Add Missing line break for docker-compose

Change number of modes

Makefile

@@ -17,4 +17,26 @@ vendor:
 	go mod vendor
 
 clean:
-	rm -rf ./vendor
+	rm -rf ./vendor
+
+run_dev:
+	docker-compose -f docker-compose.dev.yml up -d --remove-orphans
+
+run_local:
+	docker-compose -f docker-compose.local.yml up -d --remove-orphans
+
+run:
+	docker-compose -f docker-compose.yml up -d --remove-orphans
+
+restart_docker_dev:
+	docker-compose -f docker-compose.dev.yml restart
+
+restart_docker_local:
+	docker-compose -f docker-compose.local.yml restart
+
+restart_docker:
+	docker-compose -f docker-compose.yml restart
+
+show_metrics:
+	docker exec crowdsec cscli metrics
+

README.md

@@ -16,26 +16,42 @@ The crowdsec utility will provide the community blocklist which contains highly
 
 When used with crowdsec it will leverage the local API which will analyze traefik logs and take decisions on the requests made by users/bots. Malicious actors will be banned based on patterns against your website.
 
-There are 4 operating modes (CrowdsecMode) for this plugin:
+There are 3 operating modes (CrowdsecMode) for this plugin:
 
 | Mode | Description |
 |------|------|
 | none | If the client IP is on ban list, it will get a http code 403 response. Otherwise, request will continue as usual. All request call the Crowdsec LAPI |
 | live | If the client IP is on ban list, it will get a http code 403 response. Otherwise, request will continue as usual.    The bouncer can leverage use of a local cache in order to reduce the number of requests made to the Crowdsec LAPI. It will keep in cache the status for  each IP that makes queries. |
 | stream | Stream Streaming mode allows you to keep in the local cache only the Banned IPs, every requests that does not hit the cache is authorized. Every minute, the cache is updated with news from the Crowdsec LAPI. |
-| alone | Streaming mode but the blacklisted IPs are fetched on the CAPI. Every 2 hours, the cache is updated with news from the Crowdsec CAPI.|
 
 The recommanded mode for performance is the streaming mode, decisions are updated every 60 sec by default and that's the only communication between traefik and crowdsec. Every requests that happens hits the cache for quick decisions.
 
 ## Usage
 
+To get started, use the `docker-compose.yml` file.
+
+You can run it with:
+```bash
+make run
+```
+
+### Note
+Each middleware in traefik has it's own data and is instanciated by service.
+This means if there are 10 services protected by the bouncer in streaming alone or live mode, the cache will be duplicated to all 10 services.
+This is because traefik does not allow plugins to store data locally that can be consummed.
+
+The synchronisation with the crowdsec service will happen also 10 times in the period selected.
+It should be taken into account when fixing this period so each middleware has time to sync data from crowdsec.
+
+At each start of synchronisation, the middleware will wait a random number of seconds to avoid simultaneous calls to crowdsec.
+
 ### Variables
 - Enabled
   - bool
   - enable the plugin
 - CrowdsecMode
   - string
-  - default: `stream`, expected value are: `none`, `live`, `stream`, `alone`
+  - default: `live`, expected value are: `none`, `live`, `stream`
 - CrowdsecLapiScheme
   - string
   - default: `http`, expected value are: `http`, `https`
@@ -45,16 +61,7 @@ The recommanded mode for performance is the streaming mode, decisions are update
   - Crowdsec LAPI available on which host.
 - CrowdsecLapiKey
   - string
-  - Crowdsec LAPI generated key for the bouncer. 
-- CrowdsecCapiLogin
-  - string
-  - Used only in `alone` mode, login for Crowdsec CAPI
-- CrowdsecCapiPwd
-  - string
-  - Used only in `alone` mode, password for Crowdsec CAPI
-- CrowdsecCapiScenarios
-  - []string
-  - Used only in `alone` mode, scenarios for Crowdsec CAPI
+  - Crowdsec LAPI generated key for the bouncer : **must be unique by service**. 
