diff --git a/project/db/lldap/lldap.yml b/project/db/lldap/lldap.yml index 670872e..495a270 100644 --- a/project/db/lldap/lldap.yml +++ b/project/db/lldap/lldap.yml @@ -46,4 +46,4 @@ services: - "traefik.http.services.lldap-service.loadbalancer.server.port=17170" - "traefik.http.services.lldap-service.loadbalancer.server.scheme=http" # middlewares - # - "traefik.http.routers.lldap.middlewares=crowdsec-bouncer@file" \ No newline at end of file + - "traefik.http.routers.lldap.middlewares=crowdsec-bouncer@file" \ No newline at end of file diff --git a/project/infrastructure/authelia/authelia.yml b/project/infrastructure/authelia/authelia.yml index 7df5f19..5c28dd8 100644 --- a/project/infrastructure/authelia/authelia.yml +++ b/project/infrastructure/authelia/authelia.yml @@ -42,4 +42,4 @@ services: - 'traefik.http.routers.authelia.service=authelia-svc' - 'traefik.http.services.authelia-svc.loadbalancer.server.port=9091' # Middleware - #- "traefik.http.routers.authelia.middlewares=crowdsec-bouncer@file" \ No newline at end of file + - "traefik.http.routers.authelia.middlewares=crowdsec-bouncer@file" \ No newline at end of file diff --git a/project/infrastructure/crowdsec/crowdsec.yml b/project/infrastructure/crowdsec/crowdsec.yml index 893deff..b352dc3 100644 --- a/project/infrastructure/crowdsec/crowdsec.yml +++ b/project/infrastructure/crowdsec/crowdsec.yml @@ -9,18 +9,16 @@ services: COLLECTIONS: crowdsecurity/traefik crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules crowdsecurity/http-cve CROWDSEC_BOUNCER_API_KEY: ${CROWDSEC_API_KEY} CUSTOM_HOSTNAME: crowdsec - expose: - - 8080 - ports: - - 6060:6060 networks: - ip4net - ip6net volumes: - - ${INFRA_PATH}/crowdsec/data:/var/lib/crowdsec/data + - ${INFRA_PATH}/crowdsec/config/acquis.yaml:/etc/crowdsec/acquis.yaml:ro - ${INFRA_PATH}/crowdsec/config:/etc/crowdsec + - ${INFRA_PATH}/crowdsec/data:/var/lib/crowdsec/data - /var/log/auth.log:/var/log/auth.log:ro - /var/log/crowdsec:/var/log/crowdsec:ro + - /var/log/syslog:/var/log/syslog:ro labels: # Watchtower - "com.centurylinklabs.watchtower.enable=true" \ No newline at end of file diff --git a/project/infrastructure/syncthing/syncthing.yml b/project/infrastructure/syncthing/syncthing.yml index fde4eb0..63c73cf 100644 --- a/project/infrastructure/syncthing/syncthing.yml +++ b/project/infrastructure/syncthing/syncthing.yml @@ -26,4 +26,4 @@ services: - "traefik.http.routers.syncthing.service=syncthing-svc" - "traefik.http.services.syncthing-svc.loadbalancer.server.port=8384" # Middlewares - - "traefik.http.routers.syncthing.middlewares=crowdsec-bouncer@file" \ No newline at end of file + #- "traefik.http.routers.syncthing.middlewares=crowdsec-bouncer@file" \ No newline at end of file diff --git a/project/infrastructure/traefik/html/ban.html b/project/infrastructure/traefik/html/ban.html new file mode 100644 index 0000000..e4a6501 --- /dev/null +++ b/project/infrastructure/traefik/html/ban.html @@ -0,0 +1,329 @@ + + + + + CrowdSec Access Forbidden + + + + + + +
+
+
+ +

CrowdSec Access Forbidden

+
+
+

This security check has been powered by

+ + + + + + + + + + + + + + + + + + + + + CrowdSec + +
+
+
+ + \ No newline at end of file diff --git a/project/infrastructure/traefik/html/captcha.html b/project/infrastructure/traefik/html/captcha.html new file mode 100644 index 0000000..a40d37a --- /dev/null +++ b/project/infrastructure/traefik/html/captcha.html @@ -0,0 +1,338 @@ + + + + + CrowdSec Captcha + + + + + + + +
+
+
+ +

