feat: adds crowdsec

.env.sample

@@ -159,10 +159,6 @@ WRITE_TIMEOUT=0s
 #COMPOSE_FILE="$COMPOSE_FILE:compose.smtp.yml"
 #SMTP_ENABLED=1
 
-## PGSQL recipe open port 5432
-#COMPOSE_FILE="$COMPOSE_FILE:compose.pgsql.yml"
-#PGSQL_ENABLED=1
-
 ## Compy
 #COMPOSE_FILE="$COMPOSE_FILE:compose.compy.yml"
 #COMPY_ENABLED=1
@@ -227,8 +223,11 @@ WRITE_TIMEOUT=0s
 #ANUBIS_SERVE_ROBOTS_TXT=true
 #ANUBIS_SLOG_LEVEL=INFO
 
-## Anubis metrics
-#COMPOSE_FILE="$COMPOSE_FILE:compose.anubis-metrics.yml"
+## Crowdsec
+#COMPOSE_FILE="$COMPOSE_FILE:compose.crowdsec.yml"
+#CROWDSEC_ENABLED=1
+#CROWDSEC_BOUNCER_ENABLED=1
+#CROWDSEC_TRAEFIK_BOUNCER_API_KEY="some-api-key"
 
 ## Enable onion service support
 #ONION_ENABLED=1

README.md

@@ -5,7 +5,7 @@
 > https://docs.traefik.io
 
 <!-- metadata -->
-* **Maintainer**: [@p4u1](https://git.coopcloud.tech/p4u1), [@javielico](https://git.coopcloud.tech/javielico), Local-IT: [@moritz](https://git.coopcloud.tech/moritz), [@msimon](https://git.coopcloud.tech/simon), [@carla](https://git.coopcloud.tech/carla)
+* **Maintainer**: [@p4u1](https://git.coopcloud.tech/p4u1), [@decentral1se](https://git.coopcloud.tech/decentral1se), [@javielico](https://git.coopcloud.tech/javielico), Local-IT: [@moritz](https://git.coopcloud.tech/moritz), [@msimon](https://git.coopcloud.tech/simon), [@carla](https://git.coopcloud.tech/carla)
 * **Status**: `stable`
 * **Category**: Utilities
 * **Features**: ?
@@ -72,8 +72,51 @@ After deploying these changes, go to each recipe that supports Anubis
 and follow the process there.  **Enabling Anubis here is not enough for
 protection your apps.**
 
-If you want to collect Prometheus metrics for Anubis, for instance with
-[monitoring-ng](/monitoring-ng), uncomment the "Anubis metrics" section.
+## Crowdsec
+
+IMPORTANT even though Crowdsec is Open Source, the software sends information of the attacker IP and what decision(ban or captcha) to a centralized server for communit managed block lists.
+
+On first deployment you need to generate an empty secret, because the lapi key is created at runtime.
+```
+abra app secret insert <domain> crowdsec_lapi_key v1
+```
+
+Then deploy your traefik recipe with the crowdsec compose and variables enabled and set `CROWDSEC_BOUNCER_ENABLED=0` to prevent initializing the bouncer that has no key yet.
+
+When traefik is running, generate the LAPI key with the following command:
+```
+abra app run <domain> crowdsec cscli bouncers add crowdsecBouncer
+```
+
+After that insert the LAPI key(command below) and redeploy traefik with `CROWDSEC_BOUNCER_ENABLED=1` and `CROWDSEC_TRAEFIK_CONFIG_VERSION=v2`.
+```
+abra app secret insert <domain> crowdsec_lapi_key v2 -f -t <path-to/lapi-key-file>
+```
+
+When it is up and running go to the recipe you want to protect and add the following snippet and redeploy.
+```
+---
+version: "3.8"
+services:
+  app:
+    deploy:
+      labels:
+        - "traefik.http.routers.${STACK_NAME}.middlewares=crowdsec@file"
+```
+
+You can see if it is working by checking the ban list.
+```
+abra app run <domain> crowdsec cscli decisions list
+```
+
+When there are not bans yet you can try by banning your own IP.
+```
+abra app run <domain> crowdsec cscli decisions add --ip <your-ip> -d 10m # this will be effective 10min
+```
+Remove it with:
+```
+abra app run <domain> crowdsec cscli decisions remove --ip <your-ip> # this can still take a few minutes because of cache
+```
 
