Eduardo David Paredes Vara
126 lines
4.4 KiB
YAML
126 lines
4.4 KiB
YAML
services:
|
|
crowdsec:
|
|
image: ${CROWDSEC_IMAGE}
|
|
container_name: crowdsec
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
cap_add:
|
|
- NET_BIND_SERVICE
|
|
environment:
|
|
COLLECTIONS: ${CROWDSEC_COLLECTIONS}
|
|
BOUNCER_KEY_TRAEFIK: ${CROWDSEC_BOUNCER_API_KEY}
|
|
LEVEL: ${CROWDSEC_LOG_LEVEL}
|
|
TZ: ${TZ:-America/Mexico_City}
|
|
POSTGRES_HOST: crowdsec-postgres
|
|
POSTGRES_PORT: "5432"
|
|
POSTGRES_DB: ${CROWDSEC_POSTGRES_DB}
|
|
POSTGRES_USER: ${CROWDSEC_POSTGRES_USER}
|
|
POSTGRES_PASSWORD: ${CROWDSEC_POSTGRES_PASSWORD}
|
|
volumes:
|
|
- ${CROWDSEC_CONFIG_PATH}:/etc/crowdsec:Z
|
|
- crowdsec_lib:/var/lib/crowdsec
|
|
- ${TRAEFIK_LOG_PATH}:/var/log/traefik:ro
|
|
- /var/log:/var/log/host:ro
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
expose:
|
|
- "8080"
|
|
- "7422"
|
|
ports:
|
|
- "127.0.0.1:8080:8080"
|
|
networks:
|
|
- crowdsec_internal
|
|
- proxy
|
|
healthcheck:
|
|
test: ["CMD", "cscli", "lapi", "status"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
|
|
crowdsec-postgres:
|
|
image: ${CROWDSEC_POSTGRES_IMAGE}
|
|
container_name: crowdsec-postgres
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: ${CROWDSEC_POSTGRES_USER}
|
|
POSTGRES_PASSWORD: ${CROWDSEC_POSTGRES_PASSWORD}
|
|
POSTGRES_DB: ${CROWDSEC_POSTGRES_DB}
|
|
volumes:
|
|
- ${CROWDSEC_POSTGRES_PATH}:/var/lib/postgresql/data:Z
|
|
networks:
|
|
- crowdsec_internal
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${CROWDSEC_POSTGRES_USER} -d ${CROWDSEC_POSTGRES_DB}"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
crowdsec-prometheus:
|
|
image: prom/prometheus@sha256:e4254400b85610324913f0dc4acf92603d9984e7519414c5a12811aa6146acc3
|
|
container_name: crowdsec-prometheus
|
|
restart: unless-stopped
|
|
command:
|
|
- "--config.file=/etc/prometheus/prometheus.yml"
|
|
- "--storage.tsdb.path=/prometheus"
|
|
- "--storage.tsdb.retention.time=7d"
|
|
- "--web.enable-lifecycle"
|
|
volumes:
|
|
- ${CROWDSEC_PROMETHEUS_CONFIG}/prometheus.yml:/etc/prometheus/prometheus.yml:ro
|
|
- ${CROWDSEC_PROMETHEUS_PATH}:/prometheus:Z
|
|
networks:
|
|
- crowdsec_internal
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-q", "--spider", "http://localhost:9090/-/healthy"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
|
|
crowdsec-grafana:
|
|
image: ${GRAFANA_IMAGE}
|
|
container_name: crowdsec-grafana
|
|
restart: unless-stopped
|
|
environment:
|
|
GF_SERVER_ROOT_URL: https://${CROWDSEC_GRAFANA_DOMAIN}
|
|
GF_AUTH_PROXY_ENABLED: "true"
|
|
GF_AUTH_PROXY_HEADER_NAME: X-Authentik-Username
|
|
GF_AUTH_PROXY_HEADER_EMAIL: X-Authentik-Email
|
|
GF_AUTH_PROXY_HEADER_GROUPS: X-Authentik-Groups
|
|
GF_AUTH_PROXY_AUTO_SIGN_UP: "true"
|
|
GF_AUTH_PROXY_ENABLE_LOGIN_TOKEN: "false"
|
|
GF_AUTH_DISABLE_LOGIN_FORM: "true"
|
|
GF_AUTH_SIGNOUT_REDIRECT: https://${AUTHENTIK_DOMAIN:-auth.sherlockhomeless.net}/application/o/${CROWDSEC_GRAFANA_SLUG:-grafana}/end-session/
|
|
volumes:
|
|
- ${CROWDSEC_GRAFANA_PATH}:/var/lib/grafana:Z
|
|
- ${CROWDSEC_GRAFANA_PROVISIONING}:/etc/grafana/provisioning:ro
|
|
- ${CROWDSEC_GRAFANA_DASHBOARDS}:/var/lib/grafana/dashboards:ro
|
|
networks:
|
|
- crowdsec_internal
|
|
- proxy
|
|
labels:
|
|
traefik.enable: "true"
|
|
traefik.docker.network: "${TRAEFIK_DOCKER_NETWORK}"
|
|
traefik.http.routers.crowdsec-grafana.rule: "Host(`${CROWDSEC_GRAFANA_DOMAIN}`)"
|
|
traefik.http.routers.crowdsec-grafana.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
|
|
traefik.http.routers.crowdsec-grafana.tls: "true"
|
|
traefik.http.routers.crowdsec-grafana.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
|
|
traefik.http.routers.crowdsec-grafana.service: "crowdsec-grafana"
|
|
traefik.http.routers.crowdsec-grafana.middlewares: "crowdsec-bouncer@file,${TRAEFIK_AUTH_MIDDLEWARE}"
|
|
traefik.http.services.crowdsec-grafana.loadbalancer.server.port: "3000"
|
|
homepage.group: "Observabilidad"
|
|
homepage.name: "Grafana"
|
|
homepage.href: "https://${CROWDSEC_GRAFANA_DOMAIN}"
|
|
homepage.description: "Dashboards CrowdSec y monitorizacion"
|
|
homepage.icon: "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/grafana.svg"
|
|
homepage.siteMonitor: "https://${CROWDSEC_GRAFANA_DOMAIN}"
|
|
|
|
networks:
|
|
crowdsec_internal:
|
|
driver: bridge
|
|
proxy:
|
|
external: true
|
|
|
|
volumes:
|
|
crowdsec_lib:
|