mirror of
https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin.git
synced 2026-07-21 19:48:59 +02:00
26ce12f7e3
* ⬆️ bump example image versions to latest stable Align every docker-compose and Helm-values example on the same set: - Traefik v3.0.0 / v3.5.0 → v3.7.1 - Crowdsec v1.6.1-2 / v1.6.8 / latest → v1.7.8 - Plugin pin v1.3.0 / v1.4.5 / v1.5.0 → v1.6.0 No env / volume changes needed: every Crowdsec example already mounts /var/lib/crowdsec/data, so the v1.7 strict volume check is already satisfied (CROWDSEC_BYPASS_DB_VOLUME_CHECK is only required when running without persistence, as in the E2E suite). * 🤖 chore: adopt Renovate (weekly, self-hosted) to replace manual version bumps Automate the kind of bump this PR did by hand. Renovate covers what Dependabot could not reach here: - example docker-compose image tags (traefik / crowdsec) — native manager; - the plugin self-pin (`experimental.plugins.bouncer.version=` in compose args and `version:` in the Traefik Helm values) — customManager, github-tags; - the Crowdsec/Traefik image tags in the Helm values (no `repository` key, so matched by file) — customManager, docker; - the pinned Traefik binary in the e2e mock suite (`TRAEFIK_VERSION`) — customManager, github-releases; - go.mod + GitHub Actions — native managers (this is why we drop Dependabot: running both would open duplicate PRs). Runs weekly via a self-hosted workflow (Mondays 04:00 UTC, plus manual dispatch). Needs a RENOVATE_TOKEN secret (documented in the workflow). Renovate PRs trigger the existing e2e CI, so a Traefik/Crowdsec bump is validated to actually boot and bounce before merge. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * 🔒 ci: pin Go to 1.22 (yaegi ceiling) and cap Renovate's Go updates The plugin is interpreted by yaegi, bundled in Traefik. Even the latest Traefik (v3.7.1) ships yaegi v0.16.1, which only supports Go 1.22 — so the plugin's real ceiling is Go 1.22 on every current Traefik, regardless of the Go version Traefik itself is built with. - main.yml: build/test on Go 1.22 (was 1.23) so `go build`/`go test` reject newer stdlib early; yaegi v0.16.1 stays the required yaegi_test guard. - renovate.json: cap the go.mod `go`/`toolchain` directive at `<1.23` so Renovate keeps deps/actions/toolchain current but never pushes the plugin past what yaegi supports. Raise the cap when Traefik ships a newer yaegi. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * 🐛 ci(renovate): stop ignoring examples/ and tests/ so custom managers run config:recommended ships a default ignorePaths that excludes **/examples/** and **/tests/** (and **/vendor/**). That silently disabled 4 of the 5 custom managers and all example/helm coverage this PR adds — Renovate only saw the root docker-compose, go.mod and workflows. Override ignorePaths to keep only vendor/node_modules. Verified via `renovate --platform=local --dry-run=full`: package files detected go from 7 -> 32, and every custom manager now extracts its dep (plugin self-pin across 11 compose files, traefik/crowdsec helm tags, e2e TRAEFIK_VERSION pin). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * ⏪ chore: drop one-time example version bumps, let Renovate own them The manual version catch-up across the example docker-compose files and the Helm values is now redundant: Renovate (this PR) covers all of them via its native docker-compose/docker managers plus the custom managers for the plugin self-pin and the e2e Traefik binary. Reverting these files to keep the PR a clean "adopt Renovate" change; Renovate will open the bump PRs itself. Note: examples/tls-auth uses crowdsecurity/crowdsec:latest again — Renovate does not pin rolling tags, so that one stays floating unless pinned separately. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * 📌 examples(tls-auth): pin crowdsec to v1.6.8 instead of :latest Rolling `latest` tags aren't reproducible and Renovate can't manage them. v1.6.8 is already the crowdsec tag used in the root docker-compose files and, unlike the `-2` build-suffixed tags, Renovate bumps it (→ v1.7.8). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * 📌 examples: normalize crowdsec v1.6.1-2 -> v1.6.8 so Renovate can manage it Renovate's docker versioning won't advance a build-suffixed tag (v1.6.1-2) to a clean release (v1.7.8), so those 8 examples would have stayed frozen. v1.6.8 is already used in the root compose files and Renovate bumps it. Also updated the captcha README snippet to match its compose. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * 🍱 group all + no dashboard + branch prefix --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: maxlerebourg <maxlerebourg@gmail.com>
Example
Using Trusted IP (ex: LAN OR VPN) that won't get filtered by crowdsec
You need to configure your Traefik to trust Forwarded headers by your front proxy In the example we use a whoami container protected by crowdsec, and we ban our IP before allowing using TrustedIPs
If you are using another proxy in front, you need to add its IP in the trusted IP for the forwarded headers. This helps Traefik choose the right IP of the client: see https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers The "internal" Traefik instance is configured to trust the forward headers
- "--entrypoints.web.forwardedheaders.trustedips=172.21.0.5"
We configure the middleware to trust as well as the IP of the intermediate proxy if needed:
- "traefik.http.middlewares.crowdsec.plugin.bouncer.forwardedheaderstrustedips=172.21.0.5"
Add your IP to the ban list
docker exec crowdsec cscli decisions add --ip 10.0.10.30 -d 10m
You should get a 403 on http://localhost/foo
Replace 10.0.10.30 by your IP
Add the IPs that will not be filtered by the plugin
- "traefik.http.middlewares.crowdsec.plugin.bouncer.clientTrustedips=10.0.10.30/32"
Replace 10.0.10.30/32 by your IP or IP range, so it's not getting checked against ban cache of crowdsec
You should get a 200 on http://localhost/foo even if you are on the ban cache
To play the demo environment run:
make run_trustedips