update
This commit is contained in:
Mike McFetridge
@@ -0,0 +1,7 @@
|
||||
# CrowdSec enrollment and bouncer placeholders
|
||||
<%- if console_enrollment_enabled %>
|
||||
ENROLL_KEY=<< console_enrollment_key >>
|
||||
<%- endif %>
|
||||
<%- if bouncer_traefik_key %>
|
||||
BOUNCER_KEY_TRAEFIK=<< bouncer_traefik_key >>
|
||||
<%- endif %>
|
||||
@@ -0,0 +1,63 @@
|
||||
services:
|
||||
<< service_name >>:
|
||||
image: crowdsecurity/crowdsec:<< image_tag >>
|
||||
container_name: << container_name >>
|
||||
environment:
|
||||
- TZ=<< container_timezone >>
|
||||
- COLLECTIONS=<< collections_core >><%- if collections_extra %> << collections_extra >><%- endif %><%- if appsec_enabled %> crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules<%- endif %>
|
||||
<%- if docker_logs_enabled %>
|
||||
- GID=<< docker_group_id >>
|
||||
<%- endif %>
|
||||
<%- if console_enrollment_enabled %>
|
||||
- ENROLL_KEY=${ENROLL_KEY}
|
||||
- ENROLL_INSTANCE_NAME=<< console_enrollment_name >>
|
||||
<%- if console_enrollment_tags %>
|
||||
- ENROLL_TAGS=<< console_enrollment_tags >>
|
||||
<%- endif %>
|
||||
<%- endif %>
|
||||
<%- if bouncer_traefik_key %>
|
||||
- BOUNCER_KEY_TRAEFIK=${BOUNCER_KEY_TRAEFIK}
|
||||
<%- endif %>
|
||||
volumes:
|
||||
- ./config/acquis.yaml:/etc/crowdsec/acquis.yaml:ro
|
||||
- ./config/acquis.d:/etc/crowdsec/acquis.d:ro
|
||||
- crowdsec_data:/var/lib/crowdsec/data
|
||||
- /var/log:/var/log-host:ro
|
||||
<%- if docker_logs_enabled %>
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
<%- endif %>
|
||||
<%- if traefik_accesslog_enabled %>
|
||||
- << traefik_accesslog_mount_path >>:/var/log/traefik:ro
|
||||
<%- endif %>
|
||||
<%- if lapi_expose_enabled or (appsec_enabled and appsec_expose_enabled) %>
|
||||
ports:
|
||||
<%- if lapi_expose_enabled %>
|
||||
- "<< lapi_bind_address >>:<< lapi_port >>:8080"
|
||||
<%- endif %>
|
||||
<%- if appsec_enabled and appsec_expose_enabled %>
|
||||
- "<< appsec_bind_address >>:<< appsec_port >>:7422"
|
||||
<%- endif %>
|
||||
<%- endif %>
|
||||
restart: << restart_policy >>
|
||||
networks:
|
||||
- crowdsec
|
||||
<%- if traefik_network_enabled %>
|
||||
- << traefik_network >>
|
||||
<%- endif %>
|
||||
|
||||
networks:
|
||||
crowdsec:
|
||||
driver: bridge
|
||||
<%- if traefik_network_enabled %>
|
||||
<< traefik_network >>:
|
||||
<%- if traefik_network_external %>
|
||||
external: true
|
||||
<%- else %>
|
||||
driver: bridge
|
||||
name: << traefik_network >>
|
||||
<%- endif %>
|
||||
<%- endif %>
|
||||
|
||||
volumes:
|
||||
crowdsec_data:
|
||||
driver: local
|
||||
@@ -0,0 +1,9 @@
|
||||
<%- if appsec_enabled %>
|
||||
source: appsec
|
||||
listen_addr: 0.0.0.0:7422
|
||||
path: << appsec_path >>
|
||||
appsec_config: crowdsecurity/appsec-default
|
||||
labels:
|
||||
type: appsec
|
||||
name: << appsec_name >>
|
||||
<%- endif %>
|
||||
@@ -0,0 +1,26 @@
|
||||
<%- if host_logs_enabled %>
|
||||
filenames:
|
||||
- /var/log-host/auth.log
|
||||
- /var/log-host/syslog
|
||||
labels:
|
||||
type: syslog
|
||||
<%- endif %>
|
||||
<%- if host_logs_enabled and (docker_logs_enabled or traefik_accesslog_enabled) %>
|
||||
---
|
||||
<%- endif %>
|
||||
<%- if docker_logs_enabled %>
|
||||
source: docker
|
||||
container_name_regexp:
|
||||
- << docker_container_name_regexp >>
|
||||
labels:
|
||||
type: << docker_log_type >>
|
||||
<%- endif %>
|
||||
<%- if docker_logs_enabled and traefik_accesslog_enabled %>
|
||||
---
|
||||
