diff --git a/.gitignore b/.gitignore index 68aec4e..3af5679 100644 --- a/.gitignore +++ b/.gitignore @@ -106,4 +106,3 @@ temp/* traefik/k8s/local-tls.yaml converters/k8s/config.yaml convertx/k8s/config.yaml -traefik/k8s/crowdsec-middleware.yaml diff --git a/adguardhome/k8s/ingress.yaml b/adguardhome/k8s/ingress.yaml index 01761cb..c83670c 100644 --- a/adguardhome/k8s/ingress.yaml +++ b/adguardhome/k8s/ingress.yaml @@ -10,16 +10,12 @@ spec: - match: Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec services: - name: adguard-service port: 3000 - match: (Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`)) && PathPrefix(`/dns-query`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec services: - name: adguard-service port: 3000 diff --git a/authentik/k8s/ingress.yaml b/authentik/k8s/ingress.yaml index 991f0ea..118b8a1 100644 --- a/authentik/k8s/ingress.yaml +++ b/authentik/k8s/ingress.yaml @@ -10,8 +10,6 @@ spec: - match: Host(`auth.forust.xyz`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec services: - name: authentik-server-service port: 9000 diff --git a/checkmk/k8s/ingress.yaml b/checkmk/k8s/ingress.yaml index e1efbc0..2d749ab 100644 --- a/checkmk/k8s/ingress.yaml +++ b/checkmk/k8s/ingress.yaml @@ -10,8 +10,6 @@ spec: - match: Host(`cmk.forust.xyz`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec services: - name: checkmk-service port: 5000 diff --git a/crowdsec/k8s/crowdsec-middleware.yaml b/crowdsec/k8s/crowdsec-middleware.yaml deleted file mode 100644 index 09d51ee..0000000 --- a/crowdsec/k8s/crowdsec-middleware.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - name: crowdsec-bouncer - namespace: crowdsec -spec: - plugin: - crowdsec-bouncer: - enabled: true - LogLevel: INFO - CrowdsecMode: live - CrowdsecLapiScheme: http - CrowdsecLapiHost: crowdsec-service.crowdsec.svc.cluster.local:8080 - CrowdsecLapiKeyFile: "/etc/traefik/secrets/traefik-api-key" diff --git a/crowdsec/k8s/crowdsec-values.yaml b/crowdsec/k8s/crowdsec-values.yaml deleted file mode 100644 index 23d76c7..0000000 --- a/crowdsec/k8s/crowdsec-values.yaml +++ /dev/null @@ -1,65 +0,0 @@ -container_runtime: containerd -agent: - env: - - name: COLLECTIONS - value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios crowdsecurity/sshd" - extraVolumes: - - name: journal-dir - hostPath: - path: /var/log/journal - type: DirectoryOrCreate - - name: run-journal-dir - hostPath: - path: /run/log/journal - type: DirectoryOrCreate - extraVolumeMounts: - - name: journal-dir - mountPath: /var/log/journal - readOnly: true - - name: run-journal-dir - mountPath: /run/log/journal - readOnly: true - - acquisition: - - namespace: traefik - podName: "*traefik*" - program: traefik - poll_without_inotify: true - - acquisitionCustom: | - - source: journalctl - journalctl_filter: - - _SYSTEMD_UNIT=sshd.service - labels: - type: syslog - - resources: - requests: - cpu: 50m - memory: 100Mi - limits: - cpu: 200m - memory: 500Mi - -lapi: - env: - - name: COLLECTIONS - value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios crowdsecurity/sshd" - service: - type: NodePort - nodePort: 30011 - resources: - requests: - cpu: 50m - memory: 150Mi - limits: - cpu: 200m - memory: 500Mi - -metrics: - enabled: true - serviceMonitor: - additionalLabels: - release: prometheus-stack - enabled: true - namespace: prometheus diff --git a/crowdsec/k8s/post-upgrade.sh b/crowdsec/k8s/post-upgrade.sh deleted file mode 100755 index 6918a7f..0000000 --- a/crowdsec/k8s/post-upgrade.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/sh - -kubectl patch daemonset -n crowdsec crowdsec-agent --type='json' -p='[{ - "op": "replace", - "path": "/spec/template/spec/initContainers/0/command", - "value": ["sh", "-c", "until nc \"$LAPI_HOST\" \"$LAPI_PORT\" -z; do echo waiting for lapi to start; sleep 5; done; ln -s /staging/etc/crowdsec /etc/crowdsec; cscli lapi register --machine \"$USERNAME\" -u \"$LAPI_URL\" --token \"$REGISTRATION_TOKEN\" 2>/dev/null || true; cp /etc/crowdsec/local_api_credentials.yaml /tmp_config/local_api_credentials.yaml 2>/dev/null || true"] -}]' 2>&1 - -kubectl rollout restart -n crowdsec daemonset/crowdsec-agent 2>&1 -kubectl rollout status -n crowdsec daemonset/crowdsec-agent --timeout=120s 2>&1 diff --git a/dockmon/k8s/ingress.yaml b/dockmon/k8s/ingress.yaml index bbaffeb..546ad8f 100644 --- a/dockmon/k8s/ingress.yaml +++ b/dockmon/k8s/ingress.yaml @@ -18,8 +18,6 @@ spec: - match: Host(`dockmon.forust.xyz`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec - name: security-headers@file services: - name: dockmon-service diff --git a/downtify/k8s/ingress.yaml b/downtify/k8s/ingress.yaml index c381a66..9deb241 100644 --- a/downtify/k8s/ingress.yaml +++ b/downtify/k8s/ingress.yaml @@ -10,7 +10,6 @@ spec: - match: Host(`downtify.forust.xyz`) kind: Rule middlewares: - - name: crowdsec-crowdsec-bouncer@kubernetescrd - name: security-chain@file services: - name: downtify-service diff --git a/gitea/k8s/ingress.yaml b/gitea/k8s/ingress.yaml index de80195..434df56 100644 --- a/gitea/k8s/ingress.yaml +++ b/gitea/k8s/ingress.yaml @@ -10,16 +10,12 @@ spec: - match: Host(`gitea.forust.xyz`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec services: - name: gitea-service port: 3000 - match: Host(`gcr.forust.xyz`) && PathPrefix(`/v2`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec services: - name: gitea-service port: 3000 diff --git a/headscale/k8s/ingress.yaml b/headscale/k8s/ingress.yaml index 918428c..07c3f9e 100644 --- a/headscale/k8s/ingress.yaml +++ b/headscale/k8s/ingress.yaml @@ -19,24 +19,18 @@ spec: - match: Host(`hs.forust.xyz`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec services: - name: headscale-server-external port: 8080 - match: Host(`hs.forust.xyz`) && PathPrefix(`/admin`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec services: - name: headscale-ui-external port: 80 - match: Host(`hs.forust.xyz`) && PathPrefix(`/metrics`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec services: - name: headscale-server-external port: 9090 @@ -56,8 +50,6 @@ spec: kind: Rule middlewares: - name: headplane-prefix - - name: crowdsec-bouncer - namespace: crowdsec services: - name: headplane-external port: 3000 diff --git a/homepages/k8s/ingress.yaml b/homepages/k8s/ingress.yaml index 0b17b38..8fdbefd 100644 --- a/homepages/k8s/ingress.yaml +++ b/homepages/k8s/ingress.yaml @@ -10,8 +10,6 @@ spec: - match: Host(`forust.xyz`) || Host(`www.forust.xyz`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec priority: 10 services: - name: forust-homepage-service @@ -47,8 +45,6 @@ spec: - match: Host(`xdfnx.cfd`) || Host(`www.xdfnx.cfd`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec services: - name: xdfnx-homepage-service port: 80 diff --git a/kener/k8s/ingress.yaml b/kener/k8s/ingress.yaml index c35e01a..49e448c 100644 --- a/kener/k8s/ingress.yaml +++ b/kener/k8s/ingress.yaml @@ -10,7 +10,6 @@ spec: - match: Host(`status.forust.xyz`) kind: Rule middlewares: - - name: crowdsec-crowdsec-bouncer@kubernetescrd services: - name: kener-service port: 3000 diff --git a/n8n/k8s/ingress.yaml b/n8n/k8s/ingress.yaml index ee875e7..a9af090 100644 --- a/n8n/k8s/ingress.yaml +++ b/n8n/k8s/ingress.yaml @@ -10,8 +10,6 @@ spec: - match: Host(`n8n.forust.xyz`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec services: - name: n8n-service port: 5678 diff --git a/netronome/k8s/ingress.yaml b/netronome/k8s/ingress.yaml index 9382ff4..35dd264 100644 --- a/netronome/k8s/ingress.yaml +++ b/netronome/k8s/ingress.yaml @@ -10,8 +10,6 @@ spec: - match: Host(`nm.forust.xyz`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec services: - name: netronome-service port: 7575 diff --git a/nextcloud/k8s/ingress.yaml b/nextcloud/k8s/ingress.yaml index 1f5c78f..f6f2424 100644 --- a/nextcloud/k8s/ingress.yaml +++ b/nextcloud/k8s/ingress.yaml @@ -12,8 +12,6 @@ spec: kind: Rule middlewares: - name: nextcloud-chain@file - - name: crowdsec-bouncer - namespace: crowdsec services: - name: nextcloud-apache port: 11000 @@ -32,8 +30,6 @@ spec: - match: Host(`nextcloud.workstation.internal`) || Host(`nextcloud.gigaforust.internal`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec - name: nextcloud-chain@file services: - name: nextcloud-apache diff --git a/portainer/k8s/ingress.yaml b/portainer/k8s/ingress.yaml index c928c2d..c3688c6 100644 --- a/portainer/k8s/ingress.yaml +++ b/portainer/k8s/ingress.yaml @@ -10,8 +10,6 @@ spec: - match: Host(`portainer.forust.xyz`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec services: - name: portainer-service port: 9000 diff --git a/prometheus-stack/k8s/ingress.yaml b/prometheus-stack/k8s/ingress.yaml index 5f2da35..5b8dde4 100644 --- a/prometheus-stack/k8s/ingress.yaml +++ b/prometheus-stack/k8s/ingress.yaml @@ -10,8 +10,6 @@ spec: - match: Host(`grafana.forust.xyz`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec - name: "security-chain@file" services: - name: prometheus-stack-grafana diff --git a/searxng/k8s/ingress.yaml b/searxng/k8s/ingress.yaml index faa7a46..ee8c622 100644 --- a/searxng/k8s/ingress.yaml +++ b/searxng/k8s/ingress.yaml @@ -10,8 +10,6 @@ spec: - match: Host(`s.forust.xyz`) || Host(`search.forust.xyz`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec services: - name: searxng-service port: 8080 diff --git a/termix/k8s/ingress.yaml b/termix/k8s/ingress.yaml index 4104519..bb454aa 100644 --- a/termix/k8s/ingress.yaml +++ b/termix/k8s/ingress.yaml @@ -10,8 +10,6 @@ spec: - match: Host(`termix.forust.xyz`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec services: - name: termix-service port: 8080 diff --git a/traefik/k8s/ingress.yaml b/traefik/k8s/ingress.yaml index b4c6594..549f50e 100644 --- a/traefik/k8s/ingress.yaml +++ b/traefik/k8s/ingress.yaml @@ -11,8 +11,6 @@ spec: - match: Host(`traefik.forust.xyz`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec services: - name: api@internal kind: TraefikService diff --git a/traefik/k8s/traefik-values.yaml b/traefik/k8s/traefik-values.yaml index ad39810..61b6e97 100644 --- a/traefik/k8s/traefik-values.yaml +++ b/traefik/k8s/traefik-values.yaml @@ -1,5 +1,9 @@ # Auto-generated by forust | See https://github.com/traefik/traefik-helm-chart/blob/master/values.yaml hostNetwork: false +image: + registry: docker.io/library + repository: traefik + tag: v3.7.6 securityContext: capabilities: @@ -23,16 +27,7 @@ updateStrategy: type: Recreate deployment: - initContainers: - - name: volume-permissions - image: busybox:latest - command: - - sh - - -c - - "mkdir -p /data/letsencrypt && touch /data/letsencrypt/acme.json && chmod 600 /data/letsencrypt/acme.json" - volumeMounts: - - name: data - mountPath: /data + enabled: true providers: kubernetesIngress: @@ -123,10 +118,6 @@ volumes: - name: traefik-dynamic mountPath: /etc/traefik/dynamic type: configMap - - name: crowdsec-bouncer-secrets - mountPath: /etc/traefik/secrets - type: secret - additionalArguments: - "--providers.file.directory=/etc/traefik/dynamic" - "--providers.file.watch=true" @@ -139,9 +130,3 @@ log: accessLog: enabled: true format: common - -experimental: - plugins: - crowdsec-bouncer: - moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin - version: v1.3.3 diff --git a/uptime-kuma/k8s/ingress.yaml b/uptime-kuma/k8s/ingress.yaml index fc5cc5c..76b40a3 100644 --- a/uptime-kuma/k8s/ingress.yaml +++ b/uptime-kuma/k8s/ingress.yaml @@ -10,8 +10,6 @@ spec: - match: Host(`uptime.forust.xyz`) kind: Rule middlewares: - - name: crowdsec-bouncer - namespace: crowdsec services: - name: uptime-kuma-service port: 3001