🐛 Update regex to support = in lapikey update some exemples with 1.5.3 crowdsec (#115)

cannot unmarshal bool into Go struct field EnvVar.spec.template.spec.containers.env.value of type string

README.md

@@ -29,7 +29,7 @@ There are 4 operating modes (CrowdsecMode) for this plugin:
 The `streaming mode` is recommended for performance, decisions are updated every 60 sec by default and that's the only communication between Traefik and Crowdsec. Every request that happens hits the cache for quick decisions.
 
 The cache can be local to Traefik using the filesystem, or a separate Redis instance.  
-Support for Redis is currently in beta (requires version 7.0.X of Redis).
+
 
 ## Usage
 
@@ -44,6 +44,7 @@ make run
 
 **/!\ Cache is shared by all services**
 *This means if an IP is banned, all services which are protected by an instance of the plugin will deny requests from that IP*
+Only one instance of the plugin is *possible*.
 
 ### Variables
 - Enabled
@@ -111,6 +112,10 @@ make run
   - string 
   - default: ""
   - Database selection for the Redis service
+- HTTPTimeoutSeconds
+  - int64
+  - default: 10
+  - Default timeout in seconds for contacting Crowdsec LAPI
 - UpdateIntervalSeconds
   - int64
   - default: 60
@@ -172,6 +177,7 @@ http:
           logLevel: DEBUG
           updateIntervalSeconds: 60
           defaultDecisionSeconds: 60
+          httpTimeoutSeconds: 10
           crowdsecMode: live
           crowdsecLapiKey: privateKey-foo
           crowdsecLapiKeyFile: /etc/traefik/cs-privateKey-foo

bouncer.go

@@ -137,7 +137,7 @@ func New(ctx context.Context, next http.Handler, config *configuration.Config, n
 				IdleConnTimeout: 30 * time.Second,
 				TLSClientConfig: tlsConfig,
 			},
-			Timeout: 10 * time.Second,
+			Timeout: time.Duration(config.HTTPTimeoutSeconds) * time.Second,
 		},
 		cacheClient: &cache.Client{},
 	}

docker-compose.local.yml

@@ -2,7 +2,7 @@ version: "3.8"
 
 services:
   traefik:
-    image: "traefik:v2.9.10"
+    image: "traefik:v2.10.4"
     container_name: "traefik"
     restart: unless-stopped
     command:
@@ -36,7 +36,7 @@ services:
       - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" 
       - "traefik.http.services.service-foo.loadbalancer.server.port=80"
       - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5="
 
   whoami2:
     image: traefik/whoami
@@ -49,17 +49,16 @@ services:
       - "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker"
       - "traefik.http.services.service-bar.loadbalancer.server.port=80"
       - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5="
 
   crowdsec:
-    image: crowdsecurity/crowdsec:v1.4.6
+    image: crowdsecurity/crowdsec:v1.5.3
     container_name: "crowdsec"
     restart: unless-stopped
     environment:
       COLLECTIONS: crowdsecurity/traefik
       CUSTOM_HOSTNAME: crowdsec
-      BOUNCER_KEY_TRAEFIK_1: 40796d93c2958f9e58345514e67740e5
+      BOUNCER_KEY_TRAEFIK: 40796d93c2958f9e58345514e67740e5=
-      BOUNCER_KEY_TRAEFIK_2: 44c36dac5c4140af9f06f397508e82c7
     volumes:
       - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
       - logs-local:/var/log/traefik:ro

docker-compose.yml

@@ -2,7 +2,7 @@ version: "3.8"
 
 services:
   traefik:
-    image: "traefik:v2.9.10"
+    image: "traefik:v2.10.4"
     container_name: "traefik"
     restart: unless-stopped
     command:
@@ -14,7 +14,7 @@ services:
       - "--entrypoints.web.address=:80"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.1.11"
+      - "--experimental.plugins.bouncer.version=v1.1.15"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
       - "logs:/var/log/traefik"
@@ -39,7 +39,7 @@ services:
       # Definition of the middleware
       - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
       # crowdseclapikey must be unique to the middleware attached to the service
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-1"
+      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-1="
       # forwardedheaderstrustedips should be the IP of the proxy that is in front of traefik (if any)
       - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
   