 ## Enabling onion service
 

abra.sh

@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v34
-export FILE_PROVIDER_YML_VERSION=v14
-export ENTRYPOINT_VERSION=v8
-export IOCAINE_ENTRYPOINT_VERSION=v1
+export TRAEFIK_YML_VERSION=v33
+export FILE_PROVIDER_YML_VERSION=v15
+export ENTRYPOINT_VERSION=v5
+export CROWDSEC_TRAEFIK_CONFIG_VERSION=v1

anubis.yml.tmpl

@@ -1,7 +0,0 @@
-bots:
-- import: (data)/meta/default-config.yaml
-{{ if eq (env "ANUBIS_METRICS_ENABLED") "true" }}
-metrics:
-  bind: ":9090"
-  network: "tcp"
-{{ end }}

compose.anubis-metrics.yml

@@ -1,11 +0,0 @@
----
-version: "3.8"
-services:
-  anubis:
-    environment:
-      ANUBIS_METRICS_ENABLED: "true"
-    deploy:
-      labels:
-      - "prometheus.io/scrape=true"
-      - "prometheus.io/port=9090"
-      - "prometheus.io/path=/metrics"

compose.anubis.yml

@@ -7,7 +7,7 @@ services:
       - "traefik.http.middlewares.anubis.forwardauth.address=http://anubis:8080/.within.website/x/cmd/anubis/api/check"
       - "traefik.http.middlewares.anubis.forwardauth.trustForwardHeader=true"
   anubis:
-    image: "ghcr.io/techarohq/anubis:v1.27.0"
+    image: "ghcr.io/techarohq/anubis:v1.25.0"
     environment:
       BIND: ":8080"
       TARGET: " "
@@ -19,10 +19,6 @@ services:
       OG_CACHE_CONSIDER_HOST: "${ANUBIS_OG_CACHE_CONSIDER_HOST}"
       SERVE_ROBOTS_TXT: "${ANUBIS_SERVE_ROBOTS_TXT}"
       SLOG_LEVEL: "${ANUBIS_SLOG_LEVEL:-INFO}"
-      POLICY_FNAME: "/data/cfg/botPolicy.yaml"
-    configs:
-    - source: anubis_yml
-      target: /data/cfg/botPolicy.yaml
     networks:
     - proxy
     deploy:
@@ -33,8 +29,3 @@ services:
       - "traefik.http.routers.anubis.entrypoints=web-secure"
       - "traefik.http.services.anubis.loadbalancer.server.port=8080"
       - "traefik.http.routers.anubis.service=anubis"
-configs:
-  anubis_yml:
-    name: ${STACK_NAME}_anubis_yml_${ANUBIS_YML_VERSION}
-    file: anubis.yml.tmpl
-    template_driver: golang

compose.crowdsec.yml

@@ -0,0 +1,42 @@
+version: "3.8"
+services:
+  app:
+    deploy:
+      labels:
+        - "traefik.http.routers.${STACK_NAME}.middlewares=crowdsec@file"
+    secrets:
+      - crowdsec_lapi_key
+  crowdsec:
+    image: crowdsecurity/crowdsec:v1.7.8
+    environment:
+      GID: "${GID-1000}"
+      COLLECTIONS: "crowdsecurity/linux crowdsecurity/traefik"
+    volumes:
+      - crowdsec-db:/var/lib/crowdsec/data/
+      - crowdsec-config:/etc/crowdsec/
+      - traefik-logs:/var/log/traefik/:ro
+    configs:
+      - source: crowdsec_traefik_config
+        target: /etc/crowdsec/acquis.d/traefik_config.yaml
+        mode: 0555
+    networks:
+      - internal
+    deploy:
+      update_config:
+        failure_action: rollback
+        order: stop-first
+
+configs:
+  crowdsec_traefik_config:
+    name: ${STACK_NAME}_crowdsec_traefik_${CROWDSEC_TRAEFIK_CONFIG_VERSION}
+    file: crowdsec_traefik_config.yaml.tmpl
+    template_driver: golang
+
+secrets:
+  crowdsec_lapi_key:
+    external: true
+    name: ${STACK_NAME}_crowdsec_lapi_key_${SECRET_CROWDSEC_LAPI_KEY_VERSION}
+
+volumes:
+  crowdsec-db:
+  crowdsec-config:

