Add security.yaml — Pattern B migration, no env_file, domain parameterized, secrets in host .env

2026-06-27 06:24:07 -07:00
parent e7842fda6b
commit 5c0f59f00c
1 changed files with 68 additions and 0 deletions
@@ -0,0 +1,68 @@
+services:
+  crowdsec:
+    image: ghcr.io/crowdsecurity/crowdsec:latest
+    hostname: crowdsec
+    environment:
+      GID: "1000"
+      CUSTOM_HOSTNAME: "crowdsec"
+      COLLECTIONS: "crowdsecurity/traefik crowdsecurity/http-cve crowdsecurity/base-http-scenarios crowdsecurity/sshd crowdsecurity/linux crowdsecurity/appsec-generic-rules crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-crs"
+      DOCKER_HOST: unix:///var/run/docker.sock
+      PGDSN: ${CROWDSEC_PGDSN}
+      BOUNCER_KEY_TRAEFIK: ${BOUNCER_KEY_TRAEFIK}
+    volumes:
+      - /volume1/docker/crowdsec/var/lib/crowdsec/data:/var/lib/crowdsec/data
+      - /volume1/docker/crowdsec/etc/crowdsec:/etc/crowdsec/
+      - /volume1/docker/traefik/logs:/var/log/traefik:ro
+      - /var/run/docker.sock:/var/run/docker.sock
+    networks:
+      - traefik_backend
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.crowdsec.rule=Host(`security.${DOMAIN}`)
+        - traefik.http.routers.crowdsec.tls=true
+        - traefik.http.routers.crowdsec.tls.certresolver=letsencrypt
+        - traefik.http.routers.crowdsec.entrypoints=websecure
+        - traefik.http.services.crowdsec.loadbalancer.server.port=8080
+        - traefik.swarm.network=traefik_backend
+        - traefik.http.routers.crowdsec.middlewares=crowdsec@file
+      resources:
+        limits:
+          cpus: '4'
+          memory: 512M
+
+  crowdsec-web-ui:
+    image: ghcr.io/theduffman85/crowdsec-web-ui:latest
+    environment:
+      CROWDSEC_API_URL: http://crowdsec:8080
+      CROWDSEC_API_KEY: ${CROWDSEC_API_KEY}
+      CROWDSEC_URL: http://crowdsec:8080
+      CROWDSEC_USER: crowdsec-web-ui
+      CROWDSEC_PASSWORD: ${CROWDSEC_PASSWORD}
+      CROWDSEC_SIMULATIONS_ENABLED: "false"
+      CROWDSEC_LOOKBACK_PERIOD: "7d"
+      CROWDSEC_REFRESH_INTERVAL: "30s"
+      CROWDSEC_ALWAYS_SHOW_MACHINE: "false"
+    volumes:
+      - /volume1/docker/crowdsec-web-ui:/data
+    networks:
+      - traefik_backend
+    ports:
+      - 5173:5173
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.crowdsec-ui.rule=Host(`secure.${DOMAIN}`)
+        - traefik.http.routers.crowdsec-ui.tls=true
+        - traefik.http.routers.crowdsec-ui.tls.certresolver=letsencrypt
+        - traefik.http.routers.crowdsec-ui.entrypoints=websecure
+        - traefik.http.services.crowdsec-ui.loadbalancer.server.scheme=http
+        - traefik.http.services.crowdsec-ui.loadbalancer.server.port=3000
+        - traefik.http.routers.crowdsec-ui.middlewares=forwardAuth-authentik@file
+        - traefik.swarm.network=traefik_backend
+
+networks:
+  postgresql_db-backend:
+    external: true
+  traefik_backend:
+    external: true