migrate

Docker/crowdsec/files/.env

@@ -0,0 +1,7 @@
+# CrowdSec enrollment and bouncer placeholders
+<%- if console_enrollment_enabled %>
+ENROLL_KEY=<< console_enrollment_key >>
+<%- endif %>
+<%- if bouncer_traefik_key %>
+BOUNCER_KEY_TRAEFIK=<< bouncer_traefik_key >>
+<%- endif %>

Docker/crowdsec/files/compose.yaml

@@ -0,0 +1,63 @@
+services:
+  << service_name >>:
+    image: crowdsecurity/crowdsec:<< image_tag >>
+    container_name: << container_name >>
+    environment:
+      - TZ=<< container_timezone >>
+      - COLLECTIONS=<< collections_core >><%- if collections_extra %> << collections_extra >><%- endif %><%- if appsec_enabled %> crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules<%- endif %>
+      <%- if docker_logs_enabled %>
+      - GID=<< docker_group_id >>
+      <%- endif %>
+      <%- if console_enrollment_enabled %>
+      - ENROLL_KEY=${ENROLL_KEY}
+      - ENROLL_INSTANCE_NAME=<< console_enrollment_name >>
+      <%- if console_enrollment_tags %>
+      - ENROLL_TAGS=<< console_enrollment_tags >>
+      <%- endif %>
+      <%- endif %>
+      <%- if bouncer_traefik_key %>
+      - BOUNCER_KEY_TRAEFIK=${BOUNCER_KEY_TRAEFIK}
+      <%- endif %>
+    volumes:
+      - ./config/acquis.yaml:/etc/crowdsec/acquis.yaml:ro
+      - ./config/acquis.d:/etc/crowdsec/acquis.d:ro
+      - crowdsec_data:/var/lib/crowdsec/data
+      - /var/log:/var/log-host:ro
+      <%- if docker_logs_enabled %>
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      <%- endif %>
+      <%- if traefik_accesslog_enabled %>
+      - << traefik_accesslog_mount_path >>:/var/log/traefik:ro
+      <%- endif %>
+    <%- if lapi_expose_enabled or (appsec_enabled and appsec_expose_enabled) %>
+    ports:
+      <%- if lapi_expose_enabled %>
+      - "<< lapi_bind_address >>:<< lapi_port >>:8080"
+      <%- endif %>
+      <%- if appsec_enabled and appsec_expose_enabled %>
+      - "<< appsec_bind_address >>:<< appsec_port >>:7422"
+      <%- endif %>
+    <%- endif %>
+    restart: << restart_policy >>
+    networks:
+      - crowdsec
+      <%- if traefik_network_enabled %>
+      - << traefik_network >>
+      <%- endif %>
+
+networks:
+  crowdsec:
+    driver: bridge
+  <%- if traefik_network_enabled %>
+  << traefik_network >>:
+    <%- if traefik_network_external %>
+    external: true
+    <%- else %>
+    driver: bridge
+    name: << traefik_network >>
+    <%- endif %>
+  <%- endif %>
+
+volumes:
+  crowdsec_data:
+    driver: local

Docker/crowdsec/files/config/acquis.d/appsec.yaml

@@ -0,0 +1,9 @@
+<%- if appsec_enabled %>
+source: appsec
+listen_addr: 0.0.0.0:7422
+path: << appsec_path >>
+appsec_config: crowdsecurity/appsec-default
+labels:
+  type: appsec
+name: << appsec_name >>
+<%- endif %>

Docker/crowdsec/files/config/acquis.yaml

@@ -0,0 +1,26 @@
+<%- if host_logs_enabled %>
+filenames:
+  - /var/log-host/auth.log
+  - /var/log-host/syslog
+labels:
+  type: syslog
+<%- endif %>
+<%- if host_logs_enabled and (docker_logs_enabled or traefik_accesslog_enabled) %>
+---
+<%- endif %>
+<%- if docker_logs_enabled %>
+source: docker
+container_name_regexp:
+  - << docker_container_name_regexp >>
+labels:
+  type: << docker_log_type >>
+<%- endif %>
+<%- if docker_logs_enabled and traefik_accesslog_enabled %>
+---
+<%- endif %>
+<%- if traefik_accesslog_enabled %>
+filenames:
+  - /var/log/traefik/<< traefik_accesslog_filename >>
+labels:
+  type: traefik
+<%- endif %>