPlugin: Nothing, all good!
|
||||||
|
create participant CrowdsecLAPI
|
||||||
|
TraefikPlugin-->>CrowdsecLAPI: Does the User IP has a crowdsec decision ?
|
||||||
|
Destroy CrowdsecLAPI
|
||||||
|
CrowdsecLAPI-->>TraefikPlugin: Nothing, all good!
|
||||||
|
TraefikPlugin-->>PluginCache: Store the information for this IP for DefaultDecisionSeconds
|
||||||
|
Destroy PluginCache
|
||||||
|
PluginCache-->>TraefikPlugin: Done
|
||||||
|
TraefikPlugin->>Webserver: Forwarding this HTTP Request from User
|
||||||
|
Webserver->>User: HTTP Response
|
||||||
|
```
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
<details><summary>Mode stream workflow</summary>
|
||||||
|
|
||||||
|
> Cache Synchronization every UpdateIntervalSeconds
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
sequenceDiagram
|
||||||
|
participant TraefikPlugin
|
||||||
|
participant CrowdsecLAPI
|
||||||
|
TraefikPlugin->>CrowdsecLAPI: What are the current decisions
|
||||||
|
Destroy CrowdsecLAPI
|
||||||
|
CrowdsecLAPI->>TraefikPlugin: Here is the list
|
||||||
|
create participant PluginCache
|
||||||
|
TraefikPlugin-->>PluginCache: Store this list
|
||||||
|
Destroy PluginCache
|
||||||
|
PluginCache-->>TraefikPlugin: Done
|
||||||
|
```
|
||||||
|
|
||||||
|
> A Ban decision exists in cache
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
sequenceDiagram
|
||||||
|
participant User
|
||||||
|
participant TraefikPlugin
|
||||||
|
User->>TraefikPlugin: Can I access that webpage
|
||||||
|
create participant PluginCache
|
||||||
|
TraefikPlugin-->>PluginCache: Does the User IP has a crowdsec decision ?
|
||||||
|
Destroy PluginCache
|
||||||
|
PluginCache-->>TraefikPlugin: Yes a ban decision
|
||||||
|
Destroy TraefikPlugin
|
||||||
|
TraefikPlugin->>User: No, HTTP 403
|
||||||
|
```
|
||||||
|
|
||||||
|
> No decision in cache
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
sequenceDiagram
|
||||||
|
participant User
|
||||||
|
participant TraefikPlugin
|
||||||
|
User->>TraefikPlugin: Can I access that webpage
|
||||||
|
create participant PluginCache
|
||||||
|
TraefikPlugin-->>PluginCache: Does the User IP has a crowdsec decision ?
|
||||||
|
Destroy PluginCache
|
||||||
|
PluginCache-->>TraefikPlugin: Nothing, all good!
|
||||||
|
Destroy TraefikPlugin
|
||||||
|
TraefikPlugin->>Webserver: Forwarding this HTTP Request from User
|
||||||
|
Webserver->>User: HTTP Response
|
||||||
|
```
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
<details><summary>Mode alone Workflow</summary>
|
||||||
|
|
||||||
|
> Cache Synchronization every 2 hours to the Crowdsec Central API
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
sequenceDiagram
|
||||||
|
participant TraefikPlugin
|
||||||
|
participant CrowdsecCAPI
|
||||||
|
TraefikPlugin->>CrowdsecCAPI: What are the current decisions from CAPI
|
||||||
|
Destroy CrowdsecCAPI
|
||||||
|
CrowdsecCAPI->>TraefikPlugin: Here is the list
|
||||||
|
create participant PluginCache
|
||||||
|
TraefikPlugin-->>PluginCache: Store this list
|
||||||
|
Destroy PluginCache
|
||||||
|
PluginCache-->>TraefikPlugin: Done
|
||||||
|
```
|
||||||
|
|
||||||
|
> A Ban decision exists in cache
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
sequenceDiagram
|
||||||
|
participant User
|
||||||
|
participant TraefikPlugin
|
||||||
|
User->>TraefikPlugin: Can I access that webpage
|
||||||
|
create participant PluginCache
|
||||||
|
TraefikPlugin-->>PluginCache: Does the User IP has a crowdsec decision ?
