services:
  crowdsec:
    image: crowdsecurity/crowdsec:latest
    container_name: crowdsec
    networks:
      - crowdsec-net
    ports:
      - 127.0.0.1:8080:8080
    security_opt:
      - apparmor=docker-default   # security_opts are optional
    restart: unless-stopped
    environment:
      TZ: America/Chicago
      GID: "${GID:-1000}"
      COLLECTIONS: >
        crowdsecurity/linux
        crowdsecurity/iptables 
        crowdsecurity/http-cve
        crowdsecurity/base-http-scenarios
        crowdsecurity/nginx
        crowdsecurity/traefik
        crowdsecurity/whitelist-good-actors
        crowdsecurity/sshd
        crowdsecurity/appsec-virtual-patching
        crowdsecurity/appsec-generic-rules
      SCENARIOS: >
        crowdsecurity/http-path-traversal-probing
        crowdsecurity/http-xss-probing
        crowdsecurity/http-generic-bf
      PARSER: >
    volumes:
      - ./crowdsec/acquis.d:/etc/crowdsec/acquis.d/:ro
      - ./crowdsec/db:/var/lib/crowdsec/data/
      - ./crowdsec/config:/etc/crowdsec/
      - /var/log/traefik/:/var/log/traefik/:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/log/ssh.log:/var/log/ssh.log:ro
      - /var/log/mail.log:/var/log/mail.log:ro
      - /var/log/messages:/var/log/messages:ro
    healthcheck:
      test: ["CMD-SHELL", "wget -q -T 2 -O - http://127.0.0.1:8080/health || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  traefik-bouncer:
    image: docker.io/fbonalair/traefik-crowdsec-bouncer:latest
    container_name: cs-bouncer-traefik
    networks:
      - crowdsec-net
    expose:
      - 8080
    depends_on:
      crowdsec:
        condition: service_healthy
    restart: unless-stopped
    security_opt:
      - apparmor=docker-default   # security_opts are optional
    env_file:
      - .env.cs-bouncer-traefik

  firewall-bouncer:
    image: ghcr.io/knylbyte/cs-firewall-bouncer:latest
    container_name: cs-bouncer-firewall
    restart: unless-stopped
    network_mode: host
    cap_add:
      - NET_ADMIN
      - NET_RAW
    depends_on:
      crowdsec:
        condition: service_healthy
    env_file:
      - .env.cs-bouncer-firewall
    volumes:
      - ./firewall-bouncer/config:/etc/crowdsec
      - ./firewall-bouncer/log:/var/log

networks:
  crowdsec-net:
    external: true
    name: crowdsec-net