<%- endif %>
|
||||
<%- if traefik_accesslog_enabled %>
|
||||
filenames:
|
||||
- /var/log/traefik/<< traefik_accesslog_filename >>
|
||||
labels:
|
||||
type: traefik
|
||||
<%- endif %>
|
||||
@@ -0,0 +1,451 @@
|
||||
{
|
||||
"slug": "crowdsec",
|
||||
"kind": "compose",
|
||||
"metadata": {
|
||||
"name": "CrowdSec",
|
||||
"description": "Standalone CrowdSec Security Engine deployment for a single Docker host, with host and reverse-proxy log acquisition, optional AppSec exposure, and console or bouncer enrollment placeholders.",
|
||||
"tags": [
|
||||
"security",
|
||||
"logging",
|
||||
"traefik"
|
||||
],
|
||||
"icon": {
|
||||
"provider": "selfhst",
|
||||
"id": "crowdsec"
|
||||
},
|
||||
"draft": true,
|
||||
"version": {
|
||||
"name": "v1.7.6",
|
||||
"source_dep_name": "manual/crowdsec"
|
||||
}
|
||||
},
|
||||
"variables": [
|
||||
{
|
||||
"title": "General",
|
||||
"name": "general",
|
||||
"items": [
|
||||
{
|
||||
"name": "service_name",
|
||||
"type": "str",
|
||||
"title": "Service Name",
|
||||
"required": false,
|
||||
"default": "crowdsec",
|
||||
"description": "Compose service name for CrowdSec.",
|
||||
"config": {
|
||||
"placeholder": "crowdsec"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "container_name",
|
||||
"type": "str",
|
||||
"title": "Container Name",
|
||||
"required": false,
|
||||
"default": "crowdsec",
|
||||
"description": "Container name for CrowdSec.",
|
||||
"config": {
|
||||
"placeholder": "crowdsec"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "image_tag",
|
||||
"type": "str",
|
||||
"title": "Image Tag",
|
||||
"required": true,
|
||||
"default": "v1.7.6",
|
||||
"description": "CrowdSec image tag to deploy.",
|
||||
"config": {
|
||||
"placeholder": "v1.7.6"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "container_timezone",
|
||||
"type": "str",
|
||||
"title": "Container Timezone",
|
||||
"required": true,
|
||||
"default": "UTC",
|
||||
"config": {
|
||||
"placeholder": "UTC"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "restart_policy",
|
||||
"type": "enum",
|
||||
"title": "Restart Policy",
|
||||
"required": true,
|
||||
"default": "unless-stopped",
|
||||
"config": {
|
||||
"options": [
|
||||
"unless-stopped",
|
||||
"always",
|
||||
"on-failure",
|
||||
"no"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Collections",
|
||||
"name": "collections",
|
||||
"items": [
|
||||
{
|
||||
"name": "collections_core",
|
||||
"type": "str",
|
||||
"title": "Core Collections",
|
||||
"required": true,
|
||||
"default": "crowdsecurity/linux crowdsecurity/sshd",
|
||||
"description": "Space-separated base collections to install on startup.",
|
||||
"config": {
|
||||
"placeholder": "crowdsecurity/linux crowdsecurity/sshd"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "collections_extra",
|
||||
"type": "str",
|
||||
"title": "Extra Collections",
|
||||
"required": false,
|
||||
"default": "crowdsecurity/traefik",
|
||||
"description": "Additional space-separated collections to install, for example a reverse-proxy parser.",
|
||||
"config": {
|
||||
"placeholder": "crowdsecurity/traefik"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Acquisition",
|
||||
"name": "acquisition",
|
||||
"items": [
|
||||
{
|
||||
"name": "host_logs_enabled",
|
||||
"type": "bool",
|
||||
"title": "Host Logs",
|
||||
"required": false,
|
||||
"default": true,
|
||||
"description": "Ingest host auth and syslog files from `/var/log`."
