pretecno/crowdsec-bouncer-traefik-plugin
3
0
Fork 0
mirror of https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin.git synced 2026-07-21 11:38:59 +02:00
Code Issues Packages Releases Activity

Update Readme

Browse Source 
Show modes in a table
Fix gramar
This commit is contained in:
mathieuHa
2022-09-30 21:53:54 +02:00
committed by GitHub
parent 2f2cb60f74
commit ec0ffabc21
1 changed files with 11 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+11 -18
View File
@@ -17,21 +17,14 @@ The crowdsec utility will provide the community blocklist which contains highly
When used with crowdsec it will leverage the local API which will analyze traefik logs and take decisions on the requests made by users/bots. Malicious actors will be banned based on patterns against your website.
There are 4 operating modes (CrowdsecMode) for this plugin:
- none -> If the client IP is on ban list, it will get a http code 403 response.
Otherwise, request will continue as usual. All request call the Crowdsec LAPI
- live -> If the client IP is on ban list, it will get a http code 403 response.
Otherwise, request will continue as usual.
The bouncer can leverage use of a local cache in order to reduce the number
of requests made to the Crowdsec LAPI. It will keep in cache the status for
each IP that makes queries.
- stream -> Stream Streaming mode allows you to keep in the local cache only the Banned IPs,
every requests that does not hit the cache is authorized.
Every minute, the cache is updated with news from the Crowdsec LAPI.
- alone -> Streaming mode but the blacklisted IPs are fetched on the CAPI.
Every 2 hours, the cache is updated with news from the Crowdsec CAPI.
|------|------|
| Mode | Description |
|------|------|
| none | If the client IP is on ban list, it will get a http code 403 response. Otherwise, request will continue as usual. All request call the Crowdsec LAPI |
| live | If the client IP is on ban list, it will get a http code 403 response. Otherwise, request will continue as usual. The bouncer can leverage use of a local cache in order to reduce the number of requests made to the Crowdsec LAPI. It will keep in cache the status for each IP that makes queries. |
| stream | Stream Streaming mode allows you to keep in the local cache only the Banned IPs, every requests that does not hit the cache is authorized. Every minute, the cache is updated with news from the Crowdsec LAPI. |
| alone | Streaming mode but the blacklisted IPs are fetched on the CAPI. Every 2 hours, the cache is updated with news from the Crowdsec CAPI.|
|------|------|
The recommanded mode for performance is the streaming mode, decisions are updated every 60 sec by default and that's the only communication between traefik and crowdsec. Every requests that happens hits the cache for quick decisions.
@@ -66,11 +59,11 @@ The recommanded mode for performance is the streaming mode, decisions are update
- UpdateIntervalSeconds
- int64
- default: 60
- User only in `stream` mode, interval between fetching blacklisted IPs from LAPI
- Used only in `stream` mode, interval between fetching blacklisted IPs from LAPI
- DefaultDecisionSeconds
- int64
- default: 60
- User only in `live` mode, decision duration of accepted IPs
- Used only in `live` mode, decision duration of accepted IPs
### Configuration
@@ -233,4 +226,4 @@ We initially run into this project: https://github.com/fbonalair/traefik-crowdse
It was using traefik and forward auth middleware to verify every requests.
They had to go through a webserver which then contacts of another webservice (the crowdsec LAPI) to make a decision based on the source IP.
We initially proposed some improvement by implementing a streaming mode and a local cache.
With the Traefik hackathon we deciced to implement our solution directly as a traefik plugin which could be found by every one on plugins.traefik.io and be more performant.
With the Traefik hackathon we deciced to implement our solution directly as a traefik plugin which could be found by every one on plugins.traefik.io and be more performant.