drmathias/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Crowdsec and Caddy bouncer to gateway

Browse Source
This commit is contained in:
Adam
2024-10-15 12:56:17 +01:00
parent 2b0118c779
commit 29908f7f8a
4 changed files with 164 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gateway/caddy/Caddyfile
+112 -91
View File
@@ -1,4 +1,8 @@
{ {
crowdsec {
api_url http://crowdsec:8080
api_key {$CROWDSEC_API_KEY}
}
servers { servers {
trusted_proxies static private_ranges trusted_proxies static private_ranges
trusted_proxies_strict trusted_proxies_strict
@@ -6,38 +10,44 @@
} }
(secure) { (secure) {
@static-files { @static-files {
file file
path *.ico *.css *.js *.gif *.webp *.avif *.jpg *.jpeg *.png *.svg *.woff *.woff2 path *.ico *.css *.js *.gif *.webp *.avif *.jpg *.jpeg *.png *.svg *.woff *.woff2
} }
header @static-files Cache-Control "max-age=5184000" header @static-files Cache-Control "max-age=5184000"
header / Cache-Control "no-cache, no-store, must-revalidate" header / Cache-Control "no-cache, no-store, must-revalidate"
forward_auth authelia:9091 { forward_auth authelia:9091 {
uri /api/authz/forward-auth uri /api/authz/forward-auth
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
} }
} }
auth.64815139.xyz { auth.64815139.xyz {
reverse_proxy authelia:9091 route {
crowdsec
reverse_proxy authelia:9091
}
} }
www.64815139.xyz { www.64815139.xyz {
import secure * route {
crowdsec
import secure *
root * /var/www/dashboard root * /var/www/dashboard
encode gzip encode gzip
file_server file_server
}
log { log {
output file /var/log/caddy/dashboard.log output file /var/log/caddy/dashboard.log
} }
} }
64815139.xyz { 64815139.xyz {
redir https://www.{host}{uri} redir https://www.{host}{uri}
} }
search.64815139.xyz { search.64815139.xyz {
@@ -45,109 +55,120 @@ search.64815139.xyz {
output discard output discard
} }
import secure * import secure *
@api { @api {
path /config path /config
path /healthz path /healthz
path /stats/errors path /stats/errors
path /stats/checker path /stats/checker
} }
@static { @static {
path /static/* path /static/*
} }
@notstatic { @notstatic {
not path /static/* not path /static/*
} }
@imageproxy { @imageproxy {
path /image_proxy path /image_proxy
} }
@notimageproxy { @notimageproxy {
not path /image_proxy not path /image_proxy
} }
header { header {
# Enable HTTP Strict Transport Security (HSTS) to force clients to always connect via HTTPS # Enable HTTP Strict Transport Security (HSTS) to force clients to always connect via HTTPS
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
# Enable cross-site filter (XSS) and tell browser to block detected attacks # Enable cross-site filter (XSS) and tell browser to block detected attacks
X-XSS-Protection "1; mode=block" X-XSS-Protection "1; mode=block"
# Prevent some browsers from MIME-sniffing a response away from the declared Content-Type # Prevent some browsers from MIME-sniffing a response away from the declared Content-Type
X-Content-Type-Options "nosniff" X-Content-Type-Options "nosniff"
# Disable some features # Disable some features
Permissions-Policy "accelerometer=(),ambient-light-sensor=(),autoplay=(),camera=(),encrypted-media=(),focus-without-user-activation=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),speaker=(),sync-xhr=(),usb=(),vr=()" Permissions-Policy "accelerometer=(),ambient-light-sensor=(),autoplay=(),camera=(),encrypted-media=(),focus-without-user-activation=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),speaker=(),sync-xhr=(),usb=(),vr=()"
# Disable some features (legacy) # Disable some features (legacy)
Feature-Policy "accelerometer 'none';ambient-light-sensor 'none'; autoplay 'none';camera 'none';encrypted-media 'none';focus-without-user-activation 'none'; geolocation 'none';gyroscope 'none';magnetometer 'none';microphone 'none';midi 'none';payment 'none';picture-in-picture 'none'; speaker 'none';sync-xhr 'none';usb 'none';vr 'none'" Feature-Policy "accelerometer 'none';ambient-light-sensor 'none'; autoplay 'none';camera 'none';encrypted-media 'none';focus-without-user-activation 'none'; geolocation 'none';gyroscope 'none';magnetometer 'none';microphone 'none';midi 'none';payment 'none';picture-in-picture 'none'; speaker 'none';sync-xhr 'none';usb 'none';vr 'none'"
# Referer # Referer
Referrer-Policy "no-referrer" Referrer-Policy "no-referrer"
# X-Robots-Tag # X-Robots-Tag
X-Robots-Tag "noindex, noarchive, nofollow" X-Robots-Tag "noindex, noarchive, nofollow"
# Remove Server header # Remove Server header
-Server -Server
} }
header @api { header @api {
Access-Control-Allow-Methods "GET, OPTIONS" Access-Control-Allow-Methods "GET, OPTIONS"
Access-Control-Allow-Origin "*" Access-Control-Allow-Origin "*"
} }
# Cache # Cache
header @static { header @static {