|
||||
},
|
||||
{
|
||||
"name": "docker_logs_enabled",
|
||||
"type": "bool",
|
||||
"title": "Docker Logs",
|
||||
"required": false,
|
||||
"default": false,
|
||||
"description": "Read logs from a matching Docker container through the Docker socket."
|
||||
},
|
||||
{
|
||||
"name": "docker_group_id",
|
||||
"type": "int",
|
||||
"title": "Docker Group ID",
|
||||
"required": true,
|
||||
"default": 998,
|
||||
"description": "Host Docker group ID so the container can access the socket.",
|
||||
"needs": [
|
||||
"docker_logs_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "998"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "docker_container_name_regexp",
|
||||
"type": "str",
|
||||
"title": "Docker Container Regex",
|
||||
"required": true,
|
||||
"default": ".*traefik.*",
|
||||
"description": "Regular expression used to match the Docker container whose logs should be parsed.",
|
||||
"needs": [
|
||||
"docker_logs_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": ".*traefik.*"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "docker_log_type",
|
||||
"type": "str",
|
||||
"title": "Docker Log Type",
|
||||
"required": true,
|
||||
"default": "traefik",
|
||||
"description": "Parser type label for the Docker datasource.",
|
||||
"needs": [
|
||||
"docker_logs_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "traefik"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Traefik",
|
||||
"name": "traefik",
|
||||
"items": [
|
||||
{
|
||||
"name": "traefik_network_enabled",
|
||||
"type": "bool",
|
||||
"title": "Shared Traefik Network",
|
||||
"required": false,
|
||||
"default": false,
|
||||
"description": "Attach CrowdSec to an existing Docker network shared with Traefik or other bouncers."
|
||||
},
|
||||
{
|
||||
"name": "traefik_network",
|
||||
"type": "str",
|
||||
"title": "Traefik Network",
|
||||
"required": true,
|
||||
"default": "traefik",
|
||||
"description": "Docker network shared with Traefik or other remediation components.",
|
||||
"needs": [
|
||||
"traefik_network_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "traefik"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "traefik_network_external",
|
||||
"type": "bool",
|
||||
"title": "External Network",
|
||||
"required": false,
|
||||
"default": true,
|
||||
"needs": [
|
||||
"traefik_network_enabled=true"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "traefik_accesslog_enabled",
|
||||
"type": "bool",
|
||||
"title": "Traefik Access Log",
|
||||
"required": false,
|
||||
"default": false,
|
||||
"description": "Read Traefik access logs from a mounted host path."
|
||||
},
|
||||
{
|
||||
"name": "traefik_accesslog_mount_path",
|
||||
"type": "str",
|
||||
"title": "Traefik Log Path",
|
||||
"required": true,
|
||||
"default": "/var/log/traefik",
|
||||
"description": "Host directory containing Traefik access logs.",
|
||||
"needs": [
|
||||
"traefik_accesslog_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "/var/log/traefik"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "traefik_accesslog_filename",
|
||||
"type": "str",
|
||||
"title": "Traefik Log File",
|
||||
"required": true,
|
||||
"default": "access.log",
|
||||
"description": "Filename of the Traefik access log inside the mounted directory.",
|
||||
"needs": [
|
||||
"traefik_accesslog_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "access.log"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Local API",
|
||||
"toggle": "lapi_expose_enabled",
|
||||
"name": "lapi",
|
||||
"items": [
|
||||
{
|
||||
"name": "lapi_expose_enabled",
|
||||
"type": "bool",
|
||||
"title": "Expose Local API",
|
||||
"required": false,
|
||||
"default": false,
|
||||
"description": "Publish CrowdSec Local API on the host."
