Add Crowdsec and Caddy bouncer to gateway

gateway/caddy/Caddyfile

@@ -1,4 +1,8 @@
 {
+	crowdsec {
+		api_url http://crowdsec:8080
+		api_key {$CROWDSEC_API_KEY}
+	}
 	servers {
 		trusted_proxies static private_ranges
 		trusted_proxies_strict
@@ -21,15 +25,21 @@
 }
 
 auth.64815139.xyz {
+	route {
+		crowdsec
 		reverse_proxy authelia:9091
+	}
 }
 
 www.64815139.xyz {
+	route {
+		crowdsec
 		import secure *
 
 		root * /var/www/dashboard
 		encode gzip
 		file_server
+	}
 
 	log {
 		output file /var/log/caddy/dashboard.log
@@ -123,7 +133,6 @@ search.64815139.xyz {
 		Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self' https://github.com/searxng/searxng/issues/new; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self' https://overpass-api.de; img-src 'self' data: https://*.tile.openstreetmap.org; frame-src https://www.youtube-nocookie.com https://player.vimeo.com https://www.dailymotion.com https://www.deezer.com https://www.mixcloud.com https://w.soundcloud.com https://embed.spotify.com"
 	}
 
-
 	handle {
 		encode zstd gzip
 
@@ -136,18 +145,30 @@ search.64815139.xyz {
 }
 
 gitea.64815139.xyz {
+	route {
+		crowdsec
 		rewrite /user/login /user/oauth2/Authelia
 		reverse_proxy 192.168.0.210:3000
+	}
 }
 
 immich.64815139.xyz {
+	route {
+		crowdsec
 		reverse_proxy 192.168.0.210:2283
+	}
 }
 
 uptime.64815139.xyz {
+	route {
+		crowdsec
 		reverse_proxy 192.168.0.210:4393
+	}
 }
 
 oaT3cqYuCAegcoM4Xc4Pun1BUMOschxR.64815139.xyz {
+	route {
+		crowdsec
 		reverse_proxy 192.168.0.210:4449
+	}
 }

gateway/caddy/Dockerfile

@@ -0,0 +1,15 @@
+ARG CADDY_VERSION=2
+
+FROM caddy:${CADDY_VERSION}-builder-alpine AS builder
+
+RUN xcaddy build \
+    --with github.com/mholt/caddy-l4 \
+    --with github.com/caddyserver/transform-encoder \
+    --with github.com/hslatman/caddy-crowdsec-bouncer/http@main \
+    --with github.com/hslatman/caddy-crowdsec-bouncer/layer4@main
+
+FROM caddy:${CADDY_VERSION} AS caddy
+
+WORKDIR /
+
+COPY --from=builder /usr/bin/caddy /usr/bin/caddy

gateway/caddy/crowdsec/acquis.yaml

@@ -0,0 +1,4 @@
+filenames:
+  - /var/log/caddy/*.log
+labels:
+  type: caddy

gateway/docker-compose.yml

@@ -80,18 +80,45 @@ services:
     volumes:
       - ./data/redis:/data
   caddy:
-    image: caddy:2.8.4-alpine
+    build:
+      context: ./caddy
+      target: caddy
     container_name: gateway_caddy
+    depends_on:
+      - crowdsec
     restart: unless-stopped
     ports:
       - "80:80"
       - "443:443"
       - "443:443/udp"
+    env_file:
+      - ./secrets/caddy/.env
     volumes:
       - ./caddy/Caddyfile:/etc/caddy/Caddyfile
       - ./dashboard:/var/www/dashboard
       - caddy_data:/data
       - caddy_config:/config
+    networks:
+      crowdsec:
+    security_opt:
+      - no-new-privileges=true
+  crowdsec:
+    image: docker.io/crowdsecurity/crowdsec:latest
+    container_name: gateway_crowdsec
+    environment:
+      - GID=1000
+      - COLLECTIONS=crowdsecurity/caddy crowdsecurity/http-cve crowdsecurity/whitelist-good-actors
+    env_file:
+      - ./secrets/crowdsec/.env
+    volumes:
+      - ./crowdsec/data:/var/lib/crowdsec/data/
+      - ./caddy/crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml
+      - caddy_logs:/var/log/caddy:ro
+    networks:
+      crowdsec:
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges=true
   ddns:
     image: timothyjmiller/cloudflare-ddns:latest
     container_name: gateway_cloudflare_ddns
@@ -121,5 +148,9 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
 volumes:
+  caddy_logs:
   caddy_data:
   caddy_config:
+networks:
+  crowdsec:
+    driver: bridge