@@ -58,20 +58,19 @@ services:
       # Definitin of the middleware
       - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
       # crowdseclapikey must be unique to the middleware attached to the service
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-2"
+      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY-1="
       # forwardedheaderstrustedips should be the IP of the proxy that is in front of traefik (if any)
       - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
 
   crowdsec:
-    image: crowdsecurity/crowdsec:v1.4.6
+    image: crowdsecurity/crowdsec:v1.5.3
     container_name: "crowdsec"
     restart: unless-stopped
     environment:
       COLLECTIONS: crowdsecurity/traefik
       CUSTOM_HOSTNAME: crowdsec
       # We need to register one api key per service we will use
-      BOUNCER_KEY_TRAEFIK_1: FIXME-LAPI-KEY-1
+      BOUNCER_KEY_TRAEFIK: FIXME-LAPI-KEY-1=
-      BOUNCER_KEY_TRAEFIK_2: FIXME-LAPI-KEY-2
     volumes:
       - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
       - logs:/var/log/traefik:ro

exemples/behind-proxy/docker-compose.cloudflare.yml

@@ -2,7 +2,7 @@ version: "3.8"
 
 services:
   cloudflare:
-    image: "traefik:v2.9.10"
+    image: "traefik:v2.10.4"
     container_name: "cloudflare"
     restart: unless-stopped
     command:
@@ -21,7 +21,7 @@ services:
       - 8080:8080
 
   traefik:
-    image: "traefik:v2.9.10"
+    image: "traefik:v2.10.4"
     container_name: "traefik"
     restart: unless-stopped
     command:
@@ -35,7 +35,7 @@ services:
       - "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.1.11"
+      - "--experimental.plugins.bouncer.version=v1.1.13"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - logs-traefik:/var/log/traefik
@@ -57,13 +57,12 @@ services:
       - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" 
       # Definition of the service
       - "traefik.http.services.service-foo.loadbalancer.server.port=80"
-      # Definitin of the middleware
+      # Definition of the middleware
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
-      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecmode=live"
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdsecmode=live"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG"
   
   whoami-bar:
     image: traefik/whoami
@@ -77,24 +76,22 @@ services:
       - "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker" 
       # Definition of the service
       - "traefik.http.services.service-bar.loadbalancer.server.port=80"
-      # Definitin of the middleware
+      # Definition of the middleware
       - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
-      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecmode=live"
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecmode=live"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG"
   
 
   crowdsec:
-    image: crowdsecurity/crowdsec:v1.4.6
+    image: crowdsecurity/crowdsec:v1.5.2
     container_name: "crowdsec"
     restart: unless-stopped
     environment:
       COLLECTIONS: crowdsecurity/traefik
       CUSTOM_HOSTNAME: crowdsec
-      BOUNCER_KEY_TRAEFIK_DEV_1: 40796d93c2958f9e58345514e67740e5
+      BOUNCER_KEY_TRAEFIK_DEV: 40796d93c2958f9e58345514e67740e5
-      BOUNCER_KEY_TRAEFIK_DEV_2: 44c36dac5c4140af9f06f397508e82c7
     volumes:
       - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
       - logs-cloudflare:/var/log/traefik:ro

exemples/binary-vm/scripts/install_traefik.sh

@@ -2,7 +2,7 @@
 
 DEBIAN_FRONTEND=noninteractive sudo apt-get update && sudo apt-get install wget -y
 # DEBIAN_FRONTEND=noninteractive sudo apt-get upgrade -y --assume-yes
-wget -O traefik.tar.gz "https://github.com/traefik/traefik/releases/download/v2.9.10/traefik_v2.9.10_linux_amd64.tar.gz"
+wget -O traefik.tar.gz "https://github.com/traefik/traefik/releases/download/v2.10.4/traefik_v2.10.4_linux_amd64.tar.gz"
 tar -zxvf traefik.tar.gz
 # inspired from https://gist.github.com/ubergesundheit/7c9d875befc2d7bfd0bf43d8b3862d85
 sudo mv ./traefik /usr/local/bin/

