From 2f97821dc6cc29f29107385cd20e76cf3aa8ee6d Mon Sep 17 00:00:00 2001
From: mr-forust <vzlomdsisma@gmail.com>
Date: Sun, 14 Jun 2026 23:21:37 +0200
Subject: [PATCH] feat: crowdsec lapi helm

---
 .gitignore                                   |  1 +
 traefik/k8s/crowdsec-middleware.yaml.example | 14 ++++++++++
 traefik/k8s/crowdsec-values.yaml             | 29 ++++++++++++++++++++
 traefik/k8s/traefik-values.yaml              | 13 ++++++++-
 4 files changed, 56 insertions(+), 1 deletion(-)
 create mode 100644 traefik/k8s/crowdsec-middleware.yaml.example
 create mode 100644 traefik/k8s/crowdsec-values.yaml

diff --git a/.gitignore b/.gitignore
index 94e29f9..ebda3ac 100644
--- a/.gitignore
+++ b/.gitignore
@@ -105,3 +105,4 @@ temp/*
 !*/k8s/*secret*.example
 traefik/k8s/local-tls.yaml
 convertx/k8s/config.yaml
+traefik/k8s/crowdsec-middleware.yaml
diff --git a/traefik/k8s/crowdsec-middleware.yaml.example b/traefik/k8s/crowdsec-middleware.yaml.example
new file mode 100644
index 0000000..ddcaa27
--- /dev/null
+++ b/traefik/k8s/crowdsec-middleware.yaml.example
@@ -0,0 +1,14 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: crowdsec-bouncer
+  namespace: crowdsec
+spec:
+  plugin:
+    crowdsec-bouncer:
+      enabled: true
+      LogLevel: INFO
+      CrowdsecMode: live
+      CrowdsecLapiScheme: http
+      CrowdsecLapiHost: crowdsec-service.crowdsec.svc.cluster.local:8080
+      CrowdsecLapiKey: "TOKEN"
diff --git a/traefik/k8s/crowdsec-values.yaml b/traefik/k8s/crowdsec-values.yaml
new file mode 100644
index 0000000..a28fb0a
--- /dev/null
+++ b/traefik/k8s/crowdsec-values.yaml
@@ -0,0 +1,29 @@
+container_runtime: containerd
+agent:
+  env:
+    - name: COLLECTIONS
+      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios LePresidente/adguardhome-bf"
+  acquisition:
+    - namespace: traefik
+      podName: "*traefik*"
+      program: traefik
+      poll_without_inotify: true
+  resources:
+    requests:
+      cpu: 50m
+      memory: 100Mi
+    limits:
+      cpu: 200m
+      memory: 500Mi
+
+lapi:
+  env:
+    - name: COLLECTIONS
+      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios LePresidente/adguardhome-bf"
+  resources:
+    requests:
+      cpu: 50m
+      memory: 150Mi
+    limits:
+      cpu: 200m
+      memory: 500Mi
diff --git a/traefik/k8s/traefik-values.yaml b/traefik/k8s/traefik-values.yaml
index 28a67f4..94b92a5 100644
--- a/traefik/k8s/traefik-values.yaml
+++ b/traefik/k8s/traefik-values.yaml
@@ -13,6 +13,8 @@ service:
   type: LoadBalancer
   annotations:
     metallb.io/loadBalancerIPs: "192.168.80.2"
+  spec:
+    externalTrafficPolicy: Local
 api:
   dashboard: true
   insecure: true
@@ -115,10 +117,19 @@ volumes:
 additionalArguments:
   - "--providers.file.directory=/etc/traefik/dynamic"
   - "--providers.file.watch=true"
+  - "--providers.kubernetesCRD.allowCrossNamespace=true"
+  - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
+  - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
 
 logs:
   general:
     level: INFO
-    format: json
   access:
     enabled: true
+    format: common
+
+experimental:
+  plugins:
+    crowdsec-bouncer:
+      moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
+      version: v1.3.3