Eduardo David Paredes Vara
97 lines
3.4 KiB
Bash
Executable File
97 lines
3.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# ============================================================
|
|
# CrowdSec Setup Script
|
|
# ============================================================
|
|
# Este script prepara los directorios, genera la clave del
|
|
# bouncer y despliega la configuracion dinamica de Traefik.
|
|
# ============================================================
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
ENV_FILE="${SCRIPT_DIR}/.env"
|
|
|
|
echo "=== CrowdSec Setup ==="
|
|
|
|
# 1. Cargar .env
|
|
if [ ! -f "${ENV_FILE}" ]; then
|
|
echo "ERROR: No se encontro ${ENV_FILE}"
|
|
echo "Crea ${ENV_FILE} con las variables reales y editalo:"
|
|
echo " nano ${ENV_FILE}"
|
|
exit 1
|
|
fi
|
|
set -a
|
|
source "${ENV_FILE}"
|
|
set +a
|
|
|
|
# 2. Generar clave del bouncer si no esta definida
|
|
if [ "${CROWDSEC_BOUNCER_API_KEY}" = "change-me-to-a-random-64-char-hex" ] || [ -z "${CROWDSEC_BOUNCER_API_KEY}" ]; then
|
|
CROWDSEC_BOUNCER_API_KEY=$(openssl rand -hex 32)
|
|
echo "INFO: Generada nueva CROWDSEC_BOUNCER_API_KEY"
|
|
sed -i "s/^CROWDSEC_BOUNCER_API_KEY=.*/CROWDSEC_BOUNCER_API_KEY=${CROWDSEC_BOUNCER_API_KEY}/" "${ENV_FILE}"
|
|
fi
|
|
|
|
# 3. Crear directorios necesarios
|
|
sudo mkdir -p "${CROWDSEC_CONFIG_PATH}"
|
|
sudo mkdir -p "${CROWDSEC_DATA_PATH}"
|
|
sudo mkdir -p "${TRAEFIK_LOG_PATH}"
|
|
|
|
# 4. Ajustar permisos para SELinux
|
|
if command -v selinuxenabled &>/dev/null && selinuxenabled; then
|
|
sudo chcon -Rt svirt_sandbox_file_t "${CROWDSEC_CONFIG_PATH}" 2>/dev/null || true
|
|
sudo chcon -Rt svirt_sandbox_file_t "${CROWDSEC_DATA_PATH}" 2>/dev/null || true
|
|
sudo chcon -Rt svirt_sandbox_file_t "${TRAEFIK_LOG_PATH}" 2>/dev/null || true
|
|
fi
|
|
|
|
# 5. Generar Traefik dynamic config con la key del bouncer
|
|
TRAEFIK_DYNAMIC_DIR="/opt/traefik/dynamic"
|
|
TEMPLATE="${SCRIPT_DIR}/traefik-crowdsec-bouncer.yml"
|
|
OUTPUT="${TRAEFIK_DYNAMIC_DIR}/crowdsec-bouncer.yml"
|
|
|
|
if [ -f "${TEMPLATE}" ]; then
|
|
sudo mkdir -p "${TRAEFIK_DYNAMIC_DIR}"
|
|
sed "s/{{CROWDSEC_BOUNCER_API_KEY}}/${CROWDSEC_BOUNCER_API_KEY}/g" "${TEMPLATE}" | sudo tee "${OUTPUT}" > /dev/null
|
|
echo "INFO: Traefik dynamic config generado en ${OUTPUT}"
|
|
else
|
|
echo "WARN: No se encontro ${TEMPLATE}, la config dinamica de Traefik debe crearse manualmente"
|
|
fi
|
|
|
|
# 6. Generar acquis.yaml para CrowdSec (lee logs de Traefik)
|
|
ACQUIS_FILE="${CROWDSEC_CONFIG_PATH}/acquis.yaml"
|
|
if [ ! -f "${ACQUIS_FILE}" ]; then
|
|
sudo tee "${ACQUIS_FILE}" > /dev/null <<EOF
|
|
---
|
|
source: file
|
|
filenames:
|
|
- /var/log/traefik/access.log
|
|
labels:
|
|
type: traefik
|
|
EOF
|
|
echo "INFO: acquis.yaml generado en ${ACQUIS_FILE}"
|
|
fi
|
|
|
|
# 7. Generar acquis.yaml para Docker logs
|
|
ACQUIS_DOCKER="${CROWDSEC_CONFIG_PATH}/acquis-docker.yaml"
|
|
if [ ! -f "${ACQUIS_DOCKER}" ]; then
|
|
sudo tee "${ACQUIS_DOCKER}" > /dev/null <<EOF
|
|
---
|
|
source: docker
|
|
EOF
|
|
echo "INFO: acquis-docker.yaml generado para logs de contenedores"
|
|
fi
|
|
|
|
# ============================================================
|
|
echo ""
|
|
echo "=== Setup completado ==="
|
|
echo ""
|
|
echo "Siguientes pasos:"
|
|
echo " 1. (Re)desplegar Traefik para activar los plugins y access logs"
|
|
echo " 2. Desplegar CrowdSec: cd ${SCRIPT_DIR} && docker compose up -d"
|
|
echo " 3. Verificar: docker logs crowdsec"
|
|
echo " 4. El middleware se usa asi: crowdsec-bouncer@file"
|
|
echo ""
|
|
echo "Para proteger un servicio, agrega el middleware en sus labels de Traefik:"
|
|
echo ' traefik.http.routers.<svc>.middlewares: "crowdsec-bouncer@file"'
|
|
echo ""
|
|
echo "Dashboard Grafana (requiere Authentik): https://${CROWDSEC_GRAFANA_DOMAIN}"
|