exemples/kubernetes/crowdsec/values.yml

@@ -1,5 +1,5 @@
 image:
-  tag: v1.4.6
+  tag: v1.5.2
 
 agent:
   acquisition:
@@ -22,4 +22,4 @@ lapi:
       value: "k8s linux test"
     # If it's a test, we don't want to share signals with CrowdSec so disable the Online API.
     - name: DISABLE_ONLINE_API
-      value: true
+      value: "true"

exemples/kubernetes/traefik/values.yml

@@ -1,5 +1,5 @@
 image:
-  tag: v2.9.10
+  tag: v2.10.4
 
 logs:
   general:
@@ -16,4 +16,4 @@ experimental:
 
 additionalArguments:
   - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-  - "--experimental.plugins.bouncer.version=v1.1.11"
+  - "--experimental.plugins.bouncer.version=v1.1.13"

exemples/redis-cache/docker-compose.redis.yml

@@ -2,7 +2,7 @@ version: "3.8"
 
 services:
   traefik:
-    image: "traefik:v2.9.10"
+    image: "traefik:v2.10.4"
     container_name: "traefik"
     restart: unless-stopped
     command:
@@ -15,7 +15,7 @@ services:
       - "--entrypoints.web.address=:80"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.1.11"
+      - "--experimental.plugins.bouncer.version=v1.1.13"
       # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
@@ -26,29 +26,29 @@ services:
       - 8080:8080
     depends_on:
       - crowdsec
-      - redis-insecure
+      # - redis-insecure
       - redis-secure
 
-  whoami-redis-insecure:
+# Either use secure, or insecure but do not mix both
-    image: traefik/whoami
+  # whoami-redis-insecure:
-    container_name: "simple-service-foo"
+  #   image: traefik/whoami
-    restart: unless-stopped
+  #   container_name: "simple-service-foo"
-    labels:
+  #   restart: unless-stopped
-      - "traefik.enable=true"
+  #   labels:
-      # Definition of the router
+  #     - "traefik.enable=true"
-      - "traefik.http.routers.router-foo.rule=Path(`/redis-insecure`)"
+  #     # Definition of the router
-      - "traefik.http.routers.router-foo.entrypoints=web"
+  #     - "traefik.http.routers.router-foo.rule=Path(`/redis-insecure`)"
-      - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" 
+  #     - "traefik.http.routers.router-foo.entrypoints=web"
-      # Definition of the service
+  #     - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" 
-      - "traefik.http.services.service-foo.loadbalancer.server.port=80"
+  #     # Definition of the service
-      # Definition of the middleware
+  #     - "traefik.http.services.service-foo.loadbalancer.server.port=80"
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
+  #     # Definition of the middleware
-      # crowdseclapikey must be uniq to the middleware attached to the service
+  #     - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
+  #     - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.rediscacheenabled=true"
+  #     - "traefik.http.middlewares.crowdsec.plugin.bouncer.rediscacheenabled=true"
-      # Contact redis-unsecure without a password
+  #     # Contact redis-unsecure without a password
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.rediscachehost=redis-insecure:6379"
+  #     - "traefik.http.middlewares.crowdsec.plugin.bouncer.rediscachehost=redis-insecure:6379"
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG"
+  #     - "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
 
   whoami-redis-secure:
     image: traefik/whoami
@@ -63,25 +63,23 @@ services:
       # Definition of the service
       - "traefik.http.services.service-bar.loadbalancer.server.port=80"
       # Definition of the middleware
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
-      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.rediscacheenabled=true"
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.rediscacheenabled=true"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.rediscachepassword=FIXME"
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.rediscachepassword=FIXME"
       # Contact redis-secure with password
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.rediscachehost=redis-secure:6379"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.rediscachehost=redis-secure:6379"
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
 
