From d8ee0a34eb5a1b871894706aeed73930bea875fb Mon Sep 17 00:00:00 2001 From: MathieuHa Date: Sat, 5 Nov 2022 21:45:43 +0100 Subject: [PATCH] Update documentation, exemples and code for redis support --- Makefile | 1 + README.md | 31 +++++++++++++++++-- docker-compose.local.yml | 2 +- docker-compose.yml | 2 +- exemples/redis-cache/docker-compose.redis.yml | 6 ++-- pkg/redis/redis.go | 1 - 6 files changed, 34 insertions(+), 9 deletions(-) diff --git a/Makefile b/Makefile index ab729ee..6b3e774 100644 --- a/Makefile +++ b/Makefile @@ -54,6 +54,7 @@ show_dev_logs: clean_all_docker: docker-compose -f exemples/behind-proxy/docker-compose.cloudflare.yml down --remove-orphans + docker-compose -f exemples/behind-proxy/docker-compose.redis.yml down --remove-orphans docker-compose -f docker-compose.local.yml down --remove-orphans docker-compose -f docker-compose.yml down --remove-orphans diff --git a/README.md b/README.md index 17182a5..1c1aeaa 100644 --- a/README.md +++ b/README.md @@ -26,6 +26,9 @@ There are 3 operating modes (CrowdsecMode) for this plugin: The recommanded mode for performance is the streaming mode, decisions are updated every 60 sec by default and that's the only communication between traefik and crowdsec. Every requests that happens hits the cache for quick decisions. +The cache can be local to the Traefik instance using the filesystem or make use of a separated redis instance. +The redis instance is currently in beta and support Redis 7.0.X version + ## Usage To get started, use the `docker-compose.yml` file. @@ -36,8 +39,11 @@ make run ``` ### Note + +**/!\ Since Release 1.10, cache is no longer duplicated but shared by all services** + Each middleware in traefik has it's own data and is instanciated by service. -This means if there are 10 services protected by the bouncer in streaming alone or live mode, the cache will be duplicated to all 10 services. +This means if there are 10 services protected by the bouncer in streaming or live mode, the cache will be duplicated to all 10 services. This is because traefik does not allow plugins to store data locally that can be consummed. The synchronisation with the crowdsec service will happen also 10 times in the period selected. @@ -45,10 +51,12 @@ It should be taken into account when fixing this period so each middleware has t At each start of synchronisation, the middleware will wait a random number of seconds to avoid simultaneous calls to crowdsec. + ### Variables - Enabled - bool - enable the plugin + - default: true - LogLevel - string - default: `INFO`, expected value are: `INFO`, `DEBUG` @@ -61,7 +69,7 @@ At each start of synchronisation, the middleware will wait a random number of se - CrowdsecLapiHost - string - default: "crowdsec:8080" - - Crowdsec LAPI available on which host. + - Crowdsec LAPI available on which host and port. - CrowdsecLapiKey - string - Crowdsec LAPI generated key for the bouncer : **must be unique by service**. @@ -79,8 +87,17 @@ At each start of synchronisation, the middleware will wait a random number of se - List of IPs of trusted Proxies that are in front of traefik (ex: Cloudflare) - ForwardedHeadersCustomName - string - - default: X-Forwarded-For + - default: "X-Forwarded-For" - Name of the header where the real IP of the client should be retrieved +- RedisCacheEnabled + - bool + - default: false + - enable redis cache instead of filesystem cache +- RedisCacheHost + - string + - default: "redis:6379" + - hostname and port for the redis service + ### Configuration @@ -131,6 +148,8 @@ http: - 10.0.10.23/32 - 10.0.20.0/24 forwardedHeadersCustomName: X-Custom-Header + redisCacheEnabled: false + redisCacheHost: "redis:6379" ``` These are the default values of the plugin except for LapiKey. @@ -229,6 +248,12 @@ make run_behindproxy 2. With Redis as an external shared cache +The plugin must be configured to connect to a redis instance +```yaml + redisCacheHost: "redis:6379" +``` +Here **redis** is the hostname of a container located in the same network as Traefik and **6379** the default port of redis + To run the demo environnement run: ```bash make run_cacheredis diff --git a/docker-compose.local.yml b/docker-compose.local.yml index 7849d2e..be65f1c 100644 --- a/docker-compose.local.yml +++ b/docker-compose.local.yml @@ -2,7 +2,7 @@ version: "3.8" services: traefik: - image: "traefik:v2.8.8" + image: "traefik:v2.9.4" container_name: "traefik" command: # - "--log.level=DEBUG" diff --git a/docker-compose.yml b/docker-compose.yml index afb8ca3..6f0b2f7 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -2,7 +2,7 @@ version: "3.8" services: traefik: - image: "traefik:v2.8.8" + image: "traefik:v2.9.4" container_name: "traefik" command: - "--accesslog" diff --git a/exemples/redis-cache/docker-compose.redis.yml b/exemples/redis-cache/docker-compose.redis.yml index b179963..27de032 100644 --- a/exemples/redis-cache/docker-compose.redis.yml +++ b/exemples/redis-cache/docker-compose.redis.yml @@ -2,7 +2,7 @@ version: "3.8" services: traefik: - image: "traefik:v2.8.8" + image: "traefik:v2.9.4" container_name: "traefik" command: # - "--log.level=DEBUG" @@ -33,7 +33,7 @@ services: labels: - "traefik.enable=true" # Definition of the router - - "traefik.http.routers.router1.rule=Host(`localhost`) && Path(`/foo`)" + - "traefik.http.routers.router1.rule=Path(`/foo`)" - "traefik.http.routers.router1.entrypoints=web" - "traefik.http.routers.router1.middlewares=crowdsec1@docker" # Definition of the service @@ -50,7 +50,7 @@ services: labels: - "traefik.enable=true" # Definition of the router - - "traefik.http.routers.router2.rule=Host(`localhost`) && Path(`/bar`)" + - "traefik.http.routers.router2.rule=Path(`/bar`)" - "traefik.http.routers.router2.entrypoints=web" - "traefik.http.routers.router2.middlewares=crowdsec1@docker" # Definition of the service diff --git a/pkg/redis/redis.go b/pkg/redis/redis.go index d073af6..50341c4 100644 --- a/pkg/redis/redis.go +++ b/pkg/redis/redis.go @@ -102,7 +102,6 @@ func parseResponse(response []byte, dataBuf []byte, Len *int) ([]byte, []byte, e } } } - return nil, dataBuf, nil } func initContext(hostnamePort string, redisCmdWrite, redisCmdRead chan RedisCmd) {