mirror of
https://github.com/euzu/tuliprox.git
synced 2026-09-16 22:22:19 +02:00
84 lines
2.3 KiB
YAML
84 lines
2.3 KiB
YAML
services:
|
|
crowdsec:
|
|
image: crowdsecurity/crowdsec:latest
|
|
container_name: crowdsec
|
|
networks:
|
|
- crowdsec-net
|
|
ports:
|
|
- 127.0.0.1:8080:8080
|
|
security_opt:
|
|
- apparmor=docker-default # security_opts are optional
|
|
restart: unless-stopped
|
|
environment:
|
|
TZ: America/Chicago
|
|
GID: "${GID:-1000}"
|
|
COLLECTIONS: >
|
|
crowdsecurity/linux
|
|
crowdsecurity/iptables
|
|
crowdsecurity/http-cve
|
|
crowdsecurity/base-http-scenarios
|
|
crowdsecurity/nginx
|
|
crowdsecurity/traefik
|
|
crowdsecurity/whitelist-good-actors
|
|
crowdsecurity/sshd
|
|
crowdsecurity/appsec-virtual-patching
|
|
crowdsecurity/appsec-generic-rules
|
|
SCENARIOS: >
|
|
crowdsecurity/http-path-traversal-probing
|
|
crowdsecurity/http-xss-probing
|
|
crowdsecurity/http-generic-bf
|
|
PARSER: >
|
|
volumes:
|
|
- ./crowdsec/acquis.d:/etc/crowdsec/acquis.d/:ro
|
|
- ./crowdsec/db:/var/lib/crowdsec/data/
|
|
- ./crowdsec/config:/etc/crowdsec/
|
|
- /var/log/traefik/:/var/log/traefik/:ro
|
|
- /var/lib/docker/containers:/var/lib/docker/containers:ro
|
|
- /var/log/ssh.log:/var/log/ssh.log:ro
|
|
- /var/log/mail.log:/var/log/mail.log:ro
|
|
- /var/log/messages:/var/log/messages:ro
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "wget -q -T 2 -O - http://127.0.0.1:8080/health || exit 1"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 10s
|
|
|
|
traefik-bouncer:
|
|
image: docker.io/fbonalair/traefik-crowdsec-bouncer:latest
|
|
container_name: cs-bouncer-traefik
|
|
networks:
|
|
- crowdsec-net
|
|
expose:
|
|
- 8080
|
|
depends_on:
|
|
crowdsec:
|
|
condition: service_healthy
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- apparmor=docker-default # security_opts are optional
|
|
env_file:
|
|
- .env.cs-bouncer-traefik
|
|
|
|
firewall-bouncer:
|
|
image: ghcr.io/knylbyte/cs-firewall-bouncer:latest
|
|
container_name: cs-bouncer-firewall
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
depends_on:
|
|
crowdsec:
|
|
condition: service_healthy
|
|
env_file:
|
|
- .env.cs-bouncer-firewall
|
|
volumes:
|
|
- ./firewall-bouncer/config:/etc/crowdsec
|
|
- ./firewall-bouncer/log:/var/log
|
|
|
|
networks:
|
|
crowdsec-net:
|
|
external: true
|
|
name: crowdsec-net
|