 
   crowdsec:
-    image: crowdsecurity/crowdsec:v1.4.6
+    image: crowdsecurity/crowdsec:v1.5.2
     container_name: "crowdsec"
     restart: unless-stopped
     environment:
       COLLECTIONS: crowdsecurity/traefik
       CUSTOM_HOSTNAME: crowdsec
-      BOUNCER_KEY_TRAEFIK_DEV_1: 40796d93c2958f9e58345514e67740e5
+      BOUNCER_KEY_TRAEFIK_DEV: 40796d93c2958f9e58345514e67740e5
-      BOUNCER_KEY_TRAEFIK_DEV_2: 44c36dac5c4140af9f06f397508e82c7
     volumes:
       - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
       - logs-redis:/var/log/traefik:ro
@@ -91,7 +89,7 @@ services:
       - "traefik.enable=false"
 
   redis-secure:
-    image: "redis:7.0.9-alpine"
+    image: "redis:7.0.12-alpine"
     container_name: "redis-secure"
     hostname: redis-secure
     restart: unless-stopped
@@ -99,14 +97,14 @@ services:
     volumes:
       - redis-secure-data:/data
   
-  redis-insecure:
+  # redis-insecure:
-    image: "redis:7.0.9-alpine"
+  #   image: "redis:7.0.12-alpine"
-    container_name: "redis-insecure"
+  #   container_name: "redis-insecure"
-    hostname: redis-unsecure
+  #   hostname: redis-unsecure
-    restart: unless-stopped
+  #   restart: unless-stopped
-    command: "redis-server --save 60 1 --loglevel debug"
+  #   command: "redis-server --save 60 1 --loglevel debug"
-    volumes:
+  #   volumes:
-      - redis-unsecure-data:/data
+  #     - redis-unsecure-data:/data
 
 volumes:
   logs-redis:

exemples/standalone-mode/docker-compose.alone.yml

@@ -2,7 +2,7 @@ version: "3.8"
 
 services:
   traefik:
-    image: "traefik:v2.9.10"
+    image: "traefik:v2.10.4"
     container_name: "traefik"
     restart: unless-stopped
     command:
@@ -15,7 +15,7 @@ services:
       - "--entrypoints.web.address=:80"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.1.11"
+      - "--experimental.plugins.bouncer.version=v1.1.13"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
     ports:

exemples/tls-auth/docker-compose.tls-auth.yml

@@ -2,7 +2,7 @@ version: "3.8"
 
 services:
   traefik:
-    image: "traefik:v2.9.10"
+    image: "traefik:v2.10.4"
     container_name: "traefik"
     restart: unless-stopped
     command:
@@ -15,14 +15,14 @@ services:
       - "--entrypoints.web.address=:80"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.1.11"
+      - "--experimental.plugins.bouncer.version=v1.1.13"
       # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - ./LAPIKEY:/etc/traefik/LAPIKEY:ro
       - logs-tls-auth:/var/log/traefik
       - crowdsec-certs-tls-auth:/etc/traefik/crowdsec-certs
-      - ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
+      # - ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
 
     ports:
       - 80:80
@@ -30,22 +30,24 @@ services:
     depends_on:
       - crowdsec
 
-  whoami-foo:
+# Use HTTPS scheme but with lapikey authentication
-    image: traefik/whoami
+  # whoami-foo:
-    container_name: "simple-service-foo"
+  #   image: traefik/whoami
-    restart: unless-stopped
+  #   container_name: "simple-service-foo"
-    labels:
+  #   restart: unless-stopped
-      - "traefik.enable=true"
+  #   labels:
-      - "traefik.http.routers.router-foo.rule=Path(`/foo`)"
+  #     - "traefik.enable=true"
-      - "traefik.http.routers.router-foo.entrypoints=web"
+  #     - "traefik.http.routers.router-foo.rule=Path(`/foo`)"
-      - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" 
+  #     - "traefik.http.routers.router-foo.entrypoints=web"
-      - "traefik.http.services.service-foo.loadbalancer.server.port=80"
+  #     - "traefik.http.routers.router-foo.middlewares=crowdsec-foo@docker" 
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
+  #     - "traefik.http.services.service-foo.loadbalancer.server.port=80"
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG"
+  #     - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
+  #     - "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapischeme=https"
+  #     - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdsecLapiTLSCertificateAuthorityFile=/etc/traefik/crowdsec-certs/inter.pem"
+  #     - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapischeme=https"
+  #     - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecLapiTLSCertificateAuthorityFile=/etc/traefik/crowdsec-certs/inter.pem"
 