CrowdSec Captcha

+
+
+
+
+
+
+

This security check has been powered by

+ + + + + + + + + + + + + + + + + + + + + CrowdSec + +
+
+
+ + + \ No newline at end of file diff --git a/project/media/audiobookshelf/audiobookshelf.yml b/project/media/audiobookshelf/audiobookshelf.yml index 5f04c8a..e3e3b23 100644 --- a/project/media/audiobookshelf/audiobookshelf.yml +++ b/project/media/audiobookshelf/audiobookshelf.yml @@ -25,4 +25,4 @@ services: - "traefik.http.routers.audiobookshelf.tls.certresolver=myresolver" - 'traefik.http.routers.audiobookshelf.tls=true' # Middlewares - # - "traefik.http.routers.audiobookshelf.middlewares=crowdsec-bouncer@file" \ No newline at end of file + - "traefik.http.routers.audiobookshelf.middlewares=crowdsec-bouncer@file" \ No newline at end of file diff --git a/project/media/immich/immich.yml b/project/media/immich/immich.yml index 452285a..aaa0a9a 100644 --- a/project/media/immich/immich.yml +++ b/project/media/immich/immich.yml @@ -12,6 +12,7 @@ services: DB_DATABASE_NAME: immich REDIS_HOSTNAME: redis volumes: + # to mount the trueNas external library: sudo mount 192.168.1.212:/mnt/hdd-storage/vm-external-storage/immich /mnt/external-storage/immich/ - ${IMMICH_EXTERNAL_PATH}:/usr/src/app/external:ro - ${MEDIA_PATH}/immich/data/library:/usr/src/app/upload - /etc/localtime:/etc/localtime:ro @@ -29,30 +30,7 @@ services: - "traefik.http.routers.immich-server.tls.certresolver=myresolver" - 'traefik.http.routers.immich-server.tls=true' # Middlewares - # - "traefik.http.routers.immich-server.middlewares=crowdsec-bouncer@file" - - immich-microservices: - extends: - file: ${TEMPLATES_PATH} - service: default - container_name: immich_microservices - image: ghcr.io/immich-app/immich-server:release - command: [ "start.sh", "microservices" ] - environment: - DB_PASSWORD: ${IMMICH_DB_PASSWORD} - DB_HOSTNAME: postgres-with-pg-vector - DB_USERNAME: immich - DB_DATABASE_NAME: immich - REDIS_HOSTNAME: redis - networks: - - ip6net - volumes: - - ${IMMICH_EXTERNAL_PATH}:/usr/src/app/external - - ${MEDIA_PATH}/immich/data/library:/usr/src/app/upload - - /etc/localtime:/etc/localtime:ro - labels: - # Watchtower - - "com.centurylinklabs.watchtower.enable=true" + - "traefik.http.routers.immich-server.middlewares=crowdsec-bouncer@file" immich-machine-learning: extends: @@ -64,4 +42,19 @@ services: - ${MEDIA_PATH}/immich/data/model-cache:/cache labels: # Watchtower - - "com.centurylinklabs.watchtower.enable=true" \ No newline at end of file + - "com.centurylinklabs.watchtower.enable=true" + + # https://github.com/Salvoxia/immich-folder-album-creator + # one time run: + # docker run -e API_URL="https://immich.crescentec.xyz/api/" -e API_KEY="qTaebdVMtph9yD0pSJRJDQJkDEpexiXNMJ5V5HBEnA" -e ROOT_PATH="/usr/src/app/external" salvoxia/immich-folder-album-creator:latest /script/immich_auto_album.sh + immich-folder-album-creator: + extends: + file: ${TEMPLATES_PATH} + service: default + container_name: immich_folder_album_creator + image: salvoxia/immich-folder-album-creator:latest + environment: + API_URL: https://immich.crescentec.xyz/api + API_KEY: qTaebdVMtph9yD0pSJRJDQJkDEpexiXNMJ5V5HBEnA + ROOT_PATH: /usr/src/app/external + CRON_EXPRESSION: "0 * * * *" \ No newline at end of file diff --git a/project/service/gitea/gitea.yml b/project/service/gitea/gitea.yml index 5b22356..f4674f8 100644 --- a/project/service/gitea/gitea.yml +++ b/project/service/gitea/gitea.yml @@ -48,4 +48,4 @@ services: - "traefik.http.routers.gitea.service=gitea-service" - "traefik.http.services.gitea-service.loadbalancer.server.port=4002" # Middlewares - # - "traefik.http.routers.gitea.middlewares=crowdsec-bouncer@file" \ No newline at end of file + - "traefik.http.routers.gitea.middlewares=crowdsec-bouncer@file" \ No newline at end of file diff --git a/project/service/mealie/mealie.yml b/project/service/mealie/mealie.yml index 4c993dc..e54b859 100644 --- a/project/service/mealie/mealie.yml +++ b/project/service/mealie/mealie.yml @@ -43,4 +43,4 @@ services: - "traefik.http.routers.mealie.tls.certresolver=myresolver" - "traefik.http.routers.mealie.tls=true" # Middlewares - # - "traefik.http.routers.mealie.middlewares=crowdsec-bouncer@file" \ No newline at end of file + - "traefik.http.routers.mealie.middlewares=crowdsec-bouncer@file" \ No newline at end of file diff --git a/project/service/stirling-pdf/stirling-pdf.yml b/project/service/stirling-pdf/stirling-pdf.yml index 553847f..0d3bc8b 100644 --- a/project/service/stirling-pdf/stirling-pdf.yml +++ b/project/service/stirling-pdf/stirling-pdf.yml @@ -23,5 +23,4 @@ services: - "traefik.http.routers.stirling-pdf.tls.certresolver=myresolver" - "traefik.http.routers.stirling-pdf.tls=true" # Middlewares - # - "traefik.http.routers.stirling-pdf.middlewares=crowdsec-bouncer@file, authelia@file" - - "traefik.http.routers.stirling-pdf.middlewares=authelia@file" \ No newline at end of file + - "traefik.http.routers.stirling-pdf.middlewares=crowdsec-bouncer@file, authelia@file" \ No newline at end of file diff --git a/project/service/vikunja/vikunja.yml b/project/service/vikunja/vikunja.yml index 9ebd466..75c99cf 100644 --- a/project/service/vikunja/vikunja.yml +++ b/project/service/vikunja/vikunja.yml @@ -32,4 +32,4 @@ services: - "traefik.http.routers.vikunja.tls.certresolver=myresolver" - 'traefik.http.routers.vikunja.tls=true' # Middlewares - # - "traefik.http.routers.vikunja.middlewares=crowdsec-bouncer@file" \ No newline at end of file + - "traefik.http.routers.vikunja.middlewares=crowdsec-bouncer@file" \ No newline at end of file