compose.iocaine.yml

@@ -1,22 +0,0 @@
----
-version: "3.8"
-
-services:
-  app:
-    environment:
-      IOCAINE_ENABLE: "1"
-      IOCAINE_PLUGIN_VERSION: "v1.2.0"
-    volumes:
-      - "plugins-local:/plugins-local"
-
-  iocaine:
-    image: "git.madhouse-project.org/iocaine/iocaine:3.5.0"
-    environment:
-      RUST_LOG: "iocaine=info"
-    ports:
-      - "127.0.0.1:42069:42069"
-    networks:
-      - proxy
-
-volumes:
-  plugins-local:

compose.pgsql.yml

@@ -1,12 +0,0 @@
----
-version: "3.8"
-
-services:
-  app:
-    environment:
-      - PGSQL_ENABLED
-    ports:
-      - target: 5432
-        published: 5432
-        protocol: tcp
-        mode: host

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "traefik:v3.7.10"
+    image: "traefik:v3.7.8"
     # Note(decentral1se): *please do not* add any additional ports here.
     # Doing so could break new installs with port conflicts. Please use
     # the usual `compose.$app.yml` approach for any additional ports
@@ -19,6 +19,7 @@ services:
     volumes:
       - "letsencrypt:/etc/letsencrypt"
       - "file-providers:/etc/traefik/file-providers"
+      - "traefik-logs:/var/log/traefik"
     configs:
       - source: traefik_yml
         target: /etc/traefik/traefik.yml
@@ -27,9 +28,6 @@ services:
       - source: entrypoint
         target: /custom-entrypoint.sh
         mode: 0555
-      - source: iocaine_entrypoint
-        target: /entrypoint.iocaine.sh
-        mode: 0555
     networks:
       - proxy
       - internal
@@ -60,12 +58,12 @@ services:
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}.service=api@internal"
         - "traefik.http.routers.${STACK_NAME}.middlewares=security@file"
-        - "coop-cloud.${STACK_NAME}.version=6.1.0+v3.7.10"
+        - "coop-cloud.${STACK_NAME}.version=6.0.0+v3.7.7"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
 
   socket-proxy:
-    image: lscr.io/linuxserver/socket-proxy:3.4.3
+    image: lscr.io/linuxserver/socket-proxy:3.4.2
     deploy:
       endpoint_mode: dnsrr
     environment:
@@ -120,11 +118,8 @@ configs:
     name: ${STACK_NAME}_entrypoint_${ENTRYPOINT_VERSION}
     file: entrypoint.sh.tmpl
     template_driver: golang
-  iocaine_entrypoint:
-    name: ${STACK_NAME}_entrypoint_${IOCAINE_ENTRYPOINT_VERSION}
-    file: entrypoint.iocaine.sh.tmpl
-    template_driver: golang
 
 volumes:
   letsencrypt:
   file-providers:
+  traefik-logs:

