viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

reenable crowdsec and fix real ip for clients[ci skip]

Browse source
This commit is contained in:
Viktor Barzin 2024-10-10 22:01:54 +00:00
parent c3637cba26
commit 1e823ccc3c
3 changed files with 18 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

8
modules/kubernetes/main.tf
View file

@ -361,10 +361,10 @@ module "nginx-ingress" {
crowdsec_captcha_site_key = var.ingress_crowdsec_captcha_site_key crowdsec_captcha_site_key = var.ingress_crowdsec_captcha_site_key
} }
# module "crowdsec" { module "crowdsec" {
# source = "./crowdsec" source = "./crowdsec"
# tls_secret_name = var.tls_secret_name tls_secret_name = var.tls_secret_name
# } }
# Seems like it needs S3 even if pg is local... # Seems like it needs S3 even if pg is local...
# module "resume" { # module "resume" {

19
modules/kubernetes/nginx-ingress/main.tf
View file

@ -310,7 +310,9 @@ resource "kubernetes_config_map" "ingress_nginx_controller" {
} }
} }
data = { data = {
allow-snippet-annotations = true allow-snippet-annotations = true
# limit-req-status-code = 429
# limit-conn-status-code = 429
enable-modsecurity = true enable-modsecurity = true
enable-owasp-modsecurity-crs = false enable-owasp-modsecurity-crs = false
modsecurity-snippet : <<-EOT modsecurity-snippet : <<-EOT
@ -326,9 +328,9 @@ resource "kubernetes_config_map" "ingress_nginx_controller" {
setvar:tx.block_harvester_ip=1,\ setvar:tx.block_harvester_ip=1,\
setvar:tx.block_spammer_ip=1" setvar:tx.block_spammer_ip=1"
EOT EOT
# plugins = "crowdsec" plugins = "crowdsec"
plugins = "" # plugins = ""
lua-shared-dicts = "crowdsec_cache: 500m" lua-shared-dicts = "crowdsec_cache: 50m"
server-snippet : <<-EOT server-snippet : <<-EOT
lua_ssl_trusted_certificate "/etc/ssl/certs/ca-certificates.crt"; # Captcha lua_ssl_trusted_certificate "/etc/ssl/certs/ca-certificates.crt"; # Captcha
#resolver local=on ipv6=off valid=600s; #resolver local=on ipv6=off valid=600s;
@ -365,7 +367,8 @@ resource "kubernetes_service" "ingress_nginx_controller" {
"app.kubernetes.io/instance" = "ingress-nginx" "app.kubernetes.io/instance" = "ingress-nginx"
"app.kubernetes.io/name" = "ingress-nginx" "app.kubernetes.io/name" = "ingress-nginx"
} }
type = "LoadBalancer" type = "LoadBalancer"
external_traffic_policy = "Local" // see https://metallb.universe.tf/usage/
# ip_families = ["IPv4"] # ip_families = ["IPv4"]
} }
} }
@ -452,6 +455,8 @@ resource "kubernetes_deployment" "ingress_nginx_controller" {
value = "http://crowdsec-service.crowdsec.svc.cluster.local:8080" value = "http://crowdsec-service.crowdsec.svc.cluster.local:8080"
} }
env { env {
// if you can't connect with bouncer not found, regenerate api key with:
// "cscli bouncers add nginx" on the lapi
name = "API_KEY" name = "API_KEY"
value = var.crowdsec_api_key value = var.crowdsec_api_key
} }
@ -488,7 +493,9 @@ resource "kubernetes_deployment" "ingress_nginx_controller" {
name = "BOUNCER_CONFIG" name = "BOUNCER_CONFIG"
value = "/crowdsec/crowdsec-bouncer.conf" value = "/crowdsec/crowdsec-bouncer.conf"
} }
command = ["sh", "-c", "sh /docker_start.sh; mkdir -p /lua_plugins/crowdsec/; cp -r /crowdsec /lua_plugins/; chown -R 101:101 /lua_plugins/"] # command = ["sh", "-c", "sh /docker_start.sh; mkdir -p /lua_plugins/crowdsec/; cp -r /crowdsec /lua_plugins/; chown -R 101:101 /lua_plugins/"]
command = ["sh", "-c", "sh /docker_start.sh; mkdir -p /lua_plugins/crowdsec/; cp -R /crowdsec/* /lua_plugins/crowdsec/"]
volume_mount { volume_mount {
name = "crowdsec" name = "crowdsec"
mount_path = "/lua_plugins" mount_path = "/lua_plugins"

1
modules/kubernetes/paperless-ngx/main.tf
View file

@ -142,6 +142,7 @@ resource "kubernetes_ingress_v1" "paperless-ngx" {
annotations = { annotations = {
"kubernetes.io/ingress.class" = "nginx" "kubernetes.io/ingress.class" = "nginx"
"nginx.ingress.kubernetes.io/proxy-body-size" : "100000m" "nginx.ingress.kubernetes.io/proxy-body-size" : "100000m"
# "nginx.ingress.kubernetes.io/limit-rpm": "5"
} }
} }