cs-haproxy-spoa-bouncer/docker-compose.yaml at main · crowdsecurity/cs-haproxy-spoa-bouncer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
services:
  spoa:
    image: crowdsecurity/crowdsec-spoa:latest
    restart: unless-stopped
    build:
      context: .
      dockerfile: Dockerfile
    depends_on:
      - crowdsec
    volumes:
      - sockets:/run/
      - templates:/var/lib/crowdsec-haproxy-spoa-bouncer/html/
      # Uncomment the line below when using haproxy-lua.cfg (Lua rendering mode):
      # - lua:/usr/lib/crowdsec-haproxy-spoa-bouncer/lua/
      - geodb:/var/lib/crowdsec/data/
      - ./config/crowdsec-spoa-bouncer.yaml.local:/etc/crowdsec/bouncers/crowdsec-spoa-bouncer.yaml.local
    networks:
      crowdsec:
        ipv4_address: 10.5.5.254
    deploy:
      resources:
        limits:
          cpus: "4.0"
          memory: 250M


  whoami:
    image: traefik/whoami:latest
    networks:
      - crowdsec
    command:
       - --port=2020

  haproxy:
    image: haproxy:2.9.7-alpine
    restart: unless-stopped
    volumes:
      - ./config/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg
      - ./config/crowdsec.cfg:/etc/haproxy/crowdsec.cfg
      - sockets:/run/
      - templates:/var/lib/crowdsec-haproxy-spoa-bouncer/html/
      # Uncomment the two lines below when using haproxy-lua.cfg (Lua rendering mode);
      # also uncomment the matching lua: volume in the spoa service and the volumes section.
      # - lua:/usr/lib/crowdsec-haproxy-spoa-bouncer/lua/
      # - ./config/haproxy-lua.cfg:/usr/local/etc/haproxy/haproxy.cfg
    ports:
      - "9090:9090"
    depends_on:
      - crowdsec
      - spoa
      - whoami
    networks:
      - crowdsec

  crowdsec:
    image: crowdsecurity/crowdsec:latest
    restart: unless-stopped
    environment:
      - BOUNCER_KEY_SPOA=+4iYgItcalc9+0tWrvrj9R6Wded/W1IRwRtNmcWR9Ws
      - DISABLE_ONLINE_API=true
      - CROWDSEC_BYPASS_DB_VOLUME_CHECK=true
      - COLLECTIONS=crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules
    volumes:
      - geodb:/staging/var/lib/crowdsec/data/
      - ./docker/crowdsec/acquisitions/appsec.yaml:/etc/crowdsec/acquis.d/appsec.yaml
    networks:
      - crowdsec

volumes:
  sockets:
    driver: local
  templates:
    driver: local
  geodb:
    driver: local
  # Uncomment when using haproxy-lua.cfg; the spoa service populates this volume with
  # Lua scripts at /usr/lib/crowdsec-haproxy-spoa-bouncer/lua/ and haproxy mounts it.
  # lua:
  #   driver: local

networks:
  crowdsec:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: "10.5.5.0/24"