crowdsec_traefik_config.yaml.tmpl

@@ -0,0 +1,5 @@
+filenames:
+  - /var/log/traefik/*
+labels:
+  type: traefik
+

entrypoint.iocaine.sh.tmpl

@@ -1,15 +0,0 @@
-#!/bin/sh
-
-set -e
-
-apk --no-cache add git go
-iocaine_path="/plugins-local/src/git.mstar.dev/mstar/traefik-iocaine-middleware"
-if [ ! -d "$iocaine_path" ]; then
-  git clone --depth 1 --branch $IOCAINE_PLUGIN_VERSION https://git.mstar.dev/mstar/traefik-iocaine-middleware.git $iocaine_path
-else
-	git -C $iocaine_path fetch origin 'refs/tags/*:refs/tags/*'
-	git -C $iocaine_path checkout tags/$IOCAINE_PLUGIN_VERSION
-fi
-(cd $iocaine_path && go mod vendor)
-
-exit 0

entrypoint.sh.tmpl

@@ -15,8 +15,4 @@ export DO_AUTH_TOKEN=$(cat "$DO_AUTH_TOKEN_FILE")
 export AZURE_CLIENT_SECRET=$(cat "$AZURE_CLIENT_SECRET_FILE")
 {{ end }}
 
-{{ if eq (env "IOCAINE_ENABLE") "1" }}
-/entrypoint.iocaine.sh
-{{ end }}
-
 /entrypoint.sh "$@"

file-provider.yml.tmpl

@@ -17,20 +17,21 @@ http:
         authResponseHeaders:
           - X-Forwarded-User
     {{ end }}
-    {{ if eq (env "IOCAINE_ENABLE") "1" }}
-    iocaine:
-      plugin:
-        iocaine:
-          iocaineHttpUrl: "http://iocaine:42069"
-          methods:
-            - GET
-            - HEAD
-    {{ end }}
     {{ if eq (env "BASIC_AUTH") "1" }}
     basicauth:
       basicAuth:
         usersFile: "/run/secrets/usersfile"
     {{ end }}
+    {{ if eq (env "CROWDSEC_ENABLED") "1" }}
+    crowdsec:
+      plugin:
+        bouncer:
+          enabled: {{ if eq (env "CROWDSEC_BOUNCER_ENABLED") "1" }}true{{ else }}false{{ end }}
+          logLevel: DEBUG
+          crowdsecMode: live
+          crowdsecLapiKey: "{{ if eq (env "CROWDSEC_BOUNCER_ENABLED") "1" }}{{ secret "crowdsec_lapi_key" }}{{ else }}please_set_CROWDSEC_BOUNCER_ENABLED_to_1{{ end }}"
+          crowdsecLapiHost: crowdsec:8080
+    {{ end }}
     security:
       headers:
         frameDeny: true

release/6.1.0+v3.7.10

@@ -1 +0,0 @@
-Adds option ability to open ports for PGSQL recipe, new version of anubis, and ability to add anubis metrics on this release.

traefik.yml.tmpl

@@ -5,6 +5,11 @@ core:
 log:
   level: {{ env "LOG_LEVEL" }}
   maxAge: {{ env "LOG_MAX_AGE" }}
+{{- if eq (env "CROWDSEC_ENABLED") "1" }}
+  filePath: "/var/log/traefik/traefik.log"
+accessLog:
+  filePath: "/var/log/traefik/access.log"
+{{- end }}
 
 providers:
   swarm:
@@ -46,10 +51,6 @@ entrypoints:
         allowEncodedPercent: true
         allowEncodedQuestionMark: true
         allowEncodedHash: true
-			{{- if eq (env "IOCAINE_ENABLE") "1" }}
-      middlewares:
-        - iocaine@file
-			{{- end }}
   {{- if eq (env "GITEA_SSH_ENABLED") "1" }}
   gitea-ssh:
     address: ":2222"
@@ -162,9 +163,10 @@ certificatesResolvers:
           - "9.9.9.9:53"
       {{- end }}
 
-{{ if eq (env "IOCAINE_ENABLE") "1" }}
+{{ if eq (env "CROWDSEC_ENABLED") "1" }}
 experimental:
-  localPlugins:
-    iocaine:
-      moduleName: git.mstar.dev/mstar/traefik-iocaine-middleware
-{{ end }}
+  plugins:
+    bouncer:
+      moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
+      version: v1.6.0
+{{- end }}