container_runtime: containerd

agent:
  acquisition: []
  additionalAcquisition:
    - labels:
        type: traefik
      limit: 1000
      query: |
        {namespace="traefik"}
      source: loki
      url: http://loki.prometheus.svc.cluster.local:3100/
      wait_for_ready: 30s
  env:
    - name: COLLECTIONS
      value: crowdsecurity/traefik crowdsecurity/base-http-scenarios
    - name: DISABLE_COLLECTIONS
      value: crowdsecurity/sshd
  metrics:
    enabled: true
    serviceMonitor:
      additionalLabels:
        release: prometheus-stack
      enabled: true
  # Static machine identity: agent pods mount pre-created LAPI credentials
  # (Secret crowdsec-agent-credentials, key local_api_credentials.yaml)
  # at the exact path the agent entrypoint expects. Together with the
  # patched register-init (enforced by janitor-cronjob.yaml) the agent
  # never calls `cscli lapi register` in steady state, so pod names,
  # restarts and reboots can no longer break it.
  extraVolumes:
    - name: static-creds
      secret:
        secretName: crowdsec-agent-credentials
        items:
          - key: local_api_credentials.yaml
            path: local_api_credentials.yaml
  extraVolumeMounts:
    - name: static-creds
      mountPath: /tmp_config/local_api_credentials.yaml
      subPath: local_api_credentials.yaml
      readOnly: true
  resources:
    limits:
      cpu: 200m
      memory: 500Mi
    requests:
      cpu: 50m
      memory: 100Mi

config:
  parsers:
    s02-enrich:
      mobile-whitelist.yaml: |
        name: forust/mobile-whitelist
        description: "Whitelist SWAN/4ka mobile network"
        whitelist:
          reason: "Mobile IP whitelist"
          cidr:
            - "84.245.64.0/18"

  postoverflows:
    s01-whitelist:
      home-dynamic-ip.yaml: |
        name: forust/home-dynamic-ip
        description: "Whitelist home dynamic IP"
        whitelist:
          reason: "Home dynamic IP"
          expression:
            - evt.Overflow.Alert.Source.IP in LookupHost("ddns.forust.xyz")

lapi:
  env:
    - name: COLLECTIONS
      value: crowdsecurity/traefik crowdsecurity/base-http-scenarios
    - name: DISABLE_COLLECTIONS
      value: crowdsecurity/linux crowdsecurity/sshd
  metrics:
    enabled: true
    serviceMonitor:
      additionalLabels:
        release: prometheus-stack
      enabled: true
  persistentVolume:
    config:
      enabled: true
      size: 100Mi
      storageClassName: local-path-retain
    data:
      enabled: true
      size: 1Gi
      storageClassName: local-path-retain
  resources:
    limits:
      cpu: 400m
      memory: 500Mi
    requests:
      cpu: 50m
      memory: 150Mi
  service:
    type: ClusterIP
  storeLAPICscliCredentialsInSecret: true