 - UpdateIntervalSeconds
   - int64
   - default: 60
@@ -109,17 +116,10 @@ http:
           crowdsecLapiKey: privateKey
           crowdsecLapiHost: crowdsec:8080
           crowdsecLapiScheme: http
-          crowdsecCapiLogin: login
-          crowdsecCapiPwd: password
-          crowdsecCapiScenarios:
-            - scenario1
-            - scenario2
-            ...
-
 ```
-Except for the crowdsecLapiKey, crowdsecCapiLogin, crowdsecCapiPwd, crowdsecCapiScenarios, these are the default value of the plugin.
+These are the default values of the plugin except for LapiKey.
 
-#### Generate LAPI KEY (exept for `alone` mode)
+#### Generate LAPI KEY
 You need to generate a crowdsec API key for the LAPI.
 You can follow the documentation here: https://docs.crowdsec.net/docs/user_guides/lapi_mgmt/
 
@@ -148,36 +148,6 @@ You can then run all the containers:
 docker-compose up -d
 ```
 
-#### Generate CAPI credentials (only for `alone` mode)
-You need to create a crowdsec API credentials for the CAPI.
-You can follow the documentation here: https://docs.crowdsec.net/docs/central_api/intro
-
-```bash
-curl -X POST "https://api.crowdsec.net/v2/watchers" -H  "accept: application/json" -H  "Content-Type: application/json" -d "{ \"password\": \"PASSWORD\",  \"machine_id\": \"LOGIN\"}"
-```
-
-These CAPI credentials must be set in your docker-compose.yml or in your config files
-```yaml
-...
-traefik:
-  command:
-    ...
-    - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-    - "--experimental.plugins.bouncer.version=v1.0.0"
-    ...
-whoami:
-  labels:
-    - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseccapilogin=LOGIN"
-    - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseccapipwd=PASSWORD"
-    - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseccapiscenarios=scenario1, scenario2, ..."
-    - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
-```
-
-You can then run all the containers:
-```bash
-docker-compose up -d
-```
-
 #### Add manually an IP to the blocklist (testing purpose)
 
 ```bash

bouncer.go

@@ -8,10 +8,10 @@ import (
 	"io"
 	"io/ioutil"
 	"log"
+	"math/rand"
 	"net"
 	"net/http"
 	"net/url"
-	"strings"
 	"text/template"
 	"time"
 
@@ -19,7 +19,6 @@ import (
 )
 
 const (
-	aloneMode               = "alone"
 	streamMode              = "stream"
 	liveMode                = "live"
 	noneMode                = "none"
@@ -27,39 +26,31 @@ const (
 	crowdsecCapiHeader      = "Authorization"
 	crowdsecLapiRoute       = "v1/decisions"
 	crowdsecLapiStreamRoute = "v1/decisions/stream"
-	crowdsecCapiLogin       = "v2/watchers/login"
-	crowdsecCapiDecisions   = "v2/decisions/stream"
 	cacheBannedValue        = "t"
 	cacheNoBannedValue      = "f"
 )
 
 // Config the plugin configuration.
 type Config struct {
-	Enabled                bool     `json:"enabled,omitempty"`
-	CrowdsecMode           string   `json:"crowdsecMode,omitempty"`
-	CrowdsecLapiScheme     string   `json:"crowdsecLapiScheme,omitempty"`
-	CrowdsecLapiHost       string   `json:"crowdsecLapiHost,omitempty"`
-	CrowdsecLapiKey        string   `json:"crowdsecLapiKey,omitempty"`
-	CrowdsecCapiLogin      string   `json:"crowdsecCapiLogin,omitempty"`
-	CrowdsecCapiPwd        string   `json:"crowdsecCapiPwd,omitempty"`
-	CrowdsecCapiScenarios  []string `json:"crowdsecCapiScenarios,omitempty"`
-	UpdateIntervalSeconds  int64    `json:"updateIntervalSeconds,omitempty"`
-	DefaultDecisionSeconds int64    `json:"defaultDecisionSeconds,omitempty"`
+	Enabled                bool   `json:"enabled,omitempty"`
+	CrowdsecMode           string `json:"crowdsecMode,omitempty"`
+	CrowdsecLapiScheme     string `json:"crowdsecLapiScheme,omitempty"`
+	CrowdsecLapiHost       string `json:"crowdsecLapiHost,omitempty"`
+	CrowdsecLapiKey        string `json:"crowdsecLapiKey,omitempty"`
+	UpdateIntervalSeconds  int64  `json:"updateIntervalSeconds,omitempty"`
+	DefaultDecisionSeconds int64  `json:"defaultDecisionSeconds,omitempty"`
 }
 
 // CreateConfig creates the default plugin configuration.
