mirror of
https://github.com/magnus919/agent-skills.git
synced 2026-09-16 05:56:30 +03:00
110 lines
2.9 KiB
Markdown
110 lines
2.9 KiB
Markdown
# Database Configuration
|
|
|
|
CrowdSec supports multiple database backends for the Local API.
|
|
|
|
## Supported Backends
|
|
|
|
| Backend | Type value | Best for |
|
|
|---------|------------|----------|
|
|
| SQLite | `sqlite` | Single-instance, small to medium deployments |
|
|
| MySQL | `mysql` | Distributed setups, high-volume environments |
|
|
| PostgreSQL | `postgresql` | Distributed setups, enterprise requirements |
|
|
| PGX | `pgx` | PostgreSQL with pgx driver (enhanced PostgreSQL support) |
|
|
|
|
## SQLite (Default)
|
|
|
|
```yaml
|
|
db_config:
|
|
type: sqlite
|
|
db_path: /var/lib/crowdsec/data/crowdsec.db
|
|
use_wal: true # Write-Ahead Logging for better concurrency
|
|
max_open_conns: 100
|
|
```
|
|
|
|
**WAL mode** improves performance significantly. Enable it unless the database is on a network share. When WAL is unspecified, a startup warning is shown.
|
|
|
|
## MySQL
|
|
|
|
```yaml
|
|
db_config:
|
|
type: mysql
|
|
user: crowdsec
|
|
password: "${DB_PASSWORD}"
|
|
db_name: crowdsec
|
|
host: 192.168.1.100
|
|
port: 3306
|
|
sslmode: require
|
|
max_open_conns: 100
|
|
```
|
|
|
|
Socket connection:
|
|
```yaml
|
|
db_config:
|
|
type: mysql
|
|
db_path: /var/run/mysqld/mysqld.sock
|
|
user: crowdsec
|
|
password: "${DB_PASSWORD}"
|
|
db_name: crowdsec
|
|
```
|
|
|
|
## PostgreSQL
|
|
|
|
```yaml
|
|
db_config:
|
|
type: postgresql
|
|
user: crowdsec
|
|
password: "${DB_PASSWORD}"
|
|
db_name: crowdsec
|
|
host: 192.168.1.100
|
|
port: 5432
|
|
sslmode: require
|
|
ssl_ca_cert: "/path/to/ca.crt"
|
|
ssl_client_cert: "/path/to/client.crt"
|
|
ssl_client_key: "/path/to/client.key"
|
|
max_open_conns: 100
|
|
```
|
|
|
|
## PGX (Enhanced PostgreSQL)
|
|
|
|
Same as PostgreSQL but uses the pgx driver:
|
|
|
|
```yaml
|
|
db_config:
|
|
type: pgx
|
|
user: crowdsec
|
|
password: "${DB_PASSWORD}"
|
|
db_name: crowdsec
|
|
host: 192.168.1.100
|
|
port: 5432
|
|
```
|
|
|
|
## Flush Configuration
|
|
|
|
Controls alert/metrics retention:
|
|
|
|
```yaml
|
|
db_config:
|
|
flush:
|
|
max_items: 50000 # Max alerts in DB (older ones are purged)
|
|
max_age: "7d" # Alert retention (s=seconds, m=minutes, h=hours, d=days)
|
|
metrics_max_age: "90d" # Metrics retention
|
|
|
|
# Auto-delete stale bouncers
|
|
bouncers_autodelete:
|
|
cert: "720h" # Delete TLS-authenticated bouncers after N hours without pull
|
|
api_key: "720h" # Delete API key bouncers after N hours without pull
|
|
|
|
# Auto-delete stale agents
|
|
agents_autodelete:
|
|
cert: "720h" # Delete TLS-agents after N hours without push
|
|
login_password: "720h" # Delete login/password agents after N hours without push
|
|
```
|
|
|
|
## Performance Notes
|
|
|
|
- **SQLite with WAL** is suitable for most deployments up to hundreds of decisions/second
|
|
- **MySQL/PostgreSQL** are recommended for distributed multi-instance setups
|
|
- `max_open_conns` defaults to 100 — increase if you see `too many connections` errors
|
|
- `decision_bulk_size` (default: 1000, max: 2000) controls how many decisions are inserted per query
|
|
- On low-power devices (Raspberry Pi, SD cards), raise `decision_bulk_size` to 2000 and ensure WAL is enabled
|