|
||||
},
|
||||
{
|
||||
"name": "lapi_bind_address",
|
||||
"type": "str",
|
||||
"title": "Local API Bind Address",
|
||||
"required": true,
|
||||
"default": "127.0.0.1",
|
||||
"description": "Host address used for the Local API port binding.",
|
||||
"needs": [
|
||||
"lapi_expose_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "127.0.0.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "lapi_port",
|
||||
"type": "int",
|
||||
"title": "Local API Port",
|
||||
"required": true,
|
||||
"default": 8080,
|
||||
"description": "Host port used for the Local API binding.",
|
||||
"needs": [
|
||||
"lapi_expose_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "8080"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "AppSec",
|
||||
"toggle": "appsec_enabled",
|
||||
"name": "appsec",
|
||||
"items": [
|
||||
{
|
||||
"name": "appsec_enabled",
|
||||
"type": "bool",
|
||||
"title": "Enable AppSec",
|
||||
"required": false,
|
||||
"default": false
|
||||
},
|
||||
{
|
||||
"name": "appsec_name",
|
||||
"type": "str",
|
||||
"title": "AppSec Name",
|
||||
"required": true,
|
||||
"default": "traefik-appsec",
|
||||
"description": "Friendly name for the AppSec component.",
|
||||
"needs": [
|
||||
"appsec_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "traefik-appsec"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "appsec_path",
|
||||
"type": "str",
|
||||
"title": "AppSec Path",
|
||||
"required": true,
|
||||
"default": "/",
|
||||
"description": "Request path handled by the AppSec listener.",
|
||||
"needs": [
|
||||
"appsec_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "/"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "appsec_expose_enabled",
|
||||
"type": "bool",
|
||||
"title": "Expose AppSec",
|
||||
"required": false,
|
||||
"default": false,
|
||||
"description": "Publish the AppSec listener on the host.",
|
||||
"needs": [
|
||||
"appsec_enabled=true"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "appsec_bind_address",
|
||||
"type": "str",
|
||||
"title": "AppSec Bind Address",
|
||||
"required": true,
|
||||
"default": "127.0.0.1",
|
||||
"description": "Host address used for the AppSec port binding.",
|
||||
"needs": [
|
||||
"appsec_enabled=true",
|
||||
"appsec_expose_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "127.0.0.1"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "appsec_port",
|
||||
"type": "int",
|
||||
"title": "AppSec Port",
|
||||
"required": true,
|
||||
"default": 7422,
|
||||
"description": "Host port used for the AppSec port binding.",
|
||||
"needs": [
|
||||
"appsec_enabled=true",
|
||||
"appsec_expose_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "7422"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Console Enrollment",
|
||||
"toggle": "console_enrollment_enabled",
|
||||
"name": "console",
|
||||
"items": [
|
||||
{
|
||||
"name": "console_enrollment_enabled",
|
||||
"type": "bool",
|
||||
"title": "Console Enrollment",
|
||||
"required": false,
|
||||
"default": false,
|
||||
"description": "Enroll this CrowdSec instance into CrowdSec Console."
|
||||
},
|
||||
{
|
||||
"name": "console_enrollment_name",
|
||||
"type": "str",
|
||||
"title": "Instance Name",
|
||||
"required": true,
|
||||
"default": "crowdsec-homelab",
|
||||
"description": "Human-readable name shown in CrowdSec Console.",
|
||||
"needs": [
|
||||
"console_enrollment_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "crowdsec-homelab"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "console_enrollment_tags",
|
||||
"type": "str",
|
||||
"title": "Enrollment Tags",
|
||||
"required": false,
|
||||
"default": "homelab,edge",
|
||||
"description": "Comma-separated tags assigned during console enrollment.",
|
||||
"needs": [
|
||||
"console_enrollment_enabled=true"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "homelab,edge"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "console_enrollment_key",
|
||||
"type": "secret",
|
||||
"title": "Enrollment Key",
|
||||
"required": true,
|
||||
"description": "Enrollment key generated by CrowdSec Console.",
|
||||
"needs": [
|
||||
"console_enrollment_enabled=true"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Bouncers",
|
||||
"name": "bouncers",
|
||||
"items": [
|
||||
{
|
||||
"name": "bouncer_traefik_key",
|
||||
"type": "secret",
|
||||
"title": "Traefik Bouncer Key",
|
||||
"required": false,
|
||||
"description": "Optional seed key for a Traefik bouncer or plugin.",
|
||||
"config": {
|
||||
"autogenerated": {
|
||||
"length": 32
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user