mirror of
https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin.git
synced 2026-09-02 20:28:50 +02:00
Compare commits
2
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
57a97a0cf9 | ||
|
|
224669599e |
+1
-1
@@ -10,5 +10,5 @@ testData:
|
||||
crowdsec:
|
||||
bouncer:
|
||||
enabled: true
|
||||
crowdseclapikey: 40796d93c2958f9e58345514e67740e5
|
||||
crowdsecLapiKey: 40796d93c2958f9e58345514e67740e5
|
||||
|
||||
|
||||
@@ -2,11 +2,14 @@
|
||||
|
||||
# Crowdsec Bouncer Traefik plugin
|
||||
|
||||
This plugins aims to implement a Crowdsec Bouncer into a traefik plugin
|
||||
This plugins aims to implement a Crowdsec Bouncer into a traefik plugin.
|
||||
> [CrowdSec](https://www.crowdsec.net/) is an open-source and collaborative IPS (Intrusion Prevention System) and a security suite.
|
||||
> We leverage local behavior analysis and crowd power to build the largest CTI network in the world.
|
||||
|
||||
## Usage
|
||||
|
||||
|
||||
|
||||
### Configuration
|
||||
|
||||
For each plugin, the Traefik static configuration must define the module name (as is usual for Go packages).
|
||||
@@ -72,3 +75,20 @@ The source code of the plugin should be organized as follows:
|
||||
├── readme.md
|
||||
└── vendor/*
|
||||
```
|
||||
|
||||
For local developpement a docker-compose-local.yml is provided and reproduce the directory layout needed by traefik.
|
||||
|
||||
```bash
|
||||
docker-compose -f docker-compose-local.yml up -d
|
||||
```
|
||||
|
||||
### About
|
||||
|
||||
[maxlerebourg](https://github.com/maxlerebourg) and [I](https://github.com/mhanotaux) have been using traefik since 2020.
|
||||
We come from developper and security engineer background and wanted to add the power of a very promesing technologie (Crowdsec) into the edge router we love.
|
||||
|
||||
We initially run into this project: https://github.com/fbonalair/traefik-crowdsec-bouncer
|
||||
It was using traefik and forward auth middleware to verify every requests.
|
||||
They had to go through a webserver which then contacts of another webservice (the crowdsec LAPI) to make a decision based on the source IP.
|
||||
We initially proposed some improvement by implementing a streaming mode and a local cache
|
||||
With the Traefik hackathon we deciced to implement our solution directly as a traefik plugin which could be found by every one on plugins.traefik.io and be more performant.
|
||||
@@ -0,0 +1,56 @@
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.8.7"
|
||||
container_name: "traefik"
|
||||
command:
|
||||
# - "--log.level=DEBUG"
|
||||
- "--accesslog"
|
||||
- "--accesslog.filepath=/var/log/traefik/traefik.log"
|
||||
- "--api.insecure=true"
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--entrypoints.web.address=:80"
|
||||
- "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
- "logs:/var/log/traefik"
|
||||
- ./:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
ports:
|
||||
- 8000:80
|
||||
- 8080:8080
|
||||
|
||||
whoami:
|
||||
image: traefik/whoami
|
||||
container_name: "simple-service"
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.whoami.rule=Host(`localhost`)"
|
||||
- "traefik.http.routers.whoami.entrypoints=web"
|
||||
- "traefik.http.routers.whoami.middlewares=crowdsec@docker"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
|
||||
- "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
|
||||
|
||||
crowdsec:
|
||||
image: crowdsecurity/crowdsec:v1.4.1
|
||||
container_name: "crowdsec"
|
||||
command: rm -rf /etc/crowdsec/acquis.yaml
|
||||
environment:
|
||||
COLLECTIONS: crowdsecurity/traefik
|
||||
CUSTOM_HOSTNAME: crowdsec
|
||||
BOUNCER_KEY_TRAEFIK: 40796d93c2958f9e58345514e67740e5
|
||||
depends_on:
|
||||
- 'traefik'
|
||||
volumes:
|
||||
- ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
|
||||
- logs:/var/log/traefik:ro
|
||||
- crowdsec-db:/var/lib/crowdsec/data/
|
||||
- crowdsec-config:/etc/crowdsec/
|
||||
ports:
|
||||
- "8083:8080"
|
||||
|
||||
volumes:
|
||||
logs:
|
||||
crowdsec-db:
|
||||
crowdsec-config:
|
||||
+2
-4
@@ -2,7 +2,7 @@ version: "3.8"
|
||||
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v2.8.5"
|
||||
image: "traefik:v2.8.7"
|
||||
container_name: "traefik"
|
||||
command:
|
||||
# - "--log.level=DEBUG"
|
||||
@@ -12,12 +12,10 @@ services:
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--entrypoints.web.address=:80"
|
||||
|
||||
- "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
- "logs:/var/log/traefik"
|
||||
- ./:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
|
||||
ports:
|
||||
- 8000:80
|
||||
- 8080:8080
|
||||
@@ -45,7 +43,7 @@ services:
|
||||
- 'traefik'
|
||||
volumes:
|
||||
- ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
|
||||
- logs:/var/log/traefik
|
||||
- logs:/var/log/traefik:ro
|
||||
- crowdsec-db:/var/lib/crowdsec/data/
|
||||
- crowdsec-config:/etc/crowdsec/
|
||||
ports:
|
||||
|
||||
Reference in New Issue
Block a user