From 10e26cda72e15b273fa223c2e007bf312c8c746e Mon Sep 17 00:00:00 2001
From: mr-forust <vzlomdsisma@gmail.com>
Date: Tue, 16 Jun 2026 00:19:50 +0200
Subject: [PATCH] feat: crowdsec - moved bouncer tokens to secrets -
 experimental host ssh log parsing - moved crowdsec to it's own directory

---
 .../k8s/crowdsec-middleware.yaml              |  2 +-
 crowdsec/k8s/crowdsec-values.yaml             | 57 +++++++++++++++++++
 traefik/k8s/crowdsec-values.yaml              | 29 ----------
 traefik/k8s/traefik-values.yaml               |  3 +
 4 files changed, 61 insertions(+), 30 deletions(-)
 rename traefik/k8s/crowdsec-middleware.yaml.example => crowdsec/k8s/crowdsec-middleware.yaml (82%)
 create mode 100644 crowdsec/k8s/crowdsec-values.yaml
 delete mode 100644 traefik/k8s/crowdsec-values.yaml

diff --git a/traefik/k8s/crowdsec-middleware.yaml.example b/crowdsec/k8s/crowdsec-middleware.yaml
similarity index 82%
rename from traefik/k8s/crowdsec-middleware.yaml.example
rename to crowdsec/k8s/crowdsec-middleware.yaml
index ddcaa27..09d51ee 100644
--- a/traefik/k8s/crowdsec-middleware.yaml.example
+++ b/crowdsec/k8s/crowdsec-middleware.yaml
@@ -11,4 +11,4 @@ spec:
       CrowdsecMode: live
       CrowdsecLapiScheme: http
       CrowdsecLapiHost: crowdsec-service.crowdsec.svc.cluster.local:8080
-      CrowdsecLapiKey: "TOKEN"
+      CrowdsecLapiKeyFile: "/etc/traefik/secrets/traefik-api-key"
diff --git a/crowdsec/k8s/crowdsec-values.yaml b/crowdsec/k8s/crowdsec-values.yaml
new file mode 100644
index 0000000..ba3b23b
--- /dev/null
+++ b/crowdsec/k8s/crowdsec-values.yaml
@@ -0,0 +1,57 @@
+container_runtime: containerd
+agent:
+  env:
+    - name: COLLECTIONS
+      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios crowdsecurity/sshd"
+  extraVolumes:
+    - name: journal-dir
+      hostPath:
+        path: /var/log/journal
+        type: DirectoryOrCreate
+    - name: run-journal-dir
+      hostPath:
+        path: /run/log/journal
+        type: DirectoryOrCreate
+  extraVolumeMounts:
+    - name: journal-dir
+      mountPath: /var/log/journal
+      readOnly: true
+    - name: run-journal-dir
+      mountPath: /run/log/journal
+      readOnly: true
+
+  acquisition:
+    - namespace: traefik
+      podName: "*traefik*"
+      program: traefik
+      poll_without_inotify: true
+
+  acquisitionCustom: |
+    - source: journalctl
+      journalctl_filter:
+        - _SYSTEMD_UNIT=sshd.service
+      labels:
+        type: syslog
+
+  resources:
+    requests:
+      cpu: 50m
+      memory: 100Mi
+    limits:
+      cpu: 200m
+      memory: 500Mi
+
+lapi:
+  env:
+    - name: COLLECTIONS
+      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios crowdsecurity/sshd"
+  service:
+    type: NodePort
+    nodePort: 30011
+  resources:
+    requests:
+      cpu: 50m
+      memory: 150Mi
+    limits:
+      cpu: 200m
+      memory: 500Mi
diff --git a/traefik/k8s/crowdsec-values.yaml b/traefik/k8s/crowdsec-values.yaml
deleted file mode 100644
index a28fb0a..0000000
--- a/traefik/k8s/crowdsec-values.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-container_runtime: containerd
-agent:
-  env:
-    - name: COLLECTIONS
-      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios LePresidente/adguardhome-bf"
-  acquisition:
-    - namespace: traefik
-      podName: "*traefik*"
-      program: traefik
-      poll_without_inotify: true
-  resources:
-    requests:
-      cpu: 50m
-      memory: 100Mi
-    limits:
-      cpu: 200m
-      memory: 500Mi
-
-lapi:
-  env:
-    - name: COLLECTIONS
-      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios LePresidente/adguardhome-bf"
-  resources:
-    requests:
-      cpu: 50m
-      memory: 150Mi
-    limits:
-      cpu: 200m
-      memory: 500Mi
diff --git a/traefik/k8s/traefik-values.yaml b/traefik/k8s/traefik-values.yaml
index 94b92a5..666bd97 100644
--- a/traefik/k8s/traefik-values.yaml
+++ b/traefik/k8s/traefik-values.yaml
@@ -113,6 +113,9 @@ volumes:
   - name: traefik-dynamic
     mountPath: /etc/traefik/dynamic
     type: configMap
+  - name: crowdsec-bouncer-secrets
+    mountPath: /etc/traefik/secrets
+    type: secret
 
 additionalArguments:
   - "--providers.file.directory=/etc/traefik/dynamic"