From 84f53ad6f6ca8bb49e6b4c346376c20fed02aadf Mon Sep 17 00:00:00 2001 From: sabban Date: Tue, 29 Jul 2025 16:13:36 +0200 Subject: [PATCH 1/6] take tko's feedback into account --- .../unversioned/bouncers/haproxy_spoa.mdx | 172 +++++++++--------- 1 file changed, 86 insertions(+), 86 deletions(-) diff --git a/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx b/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx index 1b77b8212..130ecec15 100644 --- a/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx +++ b/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx @@ -64,7 +64,7 @@ We strongly encourage the use of our packages. ### Using packages You will have to setup crowdsec repositories first [setup crowdsec -repositories](/docs/next/getting_started/install_crowdsec#install-our-repositories). +repositories](/docs/next/getting_started/u/getting_started/installation/linux). - -`/etc/crowdsec/bouncer/crowdsec-spoa-bouncer.yaml` - -```yaml -log_mode: file -log_dir: /var/log/ -log_level: info -log_compression: true -log_max_size: 100 -log_max_backups: 3 -log_max_age: 30 - -update_frequency: 10s -api_url: http://127.0.0.1:8080/ -api_key: ${API_KEY} -insecure_skip_verify: false - -workers: - - name: spoa1 - listen_addr: 0.0.0.0:9000 - listen_socket: /run/crowdsec-spoa/spoa-1.sock - -worker_user: crowdsec-spoa -worker_group: crowdsec-spoa - -asn_database_path: /var/lib/crowdsec/data/GeoLite2-ASN.mmdb -city_database_path: /var/lib/crowdsec/data/GeoLite2-City.mmdb - -admin_socket: /run/crowdsec-spoa-admin.sock - -prometheus: - enabled: true - listen_addr: 127.0.0.1 - listen_port: 60601 -``` - - -You can get a workable configuration by using the yaml above and getting and api key by: -```bash -sudo cscli bouncers add mybouncer -API key for 'bouncertest': - - JdVa7DKBM35gPDAR014pH/55l38fxLGt02NPPnZgLQI - -Please keep this key since you will not be able to retrieve it! -``` - -You can check that the bouncer is correctly installed with cscli: - -```bash -❯ sudo cscli bouncers list -────────────────────────────────────────────────────────────────────────────────────────── - Name IP Address Valid Last API pull Type -────────────────────────────────────────────────────────────────────────────────────────── - cs-spoa-bouncer-1752052534 127.0.0.1 ✔️ crowdsec-spoa-bouncer -────────────────────────────────────────────────────────────────────────────────────────── -❯ sudo cscli bouncers inspect cs-spoa-bouncer-1752052534 -────────────────────────────────────────────────────────────────────────────────────────── - Bouncer: cs-spoa-bouncer-1752052534 -────────────────────────────────────────────────────────────────────────────────────────── - Created At 2025-07-09 09:15:34.685444393 +0000 UTC - Last Update 2025-07-09 12:42:18.92023029 +0000 UTC - Revoked? false - IP Address 127.0.0.1 - Type crowdsec-spoa-bouncer - Version v0.0.3-beta29-rpm-pragmatic-arm64-db7065289a0f5ce1c92f34807c9a98b23c07dc90 - Last Pull - Auth type api-key - OS ? - Auto Created false -────────────────────────────────────────────────────────────────────────────────────────── - -``` ## HAProxy Configuration @@ -334,23 +258,98 @@ sudo mkdir -p /etc/crowdsec/bouncers/ sudo cp config/crowdsec-spoa-bouncer.yaml /etc/crowdsec/bouncers/ ``` -Edit `/etc/crowdsec/bouncers/crowdsec-spoa-bouncer.yaml`: -- Set your **LAPI URL** to point to your CrowdSec LAPI instance: - ```yaml - api_url: http://127.0.0.1:8080/ - ``` +You can always edit the configuration file at `/etc/crowdsec/bouncer/crowdsec-spoa-bouncer.yaml`: -- Generate an API key on the server where CrowdSec is intalled: - ```bash - cscli bouncers add haproxy-spoa - ``` +
+ +`/etc/crowdsec/bouncer/crowdsec-spoa-bouncer.yaml` + +```yaml +log_mode: file +log_dir: /var/log/ +log_level: info +log_compression: true +log_max_size: 100 +log_max_backups: 3 +log_max_age: 30 + +update_frequency: 10s +api_url: http://127.0.0.1:8080/ +api_key: ${API_KEY} +insecure_skip_verify: false + +workers: + - name: spoa1 + listen_addr: 0.0.0.0:9000 + listen_socket: /run/crowdsec-spoa/spoa-1.sock + +worker_user: crowdsec-spoa +worker_group: crowdsec-spoa + +asn_database_path: /var/lib/crowdsec/data/GeoLite2-ASN.mmdb +city_database_path: /var/lib/crowdsec/data/GeoLite2-City.mmdb + +admin_socket: /run/crowdsec-spoa-admin.sock + +prometheus: + enabled: true + listen_addr: 127.0.0.1 + listen_port: 60601 +``` +
