crowdsec config

services/traefik/config/config.yml

@@ -0,0 +1,67 @@
+api:
+  dashboard: true
+
+log:
+  level: "INFO"
+
+serversTransport:
+  insecureSkipVerify: true
+
+accessLog:
+  filePath: "/var/log/traefik/access.log" # location of traefik logs for crowdsec
+  format: json
+  bufferingSize: 100 # Configuring a buffer of 100 lines
+  filters:
+    statusCodes:
+      - "204-299"
+      - "400-499"
+      - "500-559" # logged status codes
+
+entryPoints:
+  http:
+    address: "[::]:80" # Create the HTTP entrypoint on port 80
+    forwardedHeaders:
+      insecure: false
+      trustedIPs:
+        - "10.0.0.0/8"
+        - "192.168.178.0/16"
+        - "2a07:600:200:1::/64"
+    proxyProtocol:
+      insecure: false
+      trustedIPs:
+        - "10.0.0.0/8"
+        - "192.168.178.0/16"
+        - "2a07:600:200:1::/64"
+    http:
+      redirections: # HTTPS redirection (80 to 443)
+        entryPoint:
+          to: "https" # The target element
+          scheme: "https" # The redirection target scheme
+          permanent: true # The target element
+
+  https:
+    address: "[::]:443" # Create the HTTPS entrypoint on port 443
+    forwardedHeaders:
+      insecure: false
+      trustedIPs:
+        - "10.0.0.0/8"
+        - "192.168.178.0/16"
+        - "2a07:600:200:1::/64"
+    proxyProtocol:
+      insecure: false
+      trustedIPs:
+        - "10.0.0.0/8"
+        - "192.168.178.0/16"
+        - "2a07:600:200:1::/64"
+
+providers:
+  docker:
+    endpoint: "unix:///var/run/docker.sock" # Listen to the UNIX Docker socket
+    exposedByDefault: false
+  file:
+    directory: "/etc/traefik" # Link to the dynamic configuration
+    watch: true # Watch for modifications
+  providersThrottleDuration: "10" # Configuration reload frequency
+
+metrics:
+  prometheus: {}

services/traefik/config/traefik.yml

@@ -0,0 +1,96 @@
+services:
+  traefik:
+    extends:
+      file: ${TEMPLATES_PATH}
+      service: default
+    image: traefik:v3.6.6
+    container_name: traefik
+    ports:
+      - "80:80"
+      - "443:443"
+      - "8079:8080"
+    networks:
+      - ip4net
+    environment:
+      TRAEFIK_EMAIL: ${EMAIL}
+      TRAEFIK_PUBLIC_DOMAIN: ${PUBLIC_DOMAIN}
+      TRAEFIK_MAIN_SERVER_NODE_IP: ${MAIN_SERVER_NODE_IP}
+      TRAEFIK_CROWDSEC_API_KEY: ${CROWDSEC_API_KEY}
+      INFOMANIAK_ACCESS_TOKEN: ${INFOMANIAK_CERTIFICATE_ACCESS_TOKEN}
+    volumes:
+      - "/var/log/traefik/:/var/log/traefik/"
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      - "${SERVICE_PATH}/traefik/letsencrypt:/letsencrypt"
+      - "${SERVICE_PATH}/traefik/config:/etc/traefik"
+      - "${SERVICE_PATH}/traefik/certs:/etc/certs"
+      - "${SERVICE_PATH}/traefik/html/ban.html:/ban.html"
+      - "${SERVICE_PATH}/traefik/html/captcha.html:/captcha.html"
+    labels:
+      # Traefik
+      - "traefik.enable=true"
+      - "traefik.http.routers.traefik.service=api@internal"
+      - "traefik.http.routers.traefik.rule=Host(`traefik.${LOCAL_DOMAIN}`)"
+      - "traefik.http.routers.traefik.entrypoints=https"
+      - "traefik.http.routers.traefik.tls=true"
+
+  # traefik-agent:
+  #   extends:
+  #     file: ${TEMPLATES_PATH}
+  #     service: default
+  #   image: hhftechnology/traefik-log-dashboard-agent:2.4.0
+  #   container_name: traefik-log-dashboard-agent
+  #   networks:
+  #     - ip4net
+  #   ports:
+  #     - "8078:5000"
+  #   volumes:
+  #     - "/var/log/crowdsec/:/logs:ro"
+  #     - "${SERVICE_PATH}/traefik/log-dashboard/positions:/data"
+  #   environment:
+  #     TRAEFIK_LOG_DASHBOARD_ACCESS_PATH: /logs/traefik.log
+  #     TRAEFIK_LOG_DASHBOARD_AUTH_TOKEN: ${TRAEFIK_DASHBOARD_TOKEN}
+  #     TRAEFIK_LOG_DASHBOARD_SYSTEM_MONITORING: true
+  #     TRAEFIK_LOG_DASHBOARD_LOG_FORMAT: json
+  #   healthcheck:
+  #     test:
+  #       [
+  #         "CMD",
+  #         "wget",
+  #         "--no-verbose",
+  #         "--tries=1",
+  #         "--spider",
+  #         "http://localhost:5000/api/logs/status",
+  #       ]
+  #     interval: 2m
+  #     timeout: 10s
+  #     retries: 3
+  #     start_period: 30s
+  #
+  # traefik-dashboard:
+  #   extends:
+  #     file: ${TEMPLATES_PATH}
+  #     service: default
+  #   image: hhftechnology/traefik-log-dashboard:2.4.0
+  #   container_name: traefik-log-dashboard
+  #   networks:
+  #     - ip4net
+  #   ports:
+  #     - "8077:3000"
+  #   volumes:
+  #     - ./data/dashboard:/app/data
+  #     - "${SERVICE_PATH}/traefik/log-dashboard/dashboard:/app/data"
+  #     - "${SERVICE_PATH}/traefik/log-dashboard/positions:/data"
+  #   environment:
+  #     AGENT_API_URL: http://192.168.178.35:8078
+  #     AGENT_API_TOKEN: ${TRAEFIK_DASHBOARD_TOKEN}
+  #     # Display Configuration
+  #     NEXT_PUBLIC_SHOW_DEMO_PAGE: false
+  #   depends_on:
+  #     traefik-agent:
+  #       condition: service_healthy
+  #   labels:
+  #     # traefik
+  #     - "traefik.enable=true"
+  #     - "traefik.http.routers.traefik-log-dashboard.rule=Host(`traefik-dashboard.${LOCAL_DOMAIN}`)"
+  #     - "traefik.http.routers.traefik-log-dashboard.entrypoints=https"
+  #     - "traefik.http.routers.traefik-log-dashboard.tls=true"