feat: crowdsec

- moved bouncer tokens to secrets
- experimental host ssh log parsing
- moved crowdsec to it's own directory

crowdsec/k8s/crowdsec-middleware.yaml

@@ -11,4 +11,4 @@ spec:
       CrowdsecMode: live
       CrowdsecLapiScheme: http
       CrowdsecLapiHost: crowdsec-service.crowdsec.svc.cluster.local:8080
-      CrowdsecLapiKey: "TOKEN"
+      CrowdsecLapiKeyFile: "/etc/traefik/secrets/traefik-api-key"

crowdsec/k8s/crowdsec-values.yaml

@@ -0,0 +1,57 @@
+container_runtime: containerd
+agent:
+  env:
+    - name: COLLECTIONS
+      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios crowdsecurity/sshd"
+  extraVolumes:
+    - name: journal-dir
+      hostPath:
+        path: /var/log/journal
+        type: DirectoryOrCreate
+    - name: run-journal-dir
+      hostPath:
+        path: /run/log/journal
+        type: DirectoryOrCreate
+  extraVolumeMounts:
+    - name: journal-dir
+      mountPath: /var/log/journal
+      readOnly: true
+    - name: run-journal-dir
+      mountPath: /run/log/journal
+      readOnly: true
+
+  acquisition:
+    - namespace: traefik
+      podName: "*traefik*"
+      program: traefik
+      poll_without_inotify: true
+
+  acquisitionCustom: |
+    - source: journalctl
+      journalctl_filter:
+        - _SYSTEMD_UNIT=sshd.service
+      labels:
+        type: syslog
+
+  resources:
+    requests:
+      cpu: 50m
+      memory: 100Mi
+    limits:
+      cpu: 200m
+      memory: 500Mi
+
+lapi:
+  env:
+    - name: COLLECTIONS
+      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios crowdsecurity/sshd"
+  service:
+    type: NodePort
+    nodePort: 30011
+  resources:
+    requests:
+      cpu: 50m
+      memory: 150Mi
+    limits:
+      cpu: 200m
+      memory: 500Mi

traefik/k8s/crowdsec-values.yaml

@@ -1,29 +0,0 @@
-container_runtime: containerd
-agent:
-  env:
-    - name: COLLECTIONS
-      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios LePresidente/adguardhome-bf"
-  acquisition:
-    - namespace: traefik
-      podName: "*traefik*"
-      program: traefik
-      poll_without_inotify: true
-  resources:
-    requests:
-      cpu: 50m
-      memory: 100Mi
-    limits:
-      cpu: 200m
-      memory: 500Mi
-
-lapi:
-  env:
-    - name: COLLECTIONS
-      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios LePresidente/adguardhome-bf"
-  resources:
-    requests:
-      cpu: 50m
-      memory: 150Mi
-    limits:
-      cpu: 200m
-      memory: 500Mi

traefik/k8s/traefik-values.yaml

@@ -113,6 +113,9 @@ volumes:
   - name: traefik-dynamic
     mountPath: /etc/traefik/dynamic
     type: configMap
+  - name: crowdsec-bouncer-secrets
+    mountPath: /etc/traefik/secrets
+    type: secret
 
 additionalArguments:
   - "--providers.file.directory=/etc/traefik/dynamic"