+# Use HTTPS scheme with TLS cert authentication
   whoami-bar:
     image: traefik/whoami
     container_name: "simple-service-bar"
@@ -56,15 +58,15 @@ services:
       - "traefik.http.routers.router-bar.entrypoints=web"
       - "traefik.http.routers.router-bar.middlewares=crowdsec-bar@docker"
       - "traefik.http.services.service-bar.loadbalancer.server.port=80"
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapischeme=https"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapischeme=https"
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecLapiTLSCertificateAuthorityFile=/etc/traefik/crowdsec-certs/inter.pem"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecLapiTLSCertificateAuthorityFile=/etc/traefik/crowdsec-certs/inter.pem"
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecLapiTLSCertificateBouncerFile=/etc/traefik/crowdsec-certs/bouncer.pem"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecLapiTLSCertificateBouncerFile=/etc/traefik/crowdsec-certs/bouncer.pem"
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdsecLapiTLSCertificateBouncerKeyFile=/etc/traefik/crowdsec-certs/bouncer-key.pem"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecLapiTLSCertificateBouncerKeyFile=/etc/traefik/crowdsec-certs/bouncer-key.pem"
 
   crowdsec:
-    image: crowdsecurity/crowdsec:v1.4.6
+    image: crowdsecurity/crowdsec:v1.5.2
     container_name: "crowdsec"
     restart: unless-stopped
     environment:

exemples/trusted-ips/docker-compose.trusted.yml

@@ -2,7 +2,7 @@ version: "3.8"
 
 services:
   traefik:
-    image: "traefik:v2.9.10"
+    image: "traefik:v2.10.4"
     container_name: "traefik"
     restart: unless-stopped
     command:
@@ -15,12 +15,12 @@ services:
       - "--entrypoints.web.address=:80"
 
       - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.1.11"
+      - "--experimental.plugins.bouncer.version=v1.1.13"
       # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - logs-trustedips:/var/log/traefik
-      - ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
+      # - ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
     ports:
       - 80:80
       - 8080:8080
@@ -40,12 +40,11 @@ services:
       # Definition of the service
       - "traefik.http.services.service-foo.loadbalancer.server.port=80"
       # Definition of the middleware
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.enabled=true"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
-      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
       # Replace 10.0.10.30/32 by your IP range which is "trusted"
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.clienttrustedips=10.0.10.30/32"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.clienttrustedips=10.0.10.30/32"
-      - "traefik.http.middlewares.crowdsec-foo.plugin.bouncer.loglevel=DEBUG"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
   
   whoami2:
     image: traefik/whoami
@@ -60,23 +59,21 @@ services:
       # Definition of the service
       - "traefik.http.services.service-bar.loadbalancer.server.port=80"
       # Definition of the middleware
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.enabled=true"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
-      # crowdseclapikey must be uniq to the middleware attached to the service
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5"
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.crowdseclapikey=44c36dac5c4140af9f06f397508e82c7"
       # Replace 10.0.10.30/32 by your IP range which is "trusted"
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.clienttrustedips=10.0.10.30/32"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.clienttrustedips=10.0.10.30/32"
-      - "traefik.http.middlewares.crowdsec-bar.plugin.bouncer.loglevel=DEBUG"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
 
 
   crowdsec:
-    image: crowdsecurity/crowdsec:v1.4.6
+    image: crowdsecurity/crowdsec:v1.5.2
     container_name: "crowdsec"
     restart: unless-stopped
     environment:
       COLLECTIONS: crowdsecurity/traefik
       CUSTOM_HOSTNAME: crowdsec
-      BOUNCER_KEY_TRAEFIK_DEV_1: 40796d93c2958f9e58345514e67740e5
+      BOUNCER_KEY_TRAEFIK_DEV: 40796d93c2958f9e58345514e67740e5
-      BOUNCER_KEY_TRAEFIK_DEV_2: 44c36dac5c4140af9f06f397508e82c7
     volumes:
       - ./acquis.yaml:/etc/crowdsec/acquis.yaml:ro
       - logs-trustedips:/var/log/traefik:ro