 func CreateConfig() *Config {
 	return &Config{
 		Enabled:                false,
-		CrowdsecMode:           aloneMode,
+		CrowdsecMode:           liveMode,
 		CrowdsecLapiScheme:     "http",
 		CrowdsecLapiHost:       "crowdsec:8080",
 		CrowdsecLapiKey:        "",
-		CrowdsecCapiLogin:      "",
-		CrowdsecCapiPwd:        "",
-		CrowdsecCapiScenarios:  []string{},
-		UpdateIntervalSeconds:  10,
-		DefaultDecisionSeconds: 10,
+		UpdateIntervalSeconds:  60,
+		DefaultDecisionSeconds: 60,
 	}
 }
 
@@ -77,9 +68,6 @@ type Bouncer struct {
 	crowdsecMode           string
 	updateInterval         int64
 	defaultDecisionTimeout int64
-	crowdsecLogin          string
-	crowdsecPwd            string
-	crowdsecScenarios      []string
 	client                 *http.Client
 	cache                  *ttl_map.Heap
 }
@@ -102,9 +90,6 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 		crowdsecScheme:         config.CrowdsecLapiScheme,
 		crowdsecHost:           config.CrowdsecLapiHost,
 		crowdsecKey:            config.CrowdsecLapiKey,
-		crowdsecLogin:          config.CrowdsecCapiLogin,
-		crowdsecPwd:            config.CrowdsecCapiPwd,
-		crowdsecScenarios:      config.CrowdsecCapiScenarios,
 		updateInterval:         config.UpdateIntervalSeconds,
 		defaultDecisionTimeout: config.DefaultDecisionSeconds,
 		client: &http.Client{
@@ -116,13 +101,14 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 		},
 		cache: ttl_map.New(),
 	}
-	if config.CrowdsecMode == streamMode || config.CrowdsecMode == aloneMode {
-		if config.CrowdsecMode == aloneMode {
-			getToken(bouncer)
-		}
-		ticker := time.NewTicker(time.Duration(config.UpdateIntervalSeconds) * time.Second)
+	if config.CrowdsecMode == streamMode {
 		go func() {
+			rand.Seed(time.Now().UnixNano())
+			timeout := rand.Int63n(30)
+			logger(fmt.Sprintf("Wait: %v", timeout))
+			time.Sleep(time.Duration(timeout) * time.Second)
 			go handleStreamCache(bouncer)
+			ticker := time.NewTicker(time.Duration(config.UpdateIntervalSeconds) * time.Second)
 			for range ticker.C {
 				go handleStreamCache(bouncer)
 			}
@@ -132,9 +118,9 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 }
 
 // ServeHTTP principal function of plugin.
-func (a *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
-	if !a.enabled {
-		a.next.ServeHTTP(rw, req)
+func (bouncer *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
+	if !bouncer.enabled {
+		bouncer.next.ServeHTTP(rw, req)
 		return
 	}
 
@@ -142,31 +128,31 @@ func (a *Bouncer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 	remoteHost, _, err := net.SplitHostPort(req.RemoteAddr)
 	if err != nil {
 		logger(fmt.Sprintf("failed to extract ip from remote address: %v", err))
-		a.next.ServeHTTP(rw, req)
+		bouncer.next.ServeHTTP(rw, req)
 		return
 	}
 
-	if a.crowdsecMode == streamMode || a.crowdsecMode == aloneMode || a.crowdsecMode == liveMode {
-		isBanned, err := getDecision(a, remoteHost)
+	if bouncer.crowdsecMode == streamMode || bouncer.crowdsecMode == liveMode {
+		isBanned, err := getDecision(bouncer, remoteHost)
 		if err == nil {
 			if isBanned {
 				rw.WriteHeader(http.StatusForbidden)
 			} else {
-				a.next.ServeHTTP(rw, req)
+				bouncer.next.ServeHTTP(rw, req)
 			}
 			return
 		}
 	}
 
 	// Right here if we cannot join the stream we forbid the request to go on.