+ +You can get a workable configuration by using the yaml above and getting and api key by: +```bash +sudo cscli bouncers add mybouncer +API key for 'bouncertest': + + JdVa7DKBM35gPDAR014pH/55l38fxLGt02NPPnZgLQI +Please keep this key since you will not be able to retrieve it! +``` - Paste the key into: ```yaml api_key: your-generated-key ``` + +In the `/etc/crowdsec/bouncers/crowdsec-spoa-bouncer.yaml` file the following +keys are of some importance: + +- Set your **LAPI URL** to point to your CrowdSec LAPI instance: + ```yaml + api_url: http://127.0.0.1:8080/ + ``` + +You can check that the bouncer is correctly installed with cscli: + +```bash +❯ sudo cscli bouncers list +────────────────────────────────────────────────────────────────────────────────────────── + Name IP Address Valid Last API pull Type +────────────────────────────────────────────────────────────────────────────────────────── + cs-spoa-bouncer-1752052534 127.0.0.1 ✔️ crowdsec-spoa-bouncer +────────────────────────────────────────────────────────────────────────────────────────── +❯ sudo cscli bouncers inspect cs-spoa-bouncer-1752052534 +────────────────────────────────────────────────────────────────────────────────────────── + Bouncer: cs-spoa-bouncer-1752052534 +────────────────────────────────────────────────────────────────────────────────────────── + Created At 2025-07-09 09:15:34.685444393 +0000 UTC + Last Update 2025-07-09 12:42:18.92023029 +0000 UTC + Revoked? false + IP Address 127.0.0.1 + Type crowdsec-spoa-bouncer + Version v0.0.3-beta29-rpm-pragmatic-arm64-db7065289a0f5ce1c92f34807c9a98b23c07dc90 + Last Pull + Auth type api-key + OS ? + Auto Created false +────────────────────────────────────────────────────────────────────────────────────────── + +``` + + Create runtime socket directory and crowdsec-spoa user: ```bash @@ -359,6 +358,7 @@ sudo mkdir -p /run/crowdsec-spoa sudo chown crowdsec-spoa:crowdsec-spoa /run/crowdsec-spoa ``` + #### Configure HAProxy ##### Lua Integration & Environment Variables From 01400d8b8b611e9e890621e0c6b17aa7d192dd28 Mon Sep 17 00:00:00 2001 From: sabban Date: Tue, 29 Jul 2025 16:28:21 +0200 Subject: [PATCH 2/6] typo --- crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx b/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx index 130ecec15..d5d6ff499 100644 --- a/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx +++ b/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx @@ -64,7 +64,7 @@ We strongly encourage the use of our packages. ### Using packages You will have to setup crowdsec repositories first [setup crowdsec -repositories](/docs/next/getting_started/u/getting_started/installation/linux). +repositories](/u/getting_started/installation/linux). Date: Tue, 29 Jul 2025 16:39:38 +0200 Subject: [PATCH 3/6] link to crowdsec-spoa-bouncer.yaml file update --- crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx b/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx index d5d6ff499..547a6657d 100644 --- a/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx +++ b/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx @@ -99,6 +99,10 @@ configuration file `/etc/crowdsec/bouncer/crowdsec-spoa-bouncer.yaml` should already be in a working state, and can skip this section and begin with HAProxy Configuration. +If your CrowdSec Engine is installed on an other server, you'll have to [update +the `/etc/crowdsec/bouncer/crowdsec-spoa-bouncer.yaml` +file](u/bouncers/haproxy_spoa/#manual-installation-and-advanced-configuration). + ## HAProxy Configuration From 5eae8a5a9e8a755512aaaedd6741671402dbf98c Mon Sep 17 00:00:00 2001 From: sabban Date: Tue, 29 Jul 2025 16:46:49 +0200 Subject: [PATCH 4/6] typo --- crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx b/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx index 547a6657d..fa3595608 100644 --- a/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx +++ b/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx @@ -101,7 +101,7 @@ Configuration. If your CrowdSec Engine is installed on an other server, you'll have to [update the `/etc/crowdsec/bouncer/crowdsec-spoa-bouncer.yaml` -file](u/bouncers/haproxy_spoa/#manual-installation-and-advanced-configuration). +file](/haproxy_spoa/#manual-installation-and-advanced-configuration). ## HAProxy Configuration From 9e5a5bfdaf4c0ac441232a2d53810534b07522f3 Mon Sep 17 00:00:00 2001 From: sabban Date: Tue, 29 Jul 2025 16:53:46 +0200 Subject: [PATCH 5/6] typo --- crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx b/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx index fa3595608..979c76f36 100644 --- a/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx +++ b/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx @@ -101,7 +101,7 @@ Configuration. If your CrowdSec Engine is installed on an other server, you'll have to [update the `/etc/crowdsec/bouncer/crowdsec-spoa-bouncer.yaml` -file](/haproxy_spoa/#manual-installation-and-advanced-configuration). +file](/u/bouncers/haproxy_spoa/#manual-installation-and-advanced-configuration). ## HAProxy Configuration From c3fa7d546aa4b14726c9641310880c445b93f2dd Mon Sep 17 00:00:00 2001 From: sabban Date: Tue, 29 Jul 2025 17:45:16 +0200 Subject: [PATCH 6/6] link to the actual file management --- crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx b/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx index 979c76f36..f8b0ca8e1 100644 --- a/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx +++ b/crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx @@ -101,7 +101,7 @@ Configuration. If your CrowdSec Engine is installed on an other server, you'll have to [update the `/etc/crowdsec/bouncer/crowdsec-spoa-bouncer.yaml` -file](/u/bouncers/haproxy_spoa/#manual-installation-and-advanced-configuration). +file](/u/bouncers/haproxy_spoa#configure-the-bouncer). ## HAProxy Configuration