go.mod

@@ -4,5 +4,5 @@ go 1.19
 
 require (
 	github.com/leprosus/golang-ttl-map v1.1.7
-	github.com/maxlerebourg/simpleredis v1.0.7
+	github.com/maxlerebourg/simpleredis v1.0.9
 )

go.sum

@@ -1,4 +1,4 @@
 github.com/leprosus/golang-ttl-map v1.1.7 h1:cF4AAFDDnJTFSV+/42sKLhmMluvLdRlCGS2UaifH6UM=
 github.com/leprosus/golang-ttl-map v1.1.7/go.mod h1:4QWHJPeVBbrkhOhXdhCv9IEiyj/YzkO04/iexy4vSe0=
-github.com/maxlerebourg/simpleredis v1.0.7 h1:d53p3GOIgQtxxWuqsWMGTJ0dZjP8UhiDX8L1q2QZ/vY=
+github.com/maxlerebourg/simpleredis v1.0.9 h1:aj1hKaYPeOVE4Ksu3TV/zsreUDDWOpKXBAvoFysiqII=
-github.com/maxlerebourg/simpleredis v1.0.7/go.mod h1:/DH8zOK6kDskSqoX/m5CJJdNGfkIQZd/ERBJgytDDSk=
+github.com/maxlerebourg/simpleredis v1.0.9/go.mod h1:/DH8zOK6kDskSqoX/m5CJJdNGfkIQZd/ERBJgytDDSk=

pkg/configuration/configuration.go

@@ -50,6 +50,7 @@ type Config struct {
 	CrowdsecCapiScenarios                    []string `json:"crowdsecCapiScenarios,omitempty"`
 	UpdateIntervalSeconds                    int64    `json:"updateIntervalSeconds,omitempty"`
 	DefaultDecisionSeconds                   int64    `json:"defaultDecisionSeconds,omitempty"`
+	HTTPTimeoutSeconds                       int64    `json:"httpTimeoutSeconds,omitempty"`
 	ForwardedHeadersCustomName               string   `json:"forwardedheaderscustomheader,omitempty"`
 	ForwardedHeadersTrustedIPs               []string `json:"forwardedHeadersTrustedIps,omitempty"`
 	ClientTrustedIPs                         []string `json:"clientTrustedIps,omitempty"`
@@ -81,6 +82,7 @@ func New() *Config {
 		CrowdsecLapiTLSInsecureVerify: false,
 		UpdateIntervalSeconds:         60,
 		DefaultDecisionSeconds:        60,
+		HTTPTimeoutSeconds:            10,
 		ForwardedHeadersCustomName:    "X-Forwarded-For",
 		ForwardedHeadersTrustedIPs:    []string{},
 		ClientTrustedIPs:              []string{},
@@ -193,7 +195,7 @@ func ValidateParams(config *Config) error {
 // valid ! # $ % & ' * + - . ^ _ ` | ~ DIGIT ALPHA
 // See https://httpwg.github.io/specs/rfc7230.html#rule.token.separators
 func validateParamsAPIKey(lapiKey string) error {
-	reg := regexp.MustCompile("^[a-zA-Z0-9 !#$%&'*+-.^_`|~]*$")
+	reg := regexp.MustCompile("^[a-zA-Z0-9 !#$%&'*+-.^_`|~=]*$")
 	if !reg.Match([]byte(lapiKey)) {
 		return fmt.Errorf("CrowdsecLapiKey doesn't valid this regexp: '/%s/'", reg.String())
 	}
@@ -241,6 +243,7 @@ func validateParamsRequired(config *Config) error {
 	requiredInt := map[string]int64{
 		"UpdateIntervalSeconds":  config.UpdateIntervalSeconds,
 		"DefaultDecisionSeconds": config.DefaultDecisionSeconds,
+		"HTTPTimeoutSeconds":     config.HTTPTimeoutSeconds,
 	}
 	for key, val := range requiredInt {
 		if val < 1 {

vendor/github.com/maxlerebourg/simpleredis/simpleredis.go

@@ -18,6 +18,7 @@ const (
 	RedisMiss        = "redis:miss"
 	RedisTimeout     = "redis:timeout"
 	RedisNoAuth      = "redis:noauth"
+	RedisIssue      = "redis:issue?"
 )
 