|
||||||
|
Destroy PluginCache
|
||||||
|
PluginCache-->>TraefikPlugin: Yes a ban decision
|
||||||
|
Destroy TraefikPlugin
|
||||||
|
TraefikPlugin->>User: No, HTTP 403
|
||||||
|
```
|
||||||
|
|
||||||
|
> No decision in cache
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
sequenceDiagram
|
||||||
|
participant User
|
||||||
|
participant TraefikPlugin
|
||||||
|
User->>TraefikPlugin: Can I access that webpage
|
||||||
|
create participant PluginCache
|
||||||
|
TraefikPlugin-->>PluginCache: Does the User IP has a crowdsec decision ?
|
||||||
|
Destroy PluginCache
|
||||||
|
PluginCache-->>TraefikPlugin: Nothing, all good!
|
||||||
|
Destroy TraefikPlugin
|
||||||
|
TraefikPlugin->>Webserver: Forwarding this HTTP Request from User
|
||||||
|
Webserver->>User: HTTP Response
|
||||||
|
```
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
<details><summary>Mode appsec workflow</summary>
|
||||||
|
|
||||||
|
> The request is detected as malicious
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
sequenceDiagram
|
||||||
|
participant User
|
||||||
|
participant TraefikPlugin
|
||||||
|
User->>TraefikPlugin: Can I access that webpage
|
||||||
|
create participant CrowdsecAppSec
|
||||||
|
TraefikPlugin-->>CrowdsecAppSec: Is this request malicious ?
|
||||||
|
Destroy CrowdsecAppSec
|
||||||
|
CrowdsecAppSec-->>TraefikPlugin: Yes I think so
|
||||||
|
Destroy TraefikPlugin
|
||||||
|
TraefikPlugin->>User: No, HTTP 403
|
||||||
|
```
|
||||||
|
|
||||||
|
> The request is not detected as malicious
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
sequenceDiagram
|
||||||
|
participant User
|
||||||
|
participant TraefikPlugin
|
||||||
|
User->>TraefikPlugin: Can I access that webpage
|
||||||
|
create participant CrowdsecAppSec
|
||||||
|
TraefikPlugin-->>CrowdsecAppSec: Is this request malicious ?
|
||||||
|
Destroy CrowdsecAppSec
|
||||||
|
CrowdsecAppSec-->>TraefikPlugin: No I don't think so
|
||||||
|
Destroy TraefikPlugin
|
||||||
|
TraefikPlugin->>Webserver: Forwarding this HTTP Request from User
|
||||||
|
Webserver->>User: HTTP Response
|
||||||
|
```
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
<details><summary>Captcha decision workflow</summary>
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
sequenceDiagram
|
||||||
|
participant User
|
||||||
|
participant TraefikPlugin
|
||||||
|
User->>TraefikPlugin: Can I access that webpage
|
||||||
|
create participant PluginCache
|
||||||
|
TraefikPlugin-->>PluginCache: Does the User IP has a Crowdsec Decision ?
|
||||||
|
PluginCache-->>TraefikPlugin: Yes a Catpcha Decision
|
||||||
|
TraefikPlugin->>User: Please complete this captcha
|
||||||
|
User->>TraefikPlugin: Fine, done!
|
||||||
|
create participant ProviderCaptcha
|
||||||
|
TraefikPlugin-->>ProviderCaptcha: Is the validation OK ?
|
||||||
|
Destroy ProviderCaptcha
|
||||||
|
ProviderCaptcha-->>TraefikPlugin: Yes
|
||||||
|
TraefikPlugin-->>PluginCache: Set the User IP Clean for captchaGracePeriodSeconds
|
||||||
|
Destroy PluginCache
|
||||||
|
PluginCache-->>TraefikPlugin: Done
|
||||||
|
Destroy TraefikPlugin
|
||||||
|
TraefikPlugin->>Webserver: Forwarding this HTTP Request from User
|
||||||
|
Webserver->>User: HTTP Response
|
||||||
|
```
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
## Usage
|
## Usage
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user