# Cache # Cache
Cache-Control "public, max-age=31536000" Cache-Control "public, max-age=31536000"
defer defer
} }
header @notstatic { header @notstatic {
# No Cache # No Cache
Cache-Control "no-cache, no-store" Cache-Control "no-cache, no-store"
Pragma "no-cache" Pragma "no-cache"
} }
# CSP (see http://content-security-policy.com/ ) # CSP (see http://content-security-policy.com/ )
header @imageproxy { header @imageproxy {
Content-Security-Policy "default-src 'none'; img-src 'self' data:" Content-Security-Policy "default-src 'none'; img-src 'self' data:"
} }
header @notimageproxy { header @notimageproxy {
Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self' https://github.com/searxng/searxng/issues/new; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self' https://overpass-api.de; img-src 'self' data: https://*.tile.openstreetmap.org; frame-src https://www.youtube-nocookie.com https://player.vimeo.com https://www.dailymotion.com https://www.deezer.com https://www.mixcloud.com https://w.soundcloud.com https://embed.spotify.com" Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self' https://github.com/searxng/searxng/issues/new; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self' https://overpass-api.de; img-src 'self' data: https://*.tile.openstreetmap.org; frame-src https://www.youtube-nocookie.com https://player.vimeo.com https://www.dailymotion.com https://www.deezer.com https://www.mixcloud.com https://w.soundcloud.com https://embed.spotify.com"
} }
handle {
handle {
encode zstd gzip encode zstd gzip
reverse_proxy 192.168.0.210:8080 { reverse_proxy 192.168.0.210:8080 {
header_up X-Forwarded-Port {http.request.port} header_up X-Forwarded-Port {http.request.port}
header_up X-Forwarded-Proto {http.request.scheme} header_up X-Forwarded-Proto {http.request.scheme}
header_up X-Real-IP {remote_host} header_up X-Real-IP {remote_host}
} }
} }
} }
gitea.64815139.xyz { gitea.64815139.xyz {
rewrite /user/login /user/oauth2/Authelia route {
reverse_proxy 192.168.0.210:3000 crowdsec
rewrite /user/login /user/oauth2/Authelia
reverse_proxy 192.168.0.210:3000
}
} }
immich.64815139.xyz { immich.64815139.xyz {
reverse_proxy 192.168.0.210:2283 route {
crowdsec
reverse_proxy 192.168.0.210:2283
}
} }
uptime.64815139.xyz { uptime.64815139.xyz {
reverse_proxy 192.168.0.210:4393 route {
crowdsec
reverse_proxy 192.168.0.210:4393
}
} }
oaT3cqYuCAegcoM4Xc4Pun1BUMOschxR.64815139.xyz { oaT3cqYuCAegcoM4Xc4Pun1BUMOschxR.64815139.xyz {
reverse_proxy 192.168.0.210:4449 route {
crowdsec
reverse_proxy 192.168.0.210:4449
}
} }
gateway/caddy/Dockerfile
+15
View File
@@ -0,0 +1,15 @@
ARG CADDY_VERSION=2
FROM caddy:${CADDY_VERSION}-builder-alpine AS builder
RUN xcaddy build \
--with github.com/mholt/caddy-l4 \
--with github.com/caddyserver/transform-encoder \
--with github.com/hslatman/caddy-crowdsec-bouncer/http@main \
--with github.com/hslatman/caddy-crowdsec-bouncer/layer4@main
FROM caddy:${CADDY_VERSION} AS caddy
WORKDIR /
COPY --from=builder /usr/bin/caddy /usr/bin/caddy
gateway/caddy/crowdsec/acquis.yaml
+4
View File
@@ -0,0 +1,4 @@
filenames:
- /var/log/caddy/*.log
labels:
type: caddy
gateway/docker-compose.yml
+32 -1
View File
@@ -80,18 +80,45 @@ services:
volumes: volumes:
- ./data/redis:/data - ./data/redis:/data
caddy: caddy:
image: caddy:2.8.4-alpine build:
context: ./caddy
target: caddy
container_name: gateway_caddy container_name: gateway_caddy
depends_on:
- crowdsec
restart: unless-stopped restart: unless-stopped
ports: ports:
- "80:80" - "80:80"
- "443:443" - "443:443"
- "443:443/udp" - "443:443/udp"
env_file:
- ./secrets/caddy/.env
volumes: volumes:
- ./caddy/Caddyfile:/etc/caddy/Caddyfile - ./caddy/Caddyfile:/etc/caddy/Caddyfile
- ./dashboard:/var/www/dashboard - ./dashboard:/var/www/dashboard
- caddy_data:/data - caddy_data:/data
- caddy_config:/config - caddy_config:/config
networks:
crowdsec:
security_opt:
- no-new-privileges=true
crowdsec:
image: docker.io/crowdsecurity/crowdsec:latest
container_name: gateway_crowdsec
environment:
- GID=1000
- COLLECTIONS=crowdsecurity/caddy crowdsecurity/http-cve crowdsecurity/whitelist-good-actors
env_file:
- ./secrets/crowdsec/.env
volumes:
- ./crowdsec/data:/var/lib/crowdsec/data/
- ./caddy/crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml
- caddy_logs:/var/log/caddy:ro
networks:
crowdsec:
restart: unless-stopped
security_opt:
- no-new-privileges=true
ddns: ddns:
image: timothyjmiller/cloudflare-ddns:latest image: timothyjmiller/cloudflare-ddns:latest
container_name: gateway_cloudflare_ddns container_name: gateway_cloudflare_ddns
@@ -121,5 +148,9 @@ services:
volumes: volumes:
- /var/run/docker.sock:/var/run/docker.sock - /var/run/docker.sock:/var/run/docker.sock
volumes: volumes:
caddy_logs:
caddy_data: caddy_data:
caddy_config: caddy_config:
networks:
crowdsec:
driver: bridge