-	if a.crowdsecMode == streamMode || a.crowdsecMode == aloneMode {
-		if a.crowdsecStreamHealthy {
-			a.next.ServeHTTP(rw, req)
+	if bouncer.crowdsecMode == streamMode {
+		if bouncer.crowdsecStreamHealthy {
+			bouncer.next.ServeHTTP(rw, req)
 		} else {
 			rw.WriteHeader(http.StatusForbidden)
 		}
 	} else {
-		handleNoStreamCache(a, rw, req, remoteHost)
+		handleNoStreamCache(bouncer, rw, req, remoteHost)
 	}
 }
 
@@ -203,8 +189,8 @@ func logger(str string) {
 }
 
 func contains(source []string, target string) bool {
-	for _, a := range source {
-		if a == target {
+	for _, item := range source {
+		if item == target {
 			return true
 		}
 	}
@@ -213,8 +199,8 @@ func contains(source []string, target string) bool {
 
 // Get Decision check in the cache if the IP has the banned / not banned value.
 // Otherwise return with an error to add the IP in cache if we are on.
-func getDecision(a *Bouncer, clientIP string) (bool, error) {
-	banned, isCached := a.cache.Get(clientIP)
+func getDecision(bouncer *Bouncer, clientIP string) (bool, error) {
+	banned, isCached := bouncer.cache.Get(clientIP)
 	bannedString, isValid := banned.(string)
 	if isCached && isValid && len(bannedString) > 0 {
 		return bannedString == cacheBannedValue, nil
@@ -222,31 +208,31 @@ func getDecision(a *Bouncer, clientIP string) (bool, error) {
 	return false, fmt.Errorf("no cache data")
 }
 
-func setDecision(a *Bouncer, clientIP string, isBanned bool, duration int64) {
-	if a.crowdsecMode == noneMode {
+func setDecision(bouncer *Bouncer, clientIP string, isBanned bool, duration int64) {
+	if bouncer.crowdsecMode == noneMode {
 		return
 	}
 	if isBanned {
 		logger(fmt.Sprintf("%v banned", clientIP))
-		a.cache.Set(clientIP, cacheBannedValue, duration)
+		bouncer.cache.Set(clientIP, cacheBannedValue, duration)
 	} else {
-		a.cache.Set(clientIP, cacheNoBannedValue, duration)
+		bouncer.cache.Set(clientIP, cacheNoBannedValue, duration)
 	}
 }
 
-func handleNoStreamCache(a *Bouncer, rw http.ResponseWriter, req *http.Request, remoteHost string) {
+func handleNoStreamCache(bouncer *Bouncer, rw http.ResponseWriter, req *http.Request, remoteHost string) {
 	// We are now in none or live mode.
 	routeURL := url.URL{
-		Scheme:   a.crowdsecScheme,
-		Host:     a.crowdsecHost,
+		Scheme:   bouncer.crowdsecScheme,
+		Host:     bouncer.crowdsecHost,
 		Path:     crowdsecLapiRoute,
 		RawQuery: fmt.Sprintf("ip=%v&banned=true", remoteHost),
 	}
-	body := crowdsecQuery(a, routeURL.String(), false)
+	body := crowdsecQuery(bouncer, routeURL.String())
 
 	if bytes.Equal(body, []byte("null")) {
-		setDecision(a, remoteHost, false, a.defaultDecisionTimeout)
-		a.next.ServeHTTP(rw, req)
+		setDecision(bouncer, remoteHost, false, bouncer.defaultDecisionTimeout)
+		bouncer.next.ServeHTTP(rw, req)
 		return
 	}
 
@@ -258,8 +244,8 @@ func handleNoStreamCache(a *Bouncer, rw http.ResponseWriter, req *http.Request,
 		return
 	}
 	if len(decisions) == 0 {
-		setDecision(a, remoteHost, false, a.defaultDecisionTimeout)
-		a.next.ServeHTTP(rw, req)
+		setDecision(bouncer, remoteHost, false, bouncer.defaultDecisionTimeout)
+		bouncer.next.ServeHTTP(rw, req)
 		return
 	}
 	rw.WriteHeader(http.StatusForbidden)
@@ -268,102 +254,50 @@ func handleNoStreamCache(a *Bouncer, rw http.ResponseWriter, req *http.Request,
 		logger(fmt.Sprintf("failed to parse duration: %s", err))
 		return
 	}
-	setDecision(a, remoteHost, true, int64(duration.Seconds()))
+	setDecision(bouncer, remoteHost, true, int64(duration.Seconds()))
 }
 
-func handleStreamCache(a *Bouncer) {
-	logger(fmt.Sprintf("Start handleStreamCache with health=%v", a.crowdsecStreamHealthy))
+func handleStreamCache(bouncer *Bouncer) {
 	// TODO clean properly on exit.
-	var rawQuery string
-	var path string
-	if a.crowdsecMode == aloneMode {
-		rawQuery = ""
-		path = crowdsecCapiDecisions
-	} else {
-		rawQuery = fmt.Sprintf("startup=%t", !a.crowdsecStreamHealthy)
-		path = crowdsecLapiStreamRoute
-	}
 	streamRouteURL := url.URL{
-		Scheme:   a.crowdsecScheme,
-		Host:     a.crowdsecHost,
-		Path:     path,
-		RawQuery: rawQuery,
+		Scheme:   bouncer.crowdsecScheme,
+		Host:     bouncer.crowdsecHost,
+		Path:     crowdsecLapiStreamRoute,
+		RawQuery: fmt.Sprintf("startup=%t", !bouncer.crowdsecStreamHealthy),
 	}
-	body := crowdsecQuery(a, streamRouteURL.String(), false)
+	body := crowdsecQuery(bouncer, streamRouteURL.String())
 	var stream Stream
 	err := json.Unmarshal(body, &stream)
 	if err != nil {
 		logger(fmt.Sprintf("error while parsing body: %s", err))
-		a.crowdsecStreamHealthy = false
+		bouncer.crowdsecStreamHealthy = false
 		return
 	}
 	for _, decision := range stream.New {
 		duration, err := time.ParseDuration(decision.Duration)
 		if err == nil {
-			setDecision(a, decision.Value, true, int64(duration.Seconds()))
+			setDecision(bouncer, decision.Value, true, int64(duration.Seconds()))
 		}
 	}
 	for _, decision := range stream.Deleted {
-		a.cache.Del(decision.Value)
+		bouncer.cache.Del(decision.Value)
 	}
-	a.crowdsecStreamHealthy = true
+	bouncer.crowdsecStreamHealthy = true
 }
 
-func getToken(a *Bouncer) {
-	loginURL := url.URL{
-		Scheme: a.crowdsecScheme,
-		Host:   a.crowdsecHost,
-		Path:   crowdsecCapiLogin,
-	}
-	body := crowdsecQuery(a, loginURL.String(), true)
-	var login Login
-	err := json.Unmarshal(body, &login)
-	if err != nil {
-		logger(fmt.Sprintf("error while parsing body: %s", err))
-		a.crowdsecStreamHealthy = false
-		return
-	}
-	if login.Code == 200 && len(login.Token) > 0 {
-		a.crowdsecKey = login.Token
-	}
-}
-
-func crowdsecQuery(a *Bouncer, stringURL string, isPost bool) []byte {
+func crowdsecQuery(bouncer *Bouncer, stringURL string) []byte {
 	var req *http.Request
-	if isPost {
-		data := []byte(fmt.Sprintf(
-			`{"machine_id": "%v","password": "%v","scenarios": ["%v"]}`,
-			a.crowdsecLogin,
-			a.crowdsecPwd,
-			strings.Join(a.crowdsecScenarios, `","`),
-		))
-		req, _ = http.NewRequest(http.MethodPost, stringURL, bytes.NewBuffer(data))
-	} else {
-		req, _ = http.NewRequest(http.MethodGet, stringURL, nil)
-	}
-	if a.crowdsecMode == aloneMode {
-		req.Header.Add(crowdsecCapiHeader, a.crowdsecKey)
-	} else {
-		req.Header.Add(crowdsecLapiHeader, a.crowdsecKey)
-	}
-	res, err := a.client.Do(req)
+	req, _ = http.NewRequest(http.MethodGet, stringURL, nil)
+	req.Header.Add(crowdsecLapiHeader, bouncer.crowdsecKey)
+	res, err := bouncer.client.Do(req)
 	if err != nil {
 		logger(fmt.Sprintf("error while fetching %v: %s", stringURL, err))
-		a.crowdsecStreamHealthy = false
+		bouncer.crowdsecStreamHealthy = false
 		return nil
 	}
-	if res.StatusCode == http.StatusUnauthorized && a.crowdsecMode == aloneMode {
-		oldToken := a.crowdsecKey
-		getToken(a)
-		if oldToken == a.crowdsecKey {
-			a.crowdsecStreamHealthy = false
-			return nil
-		}
-		return crowdsecQuery(a, stringURL, false)
-	}
 	if res.StatusCode != http.StatusOK {
 		logger(fmt.Sprintf("error while fetching %v, status code: %d", stringURL, res.StatusCode))
-		a.crowdsecStreamHealthy = false
+		bouncer.crowdsecStreamHealthy = false
 		return nil
 	}
 	defer func(body io.ReadCloser) {
@@ -375,43 +309,26 @@ func crowdsecQuery(a *Bouncer, stringURL string, isPost bool) []byte {
 	body, err := ioutil.ReadAll(res.Body)
 	if err != nil {
 		logger(fmt.Sprintf("error while reading body: %s", err))
-		a.crowdsecStreamHealthy = false
+		bouncer.crowdsecStreamHealthy = false
 		return nil
 	}
 	return body
 }
 
 func validateParams(config *Config) error {
-	var requiredStrings map[string]string
-	if config.CrowdsecMode == aloneMode {
-		requiredStrings = map[string]string{
-			"CrowdsecCapiLogin": config.CrowdsecLapiScheme,
-			"CrowdsecCapiPwd":   config.CrowdsecLapiHost,
-		}
-		for _, val := range config.CrowdsecCapiScenarios {
-			if len(val) == 0 {
-				return fmt.Errorf("CrowdsecCapiScenarios: one or more scenario are empty")
-			}
-		}
-		config.UpdateIntervalSeconds = 7200
-		config.CrowdsecLapiKey = ""
-		config.CrowdsecLapiScheme = "https"
-		config.CrowdsecLapiHost = "api.crowdsec.net"
-	} else {
-		requiredStrings = map[string]string{
-			"CrowdsecLapiScheme": config.CrowdsecLapiScheme,
-			"CrowdsecLapiHost":   config.CrowdsecLapiHost,
-			"CrowdsecLapiKey":    config.CrowdsecLapiKey,
-			"CrowdsecMode":       config.CrowdsecMode,
-		}
-		requiredInt := map[string]int64{
-			"UpdateIntervalSeconds":  config.UpdateIntervalSeconds,
-			"DefaultDecisionSeconds": config.DefaultDecisionSeconds,
-		}
-		for key, val := range requiredInt {
-			if val < 1 {
-				return fmt.Errorf("%v: cannot be less than 1", key)
-			}
+	requiredStrings := map[string]string{
+		"CrowdsecLapiScheme": config.CrowdsecLapiScheme,
+		"CrowdsecLapiHost":   config.CrowdsecLapiHost,
+		"CrowdsecLapiKey":    config.CrowdsecLapiKey,
+		"CrowdsecMode":       config.CrowdsecMode,
+	}
+	requiredInt := map[string]int64{
+		"UpdateIntervalSeconds":  config.UpdateIntervalSeconds,
+		"DefaultDecisionSeconds": config.DefaultDecisionSeconds,
+	}
+	for key, val := range requiredInt {
+		if val < 1 {
+			return fmt.Errorf("%v: cannot be less than 1", key)
 		}
 	}
 	for key, val := range requiredStrings {
@@ -419,7 +336,7 @@ func validateParams(config *Config) error {
 			return fmt.Errorf("%v: cannot be empty", key)
 		}
 	}
-	if !contains([]string{noneMode, liveMode, streamMode, aloneMode}, config.CrowdsecMode) {
+	if !contains([]string{noneMode, liveMode, streamMode}, config.CrowdsecMode) {
 		return fmt.Errorf("CrowdsecMode: must be one of 'none', 'live' or 'stream'")
 	}
 	if !contains([]string{"http", "https"}, config.CrowdsecLapiScheme) {

bouncer_test.go

@@ -1,22 +1,20 @@
-package crowdsec_bouncer_traefik_plugin_test
+package crowdsec_bouncer_traefik_plugin
 
 import (
 	"context"
 	"net/http"
 	"net/http/httptest"
 	"testing"
-
-	crowdsec_bouncer_traefik_plugin "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
 )
 
 func TestCrowdSec(t *testing.T) {
-	cfg := crowdsec_bouncer_traefik_plugin.CreateConfig()
-	cfg.CrowdsecLapiKey = "caca"
+	cfg := CreateConfig()
+	cfg.CrowdsecLapiKey = "test"
 
 	ctx := context.Background()
 	next := http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {})
 
-	handler, err := crowdsec_bouncer_traefik_plugin.New(ctx, next, cfg, "demo-plugin")
+	handler, err := New(ctx, next, cfg, "demo-plugin")
 	if err != nil {
 		t.Fatal(err)
 	}

docker-compose.local.yml

@@ -2,7 +2,7 @@ version: "3.8"
 
 services:
   traefik:
-    image: "traefik:v2.8.7"
+    image: "traefik:v2.8.8"
     container_name: "traefik"
     command:
       # - "--log.level=DEBUG"
@@ -16,7 +16,7 @@ services:
       - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
-      - logs:/var/log/traefik
+      - logs-local:/var/log/traefik
       - ./:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
     labels:
       - "traefik.enable=true"
@@ -26,7 +26,7 @@ services:
       - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseccapipwd=Q5pgN8bRNInHGdx6QCksdPOJVLeLQ7ipJntSeuP3r8088zXzRVs4G8liXAKfI1k6"
       - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseccapiscenarios=crowdsecurity/http-backdoors-attempts,baudneo/zoneminder-bf"
     ports:
-      - 8000:80
+      - 80:80
       - 8080:8080
     depends_on:
       - crowdsec
@@ -36,35 +36,48 @@ services:
     container_name: "simple-service1"
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.whoami.rule=Host(`localhost`)"
-      - "traefik.http.routers.whoami.entrypoints=web"
-      - "traefik.http.routers.whoami.middlewares=crowdsec@docker"
-      - "traefik.http.services.whoami.loadbalancer.server.port=80"
+      # Definition of the router
+      - "traefik.http.routers.router1.rule=Host(`localhost`) && Path(`/foo`)"
+      - "traefik.http.routers.router1.entrypoints=web"
+      - "traefik.http.routers.router1.middlewares=crowdsec1@docker" 
+      # Definition of the service
+      - "traefik.http.services.service1.loadbalancer.server.port=80"
+      # Definitin of the middleware
+      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
   whoami2:
     image: traefik/whoami
     container_name: "simple-service2"
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.whoami.rule=Host(`localhost`)"
-      - "traefik.http.routers.whoami.entrypoints=web"
-      - "traefik.http.routers.whoami.middlewares=crowdsec@docker"
-      - "traefik.http.services.whoami.loadbalancer.server.port=80"
+      # Definition of the router
+      - "traefik.http.routers.router2.rule=Host(`localhost`) && Path(`/bar`)"
+      - "traefik.http.routers.router2.entrypoints=web"
+      - "traefik.http.routers.router2.middlewares=crowdsec2@docker"
+      # Definition of the service
+      - "traefik.http.services.service2.loadbalancer.server.port=80"
+      # Definitin of the middleware
+      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
 
   crowdsec:
     image: crowdsecurity/crowdsec:v1.4.1
     container_name: "crowdsec"
-    command: rm -rf /etc/crowdsec/acquis.yaml
     environment:
       COLLECTIONS: crowdsecurity/traefik
       CUSTOM_HOSTNAME: crowdsec
-      BOUNCER_KEY_TRAEFIK: 40796d93c2958f9e58345514e67740e5
+      BOUNCER_KEY_TRAEFIK_1: 40796d93c2958f9e58345514e67740e5
+      BOUNCER_KEY_TRAEFIK_2: 44c36dac5c4140af9f06f397508e82c7
     volumes:
       - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
-      - logs:/var/log/traefik:ro
-      - crowdsec-db:/var/lib/crowdsec/data/
-      - crowdsec-config:/etc/crowdsec/
-
+      - logs-local:/var/log/traefik:ro
+      - crowdsec-db-local:/var/lib/crowdsec/data/
+      - crowdsec-config-local:/etc/crowdsec/
+    labels:
+      - "traefik.enable=false"
 volumes:
-  logs:
-  crowdsec-db:
-  crowdsec-config:
+  logs-local:
+  crowdsec-db-local:
+  crowdsec-config-local:

docker-compose.yml

@@ -2,7 +2,7 @@ version: "3.8"
 
 services:
   traefik:
-    image: "traefik:v2.8.7"
+    image: "traefik:v2.8.8"
     container_name: "traefik"
     command:
       # - "--log.level=DEBUG"
@@ -14,6 +14,7 @@ services:
       - "--entrypoints.web.address=:80"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
+      - "--experimental.plugins.bouncer.version=v1.0.6"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
       - "logs:/var/log/traefik"
@@ -23,32 +24,56 @@ services:
     depends_on:
       - 'crowdsec'
 
-  whoami:
+  whoami1:
     image: traefik/whoami
-    container_name: "simple-service"
+    container_name: "simple-service-1"
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.whoami.rule=Host(`localhost`)"
-      - "traefik.http.routers.whoami.entrypoints=web"
-      - "traefik.http.routers.whoami.middlewares=crowdsec@docker"
-      - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
-      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY"
+      # Definition of the router
+      - "traefik.http.routers.router1.rule=Host(`localhost`) && Path(`/foo`)"
+      - "traefik.http.routers.router1.entrypoints=web"
+      - "traefik.http.routers.router1.middlewares=crowdsec2@docker"
+      # Definition of the service
+      - "traefik.http.services.service1.loadbalancer.server.port=80"
+      # Definitin of the middleware
+      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec1.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-1"
+  
+  whoami2:
+    image: traefik/whoami
+    container_name: "simple-service-2"
+    labels:
+      - "traefik.enable=true"
+      # Definition of the router
+      - "traefik.http.routers.router2.rule=Host(`localhost`) && Path(`/bar`)"
+      - "traefik.http.routers.router2.entrypoints=web"
+      - "traefik.http.routers.router2.middlewares=crowdsec2@docker"
+      # Definition of the service
+      - "traefik.http.services.service2.loadbalancer.server.port=80"
+      # Definitin of the middleware
+      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.enabled=true"
+      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec2.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-2"
 
   crowdsec:
     image: crowdsecurity/crowdsec:v1.4.1
     container_name: "crowdsec"
-    command: rm -rf /etc/crowdsec/acquis.yaml
     environment:
       COLLECTIONS: crowdsecurity/traefik
       CUSTOM_HOSTNAME: crowdsec
-      BOUNCER_KEY_TRAEFIK: FIXME-LAPI-KEY
+      # We need to register one api key per service we will use
+      BOUNCER_KEY_TRAEFIK_1: FIXME-LAPI-KEY-1
+      BOUNCER_KEY_TRAEFIK_2: FIXME-LAPI-KEY-2
     volumes:
       - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
       - logs:/var/log/traefik:ro
       - crowdsec-db:/var/lib/crowdsec/data/
       - crowdsec-config:/etc/crowdsec/
+    labels:
+      - "traefik.enable=false"
 
 volumes:
   logs:
   crowdsec-db:
-  crowdsec-config:
+  crowdsec-config: