🍱 push .local

* Update readme, add about sectioj

* Update readme about

* Change parameter with capitalized letters

* Add docker-compose local and docker-compose for real world utilization

* Update readme and .traefik

* update readme and docker-compose

* Update .traefik

Co-authored-by: MathieuHa <mathieu@hanotaux.fr>

.traefik.yml

@@ -7,7 +7,6 @@ import: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
 summary: 'Crowdsec Bouncer Traefik Plugin'
 
 testData:
-  bouncer:
+  Enabled: false
-    enabled: true
+  CrowdsecLapiKey: 40796d93c2958f9e58345514e67740e5
-    crowdsecLapiKey: 40796d93c2958f9e58345514e67740e5
 

README.md

@@ -12,7 +12,7 @@ The crowdsec utility will provide the community blocklist which contains highly
 
 When used with crowdsec it will leverage the local API which will analyze traefik logs and take decisions on the requests made by users/bots. Malicious actors will be banned based on patterns against your website.
 
-There is 3 operating mode for this plugin:
+There are 3 operating modes (CrowdsecMode) for this plugin:
 - none -> If the client IP is on ban list, it will get a http code 403 response.
          Otherwise, request will continue as usual. All request call the Crowdsec LAPI
 
@@ -42,7 +42,7 @@ The following declaration (given here in YAML) defines a plugin:
 # Static configuration
 
 experimental:
-  localPlugins:
+  plugins:
     bouncer:
       moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
 ```
@@ -58,7 +58,7 @@ http:
       entryPoints:
         - web
       middlewares:
-        - my-plugin
+        - crowdsec
 
   services:
     service-foo:
@@ -70,14 +70,15 @@ http:
     crowdsec:
       plugin:
         bouncer:
-          enabled: true
+          enabled: false
-          crowdseclapikey: 40796d93c2958f9e58345514e67740e5
+          crowdsecLapiKey: privateKey
+          crowdsecLapiHost: crowdsec:8080
+          crowdsecLapiScheme: http
+          crowdsecMode: stream
           updateIntervalSeconds: 60
           defaultDecisionSeconds: 60
-          crowdsecLapiHost: 
-          crowdsecLapiScheme: 
-          crowdsecMode: stream
 ```
+Except for the crowdsecLapiKey, these are the default value of the plugin.
 
 ### Local Mode
 
@@ -103,8 +104,35 @@ The source code of the plugin should be organized as follows:
                     └── vendor/* 
 ```
 
-For local developpement a docker-compose-local.yml is provided and reproduce the directory layout needed by traefik. This works once you have generated and filled your LAPI-KEY, if not look below for informations
+For local developpement a docker-compose.local.yml is provided and reproduce the directory layout needed by traefik. This works once you have generated and filled your LAPI-KEY (crowdsecLapiKey), if not look below for informations
 
+```bash
+docker-compose -f docker-compose.local.yml up -d
+```
+
+#### Generate LAPI-KEY
+You need to generate a crowdsec API key for the LAPI.
+You can follow the documentation here: https://docs.crowdsec.net/docs/user_guides/lapi_mgmt/
+
+```bash
+docker-compose -f docker-compose.local.yml up -d crowdsec
+docker exec crowdsec cscli bouncers add TRAEFIK
+```
+
+This LApi key must be set where is noted FIXME-LAPI-KEY in the docker-compose-test.yml
+```yaml
+...
+whoami:
+  labels:
+    - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY"
+...
+crowdsec:
+  environment:
+    BOUNCER_KEY_TRAEFIK: FIXME-LAPI-KEY
+...
+```
+
+You can then run all the containers:
 ```bash
 docker-compose -f docker-compose-local.yml up -d
 ```
@@ -140,16 +168,17 @@ docker-compose -f docker-compose-local.yml up -d
 
 ```bash
 docker-compose -f docker-compose-local.yml up -d crowdsec
-docker exec crowdsec cscli decisions add --ip 10.0.0.10
+docker exec crowdsec cscli decisions add --ip 10.0.0.10 # this will be effective 4h
+docker exec crowdsec cscli decisions remove --ip 10.0.0.10
 ```
 
 ### About
 
 [maxlerebourg](https://github.com/maxlerebourg) and [I](https://github.com/mhanotaux) have been using traefik since 2020.
-We come from developper and security engineer background and wanted to add the power of a very promesing technologie (Crowdsec) into the edge router we love.
+We come from web developper and security engineer background and wanted to add the power of a very promesing technology (Crowdsec) into the edge router we love.
 
 We initially run into this project: https://github.com/fbonalair/traefik-crowdsec-bouncer
 It was using traefik and forward auth middleware to verify every requests.
 They had to go through a webserver which then contacts of another webservice (the crowdsec LAPI) to make a decision based on the source IP.
-We initially proposed some improvement by implementing a streaming mode and a local cache
+We initially proposed some improvement by implementing a streaming mode and a local cache.
 With the Traefik hackathon we deciced to implement our solution directly as a traefik plugin which could be found by every one on plugins.traefik.io and be more performant.

docker-compose.local.yml

@@ -12,6 +12,7 @@ services:
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
       - "--entrypoints.web.address=:80"
+
       - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"

docker-compose.yml

@@ -12,7 +12,8 @@ services:
       - "--providers.docker=true"
       - "--providers.docker.exposedbydefault=false"
       - "--entrypoints.web.address=:80"
-      - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+
+      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
       - "logs:/var/log/traefik"