 // A redisCmd is used to communicate with redis at low level using commands.
@@ -70,12 +71,11 @@ func (sr *SimpleRedis) waitRedis(reader *textproto.Reader, channel chan redisCmd
 	}
 }
 
-func (sr *SimpleRedis) askRedis(cmd redisCmd, channel chan redisCmd) {
+func (sr *SimpleRedis) askRedis(cmd redisCmd, channel chan redisCmd) redisCmd {
 	dialer := net.Dialer{Timeout: 2 * time.Second}
 	conn, err := dialer.Dial("tcp", sr.host)
 	if err != nil {
-		channel <- redisCmd{Error: fmt.Errorf(RedisUnreachable)}
+		return redisCmd{Error: fmt.Errorf(RedisUnreachable)}
-		return
 	}
 	defer func() {
 		if err := conn.Close(); err != nil {
@@ -111,24 +111,22 @@ func (sr *SimpleRedis) askRedis(cmd redisCmd, channel chan redisCmd) {
 		for {
 			select {
 			case <-time.After(time.Second * 1):
-				channel <- redisCmd{Error: fmt.Errorf(RedisTimeout)}
+				return redisCmd{Error: fmt.Errorf(RedisTimeout)}
-				return
 			default:
 				read, _ := reader.ReadLineBytes()
 				str := string(read)
 				if strings.Contains(str, "-NOAUTH") {
-					channel <- redisCmd{Error: fmt.Errorf(RedisNoAuth)}
+					return redisCmd{Error: fmt.Errorf(RedisNoAuth)}
-					return
 				} else if str != "$1" {
-					channel <- redisCmd{Error: fmt.Errorf(RedisMiss)}
+					return redisCmd{Error: fmt.Errorf(RedisMiss)}
-					return
 				}
 				read, _ = reader.ReadLineBytes()
-				channel <- redisCmd{Data: read}
+				return redisCmd{Data: read}
-				return
+				
 			}
 		}
 	}
+	return redisCmd{Error: fmt.Errorf(RedisIssue)}
 }
 
 // Init sets the redisHost used to connect to redis.
@@ -145,8 +143,7 @@ func (sr *SimpleRedis) Get(name string) ([]byte, error) {
 		Name:    name,
 	}
 	channel := make(chan redisCmd)
-	go sr.askRedis(cmd, channel)
+	resp := sr.askRedis(cmd, channel)
-	resp := <-channel
 	if resp.Error != nil {
 		return nil, resp.Error
 	}
@@ -161,7 +158,7 @@ func (sr *SimpleRedis) Set(name string, data []byte, duration int64) error {
 		Data:     data,
 		Duration: duration,
 	}
-	go sr.askRedis(cmd, nil)
+	sr.askRedis(cmd, nil)
 	return nil
 }
 
@@ -171,6 +168,6 @@ func (sr *SimpleRedis) Del(name string) error {
 		Command: "DEL",
 		Name:    name,
 	}
-	go sr.askRedis(cmd, nil)
+	sr.askRedis(cmd, nil)
 	return nil
 }

vendor/modules.txt

@@ -1,6 +1,6 @@
 # github.com/leprosus/golang-ttl-map v1.1.7
 ## explicit; go 1.15
 github.com/leprosus/golang-ttl-map
-# github.com/maxlerebourg/simpleredis v1.0.7
+# github.com/maxlerebourg/simpleredis v1.0.9
 ## explicit; go 1.19
 github.com/maxlerebourg/simpleredis