Compare commits

..
2 Commits
Author SHA1 Message Date
mathieuHaandMathieuHa 57a97a0cf9 Update readme and solve traefiker error (#6)
* Update readme, add about sectioj

* Update readme about

* Change parameter with capitalized letters

* Add docker-compose local and docker-compose for real world utilization

* Update readme and .traefik

Co-authored-by: MathieuHa <mathieu@hanotaux.fr>
2022-09-28 22:16:03 +02:00
mathieuHaandMathieuHa 224669599e Updates .traefik with good name parameter (#4)
* Update readme, add about sectioj

* Update readme about

* Change parameter with capitalized letters

Co-authored-by: MathieuHa <mathieu@hanotaux.fr>
2022-09-28 21:39:15 +02:00
4 changed files with 80 additions and 6 deletions
+1 -1
View File
@@ -10,5 +10,5 @@ testData:
crowdsec: crowdsec:
bouncer: bouncer:
enabled: true enabled: true
crowdseclapikey: 40796d93c2958f9e58345514e67740e5 crowdsecLapiKey: 40796d93c2958f9e58345514e67740e5
+21 -1
View File
@@ -2,11 +2,14 @@
# Crowdsec Bouncer Traefik plugin # Crowdsec Bouncer Traefik plugin
This plugins aims to implement a Crowdsec Bouncer into a traefik plugin This plugins aims to implement a Crowdsec Bouncer into a traefik plugin.
> [CrowdSec](https://www.crowdsec.net/) is an open-source and collaborative IPS (Intrusion Prevention System) and a security suite.
> We leverage local behavior analysis and crowd power to build the largest CTI network in the world.
## Usage ## Usage
### Configuration ### Configuration
For each plugin, the Traefik static configuration must define the module name (as is usual for Go packages). For each plugin, the Traefik static configuration must define the module name (as is usual for Go packages).
@@ -72,3 +75,20 @@ The source code of the plugin should be organized as follows:
├── readme.md ├── readme.md
└── vendor/* └── vendor/*
``` ```
For local developpement a docker-compose-local.yml is provided and reproduce the directory layout needed by traefik.
```bash
docker-compose -f docker-compose-local.yml up -d
```
### About
[maxlerebourg](https://github.com/maxlerebourg) and [I](https://github.com/mhanotaux) have been using traefik since 2020.
We come from developper and security engineer background and wanted to add the power of a very promesing technologie (Crowdsec) into the edge router we love.
We initially run into this project: https://github.com/fbonalair/traefik-crowdsec-bouncer
It was using traefik and forward auth middleware to verify every requests.
They had to go through a webserver which then contacts of another webservice (the crowdsec LAPI) to make a decision based on the source IP.
We initially proposed some improvement by implementing a streaming mode and a local cache
With the Traefik hackathon we deciced to implement our solution directly as a traefik plugin which could be found by every one on plugins.traefik.io and be more performant.
+56
View File
@@ -0,0 +1,56 @@
version: "3.8"
services:
traefik:
image: "traefik:v2.8.7"
container_name: "traefik"
command:
# - "--log.level=DEBUG"
- "--accesslog"
- "--accesslog.filepath=/var/log/traefik/traefik.log"
- "--api.insecure=true"
- "--providers.docker=true"
- "--providers.docker.exposedbydefault=false"
- "--entrypoints.web.address=:80"
- "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
volumes:
- "/var/run/docker.sock:/var/run/docker.sock:ro"
- "logs:/var/log/traefik"
- ./:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
ports:
- 8000:80
- 8080:8080
whoami:
image: traefik/whoami
container_name: "simple-service"
labels:
- "traefik.enable=true"
- "traefik.http.routers.whoami.rule=Host(`localhost`)"
- "traefik.http.routers.whoami.entrypoints=web"
- "traefik.http.routers.whoami.middlewares=crowdsec@docker"
- "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
crowdsec:
image: crowdsecurity/crowdsec:v1.4.1
container_name: "crowdsec"
command: rm -rf /etc/crowdsec/acquis.yaml
environment:
COLLECTIONS: crowdsecurity/traefik
CUSTOM_HOSTNAME: crowdsec
BOUNCER_KEY_TRAEFIK: 40796d93c2958f9e58345514e67740e5
depends_on:
- 'traefik'
volumes:
- ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
- logs:/var/log/traefik:ro
- crowdsec-db:/var/lib/crowdsec/data/
- crowdsec-config:/etc/crowdsec/
ports:
- "8083:8080"
volumes:
logs:
crowdsec-db:
crowdsec-config:
+2 -4
View File
@@ -2,7 +2,7 @@ version: "3.8"
services: services:
traefik: traefik:
image: "traefik:v2.8.5" image: "traefik:v2.8.7"
container_name: "traefik" container_name: "traefik"
command: command:
# - "--log.level=DEBUG" # - "--log.level=DEBUG"
@@ -12,12 +12,10 @@ services:
- "--providers.docker=true" - "--providers.docker=true"
- "--providers.docker.exposedbydefault=false" - "--providers.docker.exposedbydefault=false"
- "--entrypoints.web.address=:80" - "--entrypoints.web.address=:80"
- "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin" - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
volumes: volumes:
- "/var/run/docker.sock:/var/run/docker.sock:ro" - "/var/run/docker.sock:/var/run/docker.sock:ro"
- "logs:/var/log/traefik" - "logs:/var/log/traefik"
- ./:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
ports: ports:
- 8000:80 - 8000:80
- 8080:8080 - 8080:8080
@@ -45,7 +43,7 @@ services:
- 'traefik' - 'traefik'
volumes: volumes:
- ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
- logs:/var/log/traefik - logs:/var/log/traefik:ro
- crowdsec-db:/var/lib/crowdsec/data/ - crowdsec-db:/var/lib/crowdsec/data/
- crowdsec-config:/etc/crowdsec/ - crowdsec-config:/etc/crowdsec/
ports: ports: