From 5c0f59f00c59a87898132bbd18844c7c401980c6 Mon Sep 17 00:00:00 2001
From: admin <alec@bryanmail.net>
Date: Sat, 27 Jun 2026 06:24:07 -0700
Subject: [PATCH] =?UTF-8?q?Add=20security.yaml=20=E2=80=94=20Pattern=20B?=
 =?UTF-8?q?=20migration,=20no=20env=5Ffile,=20domain=20parameterized,=20se?=
 =?UTF-8?q?crets=20in=20host=20.env?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 security.yaml | 68 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 security.yaml

diff --git a/security.yaml b/security.yaml
new file mode 100644
index 0000000..0838be9
--- /dev/null
+++ b/security.yaml
@@ -0,0 +1,68 @@
+services:
+  crowdsec:
+    image: ghcr.io/crowdsecurity/crowdsec:latest
+    hostname: crowdsec
+    environment:
+      GID: "1000"
+      CUSTOM_HOSTNAME: "crowdsec"
+      COLLECTIONS: "crowdsecurity/traefik crowdsecurity/http-cve crowdsecurity/base-http-scenarios crowdsecurity/sshd crowdsecurity/linux crowdsecurity/appsec-generic-rules crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-crs"
+      DOCKER_HOST: unix:///var/run/docker.sock
+      PGDSN: ${CROWDSEC_PGDSN}
+      BOUNCER_KEY_TRAEFIK: ${BOUNCER_KEY_TRAEFIK}
+    volumes:
+      - /volume1/docker/crowdsec/var/lib/crowdsec/data:/var/lib/crowdsec/data
+      - /volume1/docker/crowdsec/etc/crowdsec:/etc/crowdsec/
+      - /volume1/docker/traefik/logs:/var/log/traefik:ro
+      - /var/run/docker.sock:/var/run/docker.sock
+    networks:
+      - traefik_backend
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.crowdsec.rule=Host(`security.${DOMAIN}`)
+        - traefik.http.routers.crowdsec.tls=true
+        - traefik.http.routers.crowdsec.tls.certresolver=letsencrypt
+        - traefik.http.routers.crowdsec.entrypoints=websecure
+        - traefik.http.services.crowdsec.loadbalancer.server.port=8080
+        - traefik.swarm.network=traefik_backend
+        - traefik.http.routers.crowdsec.middlewares=crowdsec@file
+      resources:
+        limits:
+          cpus: '4'
+          memory: 512M
+
+  crowdsec-web-ui:
+    image: ghcr.io/theduffman85/crowdsec-web-ui:latest
+    environment:
+      CROWDSEC_API_URL: http://crowdsec:8080
+      CROWDSEC_API_KEY: ${CROWDSEC_API_KEY}
+      CROWDSEC_URL: http://crowdsec:8080
+      CROWDSEC_USER: crowdsec-web-ui
+      CROWDSEC_PASSWORD: ${CROWDSEC_PASSWORD}
+      CROWDSEC_SIMULATIONS_ENABLED: "false"
+      CROWDSEC_LOOKBACK_PERIOD: "7d"
+      CROWDSEC_REFRESH_INTERVAL: "30s"
+      CROWDSEC_ALWAYS_SHOW_MACHINE: "false"
+    volumes:
+      - /volume1/docker/crowdsec-web-ui:/data
+    networks:
+      - traefik_backend
+    ports:
+      - 5173:5173
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.crowdsec-ui.rule=Host(`secure.${DOMAIN}`)
+        - traefik.http.routers.crowdsec-ui.tls=true
+        - traefik.http.routers.crowdsec-ui.tls.certresolver=letsencrypt
+        - traefik.http.routers.crowdsec-ui.entrypoints=websecure
+        - traefik.http.services.crowdsec-ui.loadbalancer.server.scheme=http
+        - traefik.http.services.crowdsec-ui.loadbalancer.server.port=3000
+        - traefik.http.routers.crowdsec-ui.middlewares=forwardAuth-authentik@file
+        - traefik.swarm.network=traefik_backend
+
+networks:
+  postgresql_db-backend:
+    external: true
+  traefik_backend:
+    external: true