45 lines
2.4 KiB
Markdown
45 lines
2.4 KiB
Markdown
Source: https://traefik.io/ \
|
|
https://github.com/traefik/traefik
|
|
|
|
### Prerequisites:
|
|
To use this docker compose yaml file you will need: \
|
|
Cloudflare DNS API TOKEN \
|
|
Running container of [docker-socket-proxy](https://scripts.gabesville.com/Gabesville/Docker-Compose/src/branch/main/Proxy_Containers/docker-socket-proxy/compose.yaml) \
|
|
Running container of [crowdsec](https://scripts.gabesville.com/Gabesville/Docker-Compose/src/branch/main/Security_Containers/crowdsec/compose.yaml)
|
|
|
|
## Guide:
|
|
1. Start the docker-socket-proxy container
|
|
2. Get your Cloudflare DNS Zone Edit API TOKEN
|
|
3. Start your traefik compose.yaml (see .env and fill in the DNS API Token, skip the bouncer API for now)
|
|
4. Start your CrowdSec container
|
|
5. Generate the Bouncer API Key with: `docker exec crowdsec cscli bouncers add traefik-bouncer` \
|
|
NOTE: Make sure there are no special characters. If it contains anything other than [a-z A-Z 0-9], delete and regenerate: \
|
|
`docker exec crowdsec cscli bouncers delete traefik-bouncer` \
|
|
`docker exec crowdsec cscli bouncers add traefik-bouncer`
|
|
6. Put the output in your .env under CROWDSEC_BOUNCER_API_KEY
|
|
7. Restart traefik container
|
|
|
|
### Verifying:
|
|
1. Confirm CrowdSec Is Parsing Traefik Logs: `docker exec crowdsec cscli metrics`
|
|
2. Check the plugins for errors: `docker logs traefik 2>&1 | grep -i "crowdsec\|plugin\|error" | tail -20`
|
|
3. Shows bouncer list: `docker exec crowdsec cscli bouncers list`
|
|
4. Review all logs: `docker logs traefik 2>&1 | tail -30`
|
|
5. You should see /v1/decisions/stream hits incrementing: `docker exec crowdsec cscli metrics | grep -A8 "Local API Metrics"`
|
|
|
|
### Testing:
|
|
Test CrowdSec Is Actually Blocking
|
|
1. Ban your own IP: `docker exec crowdsec cscli decisions add --ip <your-ip>`
|
|
2. Check your list of banned IPs: `docker exec crowdsec cscli decisions list`
|
|
3. Go to one of URLs \
|
|
Note: using crowdsecMode: stream, decisions sync every 60 seconds — so the ban may take up to a minute to take effect
|
|
4. Unban yourself: `docker exec crowdsec cscli decisions delete --ip <your-ip>`
|
|
|
|
### Optional:
|
|
Setup CrowdSec Console (cloud)
|
|
1. Go to app.crowdsec.net and create a free account
|
|
2. Once signed in > Click "Engines" in the left sidebar
|
|
3. Click "Enroll a new engine" or "Enroll command"
|
|
4. Copy the key
|
|
5. Back on your server, run: `docker exec crowdsec cscli console enroll <enrollment-key>`
|
|
6. Restart crowdsec container
|
|
7. If you ever want to remove: `docker exec crowdsec cscli console disable --all` |