mirror of
https://github.com/magnus919/agent-skills.git
synced 2026-09-14 21:16:36 +03:00
133 lines
3.4 KiB
Markdown
133 lines
3.4 KiB
Markdown
# Docker Deployment Guide
|
|
|
|
## Quick Start
|
|
|
|
```bash
|
|
docker run -d \
|
|
--name crowdsec \
|
|
--volume /etc/crowdsec:/etc/crowdsec \
|
|
--volume /var/lib/crowdsec/data/:/var/lib/crowdsec/data/ \
|
|
--volume /var/log:/var/log:ro \
|
|
--env COLLECTIONS="crowdsecurity/linux" \
|
|
-p 127.0.0.1:8080:8080 \
|
|
crowdsecurity/crowdsec:latest
|
|
```
|
|
|
|
## Docker Compose (Recommended)
|
|
|
|
```yaml
|
|
services:
|
|
crowdsec:
|
|
image: crowdsecurity/crowdsec:latest
|
|
restart: always
|
|
ports:
|
|
- 127.0.0.1:8080:8080 # LAPI for bouncers on host or Docker
|
|
- 127.0.0.1:6060:6060 # Prometheus metrics
|
|
- 127.0.0.1:7422:7422 # AppSec WAF
|
|
environment:
|
|
COLLECTIONS: "crowdsecurity/traefik crowdsecurity/http-cve crowdsecurity/base-http-scenarios crowdsecurity/sshd crowdsecurity/linux"
|
|
GID: "${GID-1000}"
|
|
TZ: "UTC"
|
|
volumes:
|
|
- ./crowdsec/config:/etc/crowdsec
|
|
- ./crowdsec/data:/var/lib/crowdsec/data
|
|
# Log sources — mount from host or shared volume
|
|
- /var/log/auth.log:/var/log/auth.log:ro
|
|
- /var/log/syslog:/var/log/syslog:ro
|
|
- ./traefik/logs:/var/log/traefik:ro
|
|
networks:
|
|
- proxy
|
|
|
|
networks:
|
|
proxy:
|
|
external: true
|
|
```
|
|
|
|
## Key Aspects
|
|
|
|
### 1. Log Access
|
|
Mount log files from the host or shared volumes:
|
|
```yaml
|
|
volumes:
|
|
- /var/log/auth.log:/var/log/auth.log:ro
|
|
- /var/log/syslog:/var/log/syslog:ro
|
|
- logs-volume:/var/log/nginx:ro # Shared volume with nginx container
|
|
```
|
|
|
|
### 2. Persist Data
|
|
Persisting these volumes is **mandatory** since CrowdSec v1.7.0:
|
|
```yaml
|
|
volumes:
|
|
- crowdsec-db:/var/lib/crowdsec/data/
|
|
- crowdsec-config:/etc/crowdsec/
|
|
```
|
|
|
|
### 3. Use `depends_on`
|
|
If reading logs from a container that writes logs to a shared volume:
|
|
```yaml
|
|
depends_on:
|
|
- "reverse-proxy"
|
|
```
|
|
|
|
### 4. Network
|
|
CrowdSec must be on the same Docker network as bouncers (e.g., Traefik).
|
|
|
|
## Environment Variables
|
|
|
|
| Variable | Default | Description |
|
|
|----------|---------|-------------|
|
|
| `COLLECTIONS` | *(none)* | Space-separated list of collections to install |
|
|
| `TZ` | `UTC` | Timezone |
|
|
| `CONFIG_FILE` | `/etc/crowdsec/config.yaml` | Main config path |
|
|
| `LOCAL_API_URL` | `http://0.0.0.0:8080` | LAPI listen address |
|
|
| `DISABLE_LOCAL_API` | `false` | Agent-only mode (no LAPI) |
|
|
| `DISABLE_AGENT` | `false` | LAPI-only mode (no agent) |
|
|
| `AGENT_USERNAME` | *(none)* | For connecting to remote LAPI |
|
|
| `AGENT_PASSWORD` | *(none)* | For connecting to remote LAPI |
|
|
| `BOUNCER_KEY_<name>` | *(none)* | Seed API key for a bouncer |
|
|
|
|
## Enrolling in Console (Docker)
|
|
|
|
```bash
|
|
docker exec crowdsec cscli console enroll -e context <YOUR_ENROLL_KEY>
|
|
```
|
|
|
|
## Execing Commands in Docker
|
|
|
|
All `cscli` commands work via `docker exec`:
|
|
|
|
```bash
|
|
docker exec crowdsec cscli collections list
|
|
docker exec crowdsec cscli bouncers add traefik-bouncer
|
|
docker exec crowdsec cscli metrics
|
|
docker exec crowdsec cscli decisions list
|
|
```
|
|
|
|
## Volumes vs Bind Mounts
|
|
|
|
| Approach | Pros | Cons |
|
|
|----------|------|------|
|
|
| Named volumes | Managed by Docker, portable | Harder to inspect/modify |
|
|
| Bind mounts | Easy to edit config directly | Permissions issues on some hosts |
|
|
|
|
For production, use bind mounts for config (so you can edit) and named volumes for data.
|
|
|
|
## Logrotate for Docker
|
|
|
|
Log files can grow quickly. Configure logrotate on the host:
|
|
|
|
```bash
|
|
# /etc/logrotate.d/traefik
|
|
compress
|
|
/mnt/docker-volumes/traefik/logs/*.log {
|
|
size 20M
|
|
daily
|
|
rotate 14
|
|
missingok
|
|
notifempty
|
|
postrotate
|
|
docker kill --signal="USR1" traefik
|
|
endscript
|
|
}
|
|
